ThreatFox IOC Database
You are viewing the ThreatFox database entry for ip:port 153.75.245.123:1224.
Database Entry
| IOC ID: | 1855539 |
|---|---|
| IOC: | 153.75.245.123:1224 |
| IOC Type : | ip:port |
| Threat Type : | botnet_cc |
| Malware: | Unknown Loader |
| Confidence Level : | Confidence level is elevated (75%) |
| Is compromised? : | True |
| ASN: | AS19318 IS-AS-1 |
| Country: |  US |
| First seen: | 2026-07-23 05:12:42 UTC |
| Last seen: | never |
| UUID: | 335be800-8609-11f1-8973-42010aa4000a |
| Reporter |  adklempner |
| Reward | 5 credits from ThreatFox |
| Tags: | BeaverTail ContagiousInterview npm supply-chain |
| Reference: | https://www.npmjs.com/package/animated-css-kit |
adklempner
> I've identified two live malicious npm packages that appear to be part of the> Contagious Interview campaign, delivered via a fake recruitment take-home exercise.
>
> `tailwind-motionkit@1.0.3` depends on `animated-css-kit@1.0.1`, whose
> `src/side-effects.js` is a 35KB obfuscated loader executing on PostCSS plugin
> construction — build time, not install time, so `--ignore-scripts` doesn't mitigate.
> It POSTs to `http://153.75.245.123:1224/debugCheck` and builds a second stage via
> `(function(){}.constructor("return this")())`.
>
> This is a republication after npm security-held the same operator's earlier package
> `postcss-animatecss` on 2026-07-07 — the replacement went up under a different
> maintainer account ~24h later. Reported to npm and GitHub; both packages were still
> live as of 2026-07-22.
```
C2: http://153.75.245.123:1224/debugCheck
IP: 153.75.245.123 (ASN 19318, InterServer, rDNS vps3373073.trouble-free.net)
npm packages: tailwind-motionkit 1.0.1, 1.0.2, 1.0.3
animated-css-kit 1.0.1
postcss-animatecss (previously security-held by npm, 2026-07-07)
maintainers: romisyahridev, taylorhunttech
GitHub: github.com/anton-modaresi/Aurelia-Stay (private/removed)
github.com/anton-modaresi (account, created 2026-04-19)
github.com/anton-modaresi/Telepsychiatry-pra (possible second lure)
fake repo URLs in package metadata (both 404):
github.com/dumptyd/tailwind-motionkit
github.com/dumptyd/animated-css-kit
payload SHA-256: f8f786eaf000460bb05e883492c6d9d547b792fbb478c0cbe09d1dd1fa1a25ba
tarball SHA-256: cff1851c3f0c70024bff48a338b4ed1cd227c50b0f61396800219b844e0edfa3 (animated-css-kit 1.0.1)
c305c86d04eacec3cb600ca5581f128c196a521e31d90d16dfdcdd9589f40df5 (tailwind-motionkit 1.0.3)
decoy string: "Tailwind engine failed to load after all retries"
```