ThreatFox IOC Database

You are viewing the ThreatFox database entry for url http://151.80.76.67:1224/api/checkStatus.

Database Entry

IOC ID:	1906039
IOC:	http://151.80.76.67:1224/api/checkStatus
IOC Type :	url
Threat Type :	botnet_cc
Malware:	BeaverTail
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
ASN:	AS16276 OVH
Country:	FR
First seen:	2026-09-09 10:14:36 UTC
Last seen:	never
UUID:	e8ce9486-ac2c-11f1-b569-42010aa4000a
Reporter	luisalbinati
Reward	5 credits from ThreatFox
Tags:	BeaverTail ContagiousInterview EXFILTRATION FamousChollima

luisalbinati

Exfiltration and command endpoint. Backdoor in routes/api/auth.js of the lure repo posted the full process environment here with header 'x-app-request: ip-check', then executed the HTTP response via new Function(require, response.data). URL was base64-encoded in the AUTH_API env var: aHR0cDovLzE1MS44MC43Ni42NzoxMjI0L2FwaS9jaGVja1N0YXR1cw== . Observed 2026-09-07.