🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://walter-server.vercel.app/api/ipcheck-encrypted/606.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1916636
IOC: https://walter-server.vercel.app/api/ipcheck-encrypted/606
IOC Type :url
Threat Type :botnet_cc
Malware: BeaverTail
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS16509 AMAZON-02
Country:- US
First seen:2026-09-13 15:34:52 UTC
Last seen:never
UUID:bb81e9c0-af7a-11f1-b569-42010aa4000a
Reporter Isk0o
Reward 5 credits from ThreatFox
Tags:c2 contagious-interview NodeJS
Reference: https://github.com/HiCodename47/Binance_assessment/blob/a2bc97f4ed0795387af6b6f25a1c9407a7e7baf4/server/.env

Avatar
Isk0o
Static GitHub analysis shows this URL Base64-encoded as AUTH_AIP_KEY together with Base64 values for x-secret-header and secret. server/middleware/errorHandler.js decodes these values, performs the remote request and executes an HTTP error response through Function.constructor("require", ...); server/routes/api/profile.js invokes errorTimeHandler(). The endpoint was not contacted during this investigation. Behavior matches the same Contagious Interview / BeaverTail loader family.