ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://server-azure-tau.vercel.app/api/ipcheck-encrypted/606.

Database Entry

IOC ID:	1916638
IOC:	https://server-azure-tau.vercel.app/api/ipcheck-encrypted/606
IOC Type :	url
Threat Type :	botnet_cc
Malware:	BeaverTail
Confidence Level :	Confidence level is elevated (75%)
Is compromised? :	False
ASN:	AS16509 AMAZON-02
Country:	US
First seen:	2026-09-13 15:34:51 UTC
Last seen:	never
UUID:	bcc4e679-af7a-11f1-b569-42010aa4000a
Reporter	Isk0o
Reward	5 credits from ThreatFox
Tags:	c2 contagious-interview NodeJS
Reference:	https://github.com/rsaw409/DeFi/blob/3458db9309eeccfdc4f4534a5adeabf24c3c63d7/server/.env

Isk0o

Static GitHub analysis shows this URL Base64-encoded as AUTH_AIP_KEY together with Base64 values for x-secret-header and secret. server/middleware/errorHandler.js decodes these values, performs the remote request and executes an HTTP error response through Function.constructor("require", ...); server/routes/api/profile.js invokes errorTimeHandler(). The endpoint was not contacted during this investigation. Behavior matches the same Contagious Interview / BeaverTail loader family.