ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://api-server-mocha.vercel.app/api/ipcheck-encrypted/607.

Database Entry

IOC ID:	1916639
IOC:	https://api-server-mocha.vercel.app/api/ipcheck-encrypted/607
IOC Type :	url
Threat Type :	botnet_cc
Malware:	BeaverTail
Confidence Level :	Confidence level is elevated (75%)
Is compromised? :	False
ASN:	AS16509 AMAZON-02
Country:	US
First seen:	2026-09-13 15:34:51 UTC
Last seen:	never
UUID:	bd63419c-af7a-11f1-b569-42010aa4000a
Reporter	Isk0o
Reward	5 credits from ThreatFox
Tags:	c2 contagious-interview NodeJS
Reference:	https://github.com/SURUJ404/swapball/blob/460393ae8cdc737b1a898dc9b3d3f9ed50d48d61/server/.env

Isk0o

Static GitHub analysis shows this URL Base64-encoded as AUTH_AIP_KEY together with Base64 values for x-secret-header and secret. server/middleware/errorHandler.js decodes these values, performs the remote request and executes an HTTP error response through Function.constructor("require", ...); server/routes/api/profile.js invokes errorTimeHandler(). The endpoint was not contacted during this investigation. Behavior matches the same Contagious Interview / BeaverTail loader family.