178[.]236[.]252[.]133

Posts referencing this indicator

• Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

  Socket

  C2 server for Chrome extension versions 1.1 and 1.2; used for clipboard exfiltration and proxy-location retrieval

  2026-07-02