185[.]204[.]1[.]225

Posts referencing this indicator

• From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach

  FFortinet

  First observed external IP abusing stolen Jenkins instance role credentials for cloud reconnaissance and IAM privilege escalation

  2026-07-06