Skip to content
.ca
Home
Posts
Engagements
Recaps
IOCs
Detections
About
Search posts and IOCs
sign in
Loading…
indicator
url
hxxp[:]//localhost:3002/crypto-data
copy defanged
copy refanged (live)
First seen
2026-05-14
Last seen
2026-05-14
Sightings
1
Posts referencing this indicator
Analyzing the Current State of AI Use in Malware
Palo Alto Networks
Default C2 URL used by the .NET infostealer to exfiltrate stolen data in JSON format.
2026-05-13
http://localhost:3002/crypto-data · URL · cyfar.ca
