Essential information

Value / Name

94.159.113.32

Confidence

100/100

Revoked

Yes

Valid from

09/12/2025 06:39

Valid until

02/01/2026 08:26

Pattern type

stix

Published

20/12/2025 20:02

Modified

15/01/2026 16:40

Author / Source

AlienVault

Description

No description.

Pattern

[ipv4-addr:value = '94.159.113.32']

Labels / Tags

Labels: booking.com castlebot castleloader castlerat clickfix credential theft evasion loader logistics malware-as-a-service matanbuchus memory-only multi-stage netsupport rat phishing process hollowing sectoprat warmcookie

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.