Evilginx
Evilginx Go-based AitM phishing proxy — credential and session-cookie harvester
1329
Hosts
Threat Attribution
otx
NSO Group - MIrai - Botnets - Spyware - Law enforcement - Intelligence agencies - Others
Trojan, Trojan Downloader, stealer
Referenced in 41 OTX pulses
virustotal
Malicious: 0 | AS: Microsoft Corporation | Country: US
Results for "13.107.246.69" (0)
No results found.
Recent Hosts
| IP | Port | Country | Cert SHA256 | Cert Serial | Subject CN | Issuer CN | Server | Target | Indicators | Last Seen |
|---|---|---|---|---|---|---|---|---|---|---|
| 185.199.110.153 | 443 | US | 32491b26bfaf | 598823547690534085216884722173052752111645 | *.github.io | YR2 | GitHub.com | amazon | 2026-07-16 04:50:39 | |
| 142.251.219.161 | 80 | US | gws | 2026-07-16 04:50:39 | ||||||
| 172.67.220.238 | 443 | outlook | 2026-07-16 04:50:39 | |||||||
| 3.5.92.123 | 443 | US | aws | 2026-07-16 04:50:39 | ||||||
| 185.199.110.153 | 80 | US | GitHub.com | amazon | 2026-07-16 04:50:38 | |||||
| 104.21.31.178 | 443 | microsoft | 2026-07-16 04:50:38 | |||||||
| 52.84.150.45 | 80 | US | aws | 2026-07-16 04:50:38 | ||||||
| 172.67.162.43 | 443 | aws | 2026-07-16 04:50:38 | |||||||
| 185.199.108.153 | 80 | US | GitHub.com | github | 2026-07-16 04:50:37 | |||||
| 185.199.108.153 | 443 | US | 32491b26bfaf | 598823547690534085216884722173052752111645 | *.github.io | YR2 | GitHub.com | github | 2026-07-16 04:50:37 | |
| 13.249.74.110 | 443 | US | microsoft | 2026-07-16 04:50:37 | ||||||
| 162.0.214.119 | 443 | US | microsoft | 2026-07-16 04:50:37 | ||||||
| 172.67.133.156 | 443 | onedrive | 2026-07-16 04:50:37 | |||||||
| 142.251.218.193 | 443 | US | 4c1c23455bd5 | 306281304664571053433988995091826550565 | invalid2.invalid | invalid2.invalid | gws | 2026-07-16 04:50:36 | ||
| 142.251.214.33 | 443 | US | 4c1c23455bd5 | 306281304664571053433988995091826550565 | invalid2.invalid | invalid2.invalid | gws | 2026-07-16 04:50:36 | ||
| 150.171.109.148 | 443 | US | 7aaee0906582 | 1940165850661118518706575858185291292936961574 | *.azureedge.net | Microsoft TLS G2 ECC CA OCSP 02 | azure | no_server_header | 2026-07-16 04:50:36 | |
| 172.66.44.89 | 443 | meta | 2026-07-16 04:50:36 | |||||||
| 172.66.44.130 | 443 | meta | 2026-07-16 04:50:36 | |||||||
| 172.66.47.153 | 443 | meta | 2026-07-16 04:50:36 | |||||||
| 16.182.67.21 | 80 | US | aws | 2026-07-16 04:50:36 | ||||||
| 142.251.218.65 | 443 | US | 4c1c23455bd5 | 306281304664571053433988995091826550565 | invalid2.invalid | invalid2.invalid | gws | 2026-07-15 22:50:38 | ||
| 13.249.74.80 | 443 | US | microsoft | 2026-07-15 22:50:38 | ||||||
| 172.66.47.82 | 443 | cloudflare | 2026-07-15 22:50:38 | |||||||
| 104.21.92.51 | 443 | outlook | 2026-07-15 22:50:38 | |||||||
| 142.251.218.161 | 443 | US | 4c1c23455bd5 | 306281304664571053433988995091826550565 | invalid2.invalid | invalid2.invalid | gws | 2026-07-15 22:50:37 | ||
| 13.249.74.37 | 443 | US | microsoft | 2026-07-15 22:50:37 | ||||||
| 34.194.247.17 | 443 | US | 8076fc365afb | 478422360655562326093100726321446288249079 | 028426.com | R13 | outlook | no_server_header | 2026-07-15 22:50:37 | |
| 185.199.111.153 | 443 | US | 32491b26bfaf | 598823547690534085216884722173052752111645 | *.github.io | YR2 | GitHub.com | github | 2026-07-15 22:50:36 | |
| 185.199.109.153 | 443 | US | 32491b26bfaf | 598823547690534085216884722173052752111645 | *.github.io | YR2 | GitHub.com | github | 2026-07-15 22:50:36 | |
| 142.251.214.33 | 80 | US | gws | 2026-07-15 22:50:36 | ||||||
| 172.66.46.235 | 443 | cloudflare | onedrive | 2026-07-15 22:50:36 | ||||||
| 172.67.208.218 | 443 | meta | 2026-07-15 16:56:58 | |||||||
| 104.21.18.158 | 443 | cloudflare | outlook | 2026-07-15 16:56:57 | ||||||
| 3.5.169.249 | 443 | AU | 1a1202f01e8a | 4683312839032071241318915985891276000 | *.s3-ap-southeast-2.amazonaws.com | Amazon RSA 2048 M04 | AmazonS3 | AWS | head_405_go_server | 2026-07-15 16:56:57 |
| 52.95.181.21 | 443 | JP | 0c854ef35975 | 8489496053842077939288520739918839124 | *.s3.ap-northeast-3.amazonaws.com | Amazon RSA 2048 M01 | AmazonS3 | AWS | head_405_go_server | 2026-07-15 16:56:57 |
| 104.18.26.80 | 80 | cloudflare | meta | 2026-07-15 16:56:56 | ||||||
| 3.5.217.120 | 80 | SE | AmazonS3 | aws | head_405_go_server | 2026-07-15 16:56:56 | ||||
| 172.66.47.43 | 443 | cloudflare | outlook | 2026-07-15 16:56:55 | ||||||
| 200.58.120.23 | 80 | AR | Microsoft-IIS/10.0 | meta | 2026-07-15 16:56:55 | |||||
| 13.107.246.69 | 443 | US | 45392fede3ac | 1940165731888907293448267040817216615635657931 | *.azureedge.net | Microsoft TLS G2 ECC CA OCSP 02 | Microsoft 365 | no_server_header | 2026-07-15 16:56:54 | |
| 167.86.81.173 | 443 | DE | fac51ecc24bc | 465510320507729759108795100737168261058795 | *.newdnsstar.lat | R12 | Apache | apple | 2026-07-15 16:56:54 | |
| 172.67.186.141 | 443 | cloudflare | outlook | 2026-07-15 16:50:38 | ||||||
| 52.204.246.179 | 443 | US | 577d1277bc1b | 550806271470032523474694007178677663810719 | 028426.com | R12 | outlook | no_server_header | 2026-07-15 16:50:37 | |
| 172.66.44.174 | 443 | cloudflare | 2026-07-15 16:50:37 | |||||||
| 13.249.74.42 | 443 | US | microsoft | 2026-07-15 16:50:36 | ||||||
| 142.251.218.193 | 80 | US | gws | 2026-07-15 16:50:36 | ||||||
| 142.251.35.65 | 443 | US | 2026-07-15 16:38:55 | |||||||
| 142.251.219.129 | 80 | US | gws | 2026-07-15 16:38:54 | ||||||
| 16.15.183.240 | 443 | US | aws | 2026-07-15 16:38:54 | ||||||
| 37.203.35.36 | 443 | LV | amazon | 2026-07-15 16:38:54 |