IP report
166.0.192.57
payload staging hostThis IP has not connected to our sensors directly. It appears as a malware staging host inside captured payloads.
Referenced in captured payloads
Our honeypots were instructed to download malware from this host. It has not connected to our sensors itself; it appears as the download target inside 2 captured dropper payloads.
| File | SHA-256 | VT | Via | First seen |
|---|---|---|---|---|
| loader | 930e5c1df1a8fd44… | 6/75 | curl | 2026-08-14 |
| [http]://166[.]0[.]192[.]57/loader | ||||
| cumshotnews | 2690b9cf6cf4fb68… | 12/74 | curl | 2026-08-06 |
| [http]://166[.]0[.]192[.]57/cumshotnews | ||||