85.206.161.241

IP Address

Threat entity extracted from intelligence sources

Frequency

1

occurrences

First Seen

August 17, 2026

Last Seen

August 17, 2026

IOC Validation

ThreatCluster AI

Confirmed IOC — High confidence

[article sweep] IP address used for direct C2 communication via WebSocket

This indicator was confirmed as a true IOC by AI analysis.

Pivot to external tools

Opens in new tab · no data sent to TC

Reputation · 4

Sandbox · 2

Infrastructure · 3

Malware trackers · 1

Web search · 2

Related Clusters (1)

MacSync Infostealer Exploits Google Search for Claude Installation

Aug 19·2 sources

Related Articles (1)

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Huntress·Aug 17

Related Entities

Malware Phishing Trojan AMOS Stealer MacSync Stealer SecTopRAT T1041 - Exfiltration Over C2 Channel T1053 - Scheduled Task/Job T1059.004 - Unix Shell T1059.005 - Visual Basic T1071 - Application Layer Protocol T1566 - Phishing