Raw IOC List - VS Code / Git Hook JavaScript Stealer Campaign

Source: local investigation report and supporting IOC CSVs.
Note: This list mixes confirmed malicious infrastructure, static pivots, passive historical pivots, and contextual GitHub metadata. Validate before blocking at scale.


DOMAINS

precommit.vercel.app
auth-drive-google.vercel.app
tanxilabs.com
precommit-chk.vercel.app
precommit-nyx.vercel.app
gitconfig-nyx.vercel.app
ninjacode-gitconfig-v1.vercel.app
www.regioncheck.xyz
isvalid-regions.vercel.app
ip-regions-check.vercel.app
www.ipregionchecker.net
www.ipregionchecker.org
ipregionchecker.org
www.whatisip.app
ip-api-psi.vercel.app
jsonkeeper.com
www.code-beautify.com

Contextual hosted services:
react-frontend-455286116660.europe-west1.run.app
python-backend-455286116660.europe-west1.run.app
node-backend-455286116660.europe-west1.run.app


IP ADDRESSES

45.61.148.220
216.126.237.163
172.86.123.37
64.227.108.217

Observed DNS snapshot / passive context:
216.198.79.1
216.198.79.3
216.198.79.65
216.198.79.67
216.198.79.195
64.29.17.1
64.29.17.3
64.29.17.65
64.29.17.67
64.29.17.195


URLS AND ROUTES

https://tanxilabs.com/settings/mac?flag=2
https://tanxilabs.com/settings/linux?flag=2
https://tanxilabs.com/settings/windows?flag=2
https://tanxilabs.com/settings/bootstraplinux?flag=2
https://tanxilabs.com/settings/bootstrap?flag=2
https://tanxilabs.com/settings/env?flag=2
https://tanxilabs.com/settings/package
https://ip-api-psi.vercel.app/api/githook-encrypted/N3RlYW02
https://www.ipregionchecker.net/api/ip-check-encrypted/3aeb34a32
https://www.ipregionchecker.net/api/ip-check-encrypted/3aeb34a33
https://www.ipregionchecker.net/api/ip-check-encrypted/3aeb34a35
https://www.ipregionchecker.net/api/ip-check-encrypted/3aeb34a37
https://www.ipregionchecker.org/api/ip-check-encrypted/3aeb34a32
https://www.whatisip.app/api/ip-check-encrypted/3aeb34a30
https://www.whatisip.app/api/ip-check-encrypted/3aeb34a38
https://ip-regions-check.vercel.app/api/ip-check-encrypted/3aeb34a31
https://jsonkeeper.com/b/LI1B9
https://www.code-beautify.com/settings/linux?flag=2

Generic route patterns:
/settings/{mac,linux,windows}?flag=0
/settings/{mac,linux,windows}?flag=1
/settings/{mac,linux,windows}?flag=2
/settings/{mac,linux,windows}?flag=5
/settings/{mac,linux,windows}?flag=6
/settings/{mac,linux,windows}?flag=8
/settings/{mac,linux,windows}?token=<20-hex>
/api/ip-check-encrypted/3aeb34a30
/api/ip-check-encrypted/3aeb34a31
/api/ip-check-encrypted/3aeb34a32
/api/ip-check-encrypted/3aeb34a33
/api/ip-check-encrypted/3aeb34a35
/api/ip-check-encrypted/3aeb34a37
/api/ip-check-encrypted/3aeb34a38
/api/githook-encrypted/N3RlYW02
/b/LI1B9

Final C2 / exfil routes:
http://45.61.148.220:8085/upload
http://45.61.148.220:8085/api/upload-file
http://45.61.148.220:8086/upload
http://45.61.148.220:8087/api/log
http://45.61.148.220:8087/api/notify
http://45.61.148.220:8087/socket.io/
ws://45.61.148.220:8087
http://216.126.237.163:8085/upload
http://216.126.237.163:8085/api/upload-file
http://216.126.237.163:8086/upload
http://216.126.237.163:8087/api/log
http://216.126.237.163:8087/api/notify
ws://216.126.237.163:8087
http://172.86.123.37:8085/upload
http://172.86.123.37:8085/api/upload-file
http://172.86.123.37:8086/upload
http://172.86.123.37:8087/api/log
http://172.86.123.37:8087/api/notify
ws://172.86.123.37:8087

Cloud Run URLs:
https://react-frontend-455286116660.europe-west1.run.app
https://python-backend-455286116660.europe-west1.run.app
https://node-backend-455286116660.europe-west1.run.app
https://node-backend-455286116660.europe-west1.run.app/api/products/getAll
https://node-backend-455286116660.europe-west1.run.app/api/products/1/bid-history


SHA-256 HASHES

VS Code / Git hook files:
d588f6058e912bbea0bebe5d13b263e1353f1f99b0981d1e6966d3588ecb7919
a95d5f5b367530728108d38215e5e7c87717cbcc844f482cc2350b69b35824be
2ea7cf0b9dac58091515a25aaac21e9ea607b8c424d4f8d378a39f4ed357da9f
0c56b670e7f84c7618d615f08aca3ebc262a67b7fb47fd675afa20eeda0d1330
0bcf7d564b1ed02249af54fcdbe167571dfca687f8525f9c4d1535febc881304
78deace2e76fe8678d65018b1f136965f4ebad5e8d92568e5e2d2335e292146b
347d6886aa799d5db7068367d3873fec699b5224d292b7eeec9afa079adb5d07
53c471f1e5a3f165b91836c0a45b58dccdcb0685af9c086348efbeb30b6fbae2
1d0691543ad1f78300504e19d11562a4212702f3a9d9ab8241aea4969230d938
817d4187f067276c3733623447449e7d4b9374eee24f6efa9a1200bfe8953dc8
2d8ad75c0bdc7329ae0a3ea0fba36f44d9b72c178ba509dbc4bbea2473249941
7c9433c6f403d12f0a09ceed5bf7b5e79a1fb9822b9d667909666199084ec808
5520ddbb0190a1e5786a317c381f0b101a034ec29682760c934fa9a4559715dc
e7a7f0f78bf17dd2a4b3edd69fb8a9e80229da44f512da44af72246a2ad12c90
458234591283e1214073448664b4d6aff27e88ccc260190dc47be4e69e040817
9caa5fb4509791465ce68a2b6d9750b3db95b75b6c99389765a0b6a5d6615298

StockX / tanxilabs payload chain:
a6a864386086bc4c7f5dc1df38b4a659fb62ae66b4ee6c749007e8e973bd84da
18f5db6fd9cedd45cd5c25f471c730fa07cdafda33beb168ef2088c785e8cc9b
a0e00100d1c6d065e520eb029ad2022ba928ff9bfe54ac07b240967f0ec4e635
3039fb7a706fb970b9aa16c5f067d947325ca50d47ceb726fb96c2d1c97014b5
857b09522e5a3cbb20db44cf0be563050a282b7389319292ec95802911d5bcbf
017cb09cabd9c909e4fb06e8c668d2f89e472e103eda5230d98761a9f998bdb5
f44011fd3504ac524b2a52780f7686d49d45975b2f76901218d53d1ede6c88ba
7924154f069807c44041b5dea30baf2d3622d45fcf294d900c59ef2c941374a6
32feb40c885903e63e4c070f39f5e53e1365bad88c1f24b920561cbd76a9004f
48e3a077650390481368152b20ae1cf6c43b60e36c588e9cd489cec1beba5d37
f5c3462eea82f081eaac64eff4d1f64cb11c6a27b19b753af93f917a58f07a09
fd105cb9b1215059994affe7d5cda2f90445673fbdbd3a868faa47d0ecf73bec
1ba4bdcc61e141dc43d7e95ce7dd5e996a2ac5fb0359b52401c169a0f30ca3e9
7cbf735aa1ae752dc8a85c6db6e7c97cbf6702e73f1ea70a6f0ef0c9aef36fbe
877b2bd80c6bf3e8b0730e2506d5f35ff3a30a2ead66c41bcbb2af20d1722e36
430bde7a0ffb47fc496d01dfce0921f1b4c0b1220a054c2a05f34b7ab4f0f49f

spellright.dict variants:
5f6e1ffe0cab6c7e39b0095f30c5d57ba0bf22f98bc073d156a73cc15f7431cd
cde4d53a50dc51d3e43da9fcea409966cd806bad69209fc582fa35023b45475a
1bc78add1bb2d54cdc48459f8356b0ae23f5b660b936f47f12552060705c8b77
a3ed5995cc51c0d282d14fb38bfa8af1cfdb1bf21a162cb815720937d275eb05

Node challenge / ipregionchecker.org branch:
466b03662c20a1c75cc8d09f4d543cb3e20beffe9771e4b54d569e070a4746b8
87eafdd9bd6fde9d7c746c45eedd659e7bc39849a59fb201bd02ff84c8914883
6b1d9e0a23a62abcbb530f053d9b6494375cc2d25fb68ef9ee47cf0a861aa65d
fde568ce87dffda6bbb0a95b4904461333d5bf00306f48f63a6831684ed30e77
33efe5e804a09a6a2c6238cccba5db0e8d7bb34b6eddf01db196d15cdffbe655
ae5ef5c7119aefe80a7e29a5957d36689ca6a152191ac5800ccbe61488e6dc38
eb2185f5fbae31ab0b558ba6a8a891eb9c3d87f5093917f6d0065d49a96bb815
2376b9819f6a9605ddd1bd0d526e79d70cc88773891ad3afb18f2b25f9d32b96


GIT BLOB SHAS

ebb90054c3db43393b6ad1abb3c39e6e4eeba004
515d7ae0d7961960aab7fa7b32c5ff232aa67638
3831a19c3953f9c22643674dd8fdb1d251ed7526
ef5ba3f34990b03929282adfeb63924007bdcc37
806b2c7a71f93272058af1e5101357c074e1e56f
df70f6791d34c69daa96cd345f76804a6f36006c
739c99a94118f433d3e9c958b52879a6f3462ce1
4d5adf079933a1f99bdac99cb37292ccaaed2bb0
343c50336fcd4f5137be83120a6625f379890bb9
5bbbf96af88b77bc43ce9ac12d84124f8cbbde6a
575d5fb2ad68e11b7342df88cad4986861d882ce
2c7008cd68e0ca7e8309ce41a82efd68c10c0334
7c2895c0fd89ed9afda620b00abfa37f48854f53
914460c3ed10868c4ac629a06f84ae557c63d169
41bff03df536c4239da555eeebc5da6c24a2b9cd
9c9c4c476abddca162bb78e73452d0dd8a9102ee


GITHUB REPOSITORIES

YurdakosKaan/stockx
kinetfi/MVP
vlad894/Defi-Token-Manager
dtm059/v1
dtm089/v1
dtm186/mvp
dtm188/MVP
dtm189/v1
dtm489/v1
javier-furio/dtm
jovanh89/Defi-Token-Manager
enjamy/dtm
liam-ruffin/dtm
erempijl/dtm
blockett89/dtm
dtm89/v1
blockchain-jackyang/estoken
kamilniftaliev/unipay
ta3pks/Decentralized-Social
usmankhan16677/messageforge
shekhus/petshop
Timka654/skill-test
mateoKutnjak/react-node-test-solution
zllltn/nodejs-reactjs-test
MarcelTawamba/test-smart-contracts
Hassanawi/solidity-token-contract
MikeAlladoum/Bitbucket_test
Chainbits1/StockX
Lynqex-Labs/Stockx_PoC_v3
0xbrentfi/StockX_PoC_1.03
aleksandrmaliarenko/nodejs-challenge
aleksandrmaliarenko/react-challenge
aleksandrmaliarenko/rust-test
aleksandrmaliarenko/python_test
aleksandrmaliarenko/.nettest
aleksandrmaliarenko/gotest
aleksandrmaliarenko/StockX-Demo
aleksandrmaliarenko/Solidity-SC-Test


REPOSITORY PATHS / FILE INDICATORS

.vscode/tasks.json
.vscode/settings.json
.vscode/spellright.dict
.githooks/pre-commit
.githooks/post-checkout
python-backend/.vscode/tasks.json
python-backend/.vscode/settings.json
python-backend/.githooks/post-checkout
node-backend/controllers/productController.js
utils/checkRegion.js
middlewares/regionMiddleware.js
server/utils/regionChecker.js
backend/src/compliance/complianceService.js
contract/.vscode/tasks.json
contract/.vscode/spellright.dict
frontend/.vscode/tasks.json
frontend/.vscode/spellright.dict


LOCAL HOST ARTEFACTS / TARGETED PATHS

~/.vscode/vscode-bootstrap.sh
~/.vscode/env-setup.js
~/.vscode/package.json
.config/google-chrome/*/Login Data
.config/chromium/*/Login Data
.config/BraveSoftware/Brave-Browser/*/Login Data
.config/microsoft-edge/*/Login Data
Chrome-family Login Data
Chrome-family Login Data For Account
Chrome-family Local State


WALLET EXTENSION IDS

nkbihfbeogaeaoehlefnkodbefgpgknn
bfnaelmomeimhlpmgjnjophhpkkoljpa


GIT COMMITS / TREES / EMAILS

82edc4a13061bb2b26c73a4a360c0202248971e1
7181dd4fe32aaef63321b2a0020305a9c0d7b6d1
eb2daee1beb562936ef6968801c3f76f6d6a4184
adfb26c92587a0c7dd19e274db37754ec5173f27
fed9a0fcfe4f92b182e470c7a5e2d3651564df81
3a90400e196f460fa07830433e682882e6da8f3f
f3c4583eac4e116773bfce779b853fd32099f4fd
35f5b13d59a7c9903ecd7d218dc0de0587171fe2
8fa187e9724fe0bcfccef78f32dbd5be2e2dd3d4
0717bc98f678311029d8b26193e23ccd6c1ad1b1
736118578aaeaa51d7446590bcd8947308ce915c
5816d922cfcddd8173077ee9ab889a03b790df51
7f97a65183a39167f6bf6c8dcca2fc4b5bce9093
cc69489bae5e839b9f0de467d13dbad033ff5b7f

vladzane569@gmail.com
valdzane569@gmail.com
aleksandrmaliarenko@lynqexlabs.com
h1ah2fksjdhf123@github.user


TOKENS / STATIC STRINGS

N3RlYW02
7team6
3aeb34a30
3aeb34a31
3aeb34a32
3aeb34a33
3aeb34a35
3aeb34a37
3aeb34a38
b4dadd6a26d820d08596
6c1d60d35852ef0c05df
f1f097d93c318c92f0c5
aHR0cHM6Ly93d3cuaXByZWdpb25jaGVja2VyLm9yZy9hcGkvaXAtY2hlY2stZW5jcnlwdGVkLzNhZWIzNGEzMg==
eC1zZWNyZXQtaGVhZGVy
c2VjcmV0


BEHAVIOURAL / HUNTING STRINGS

runOn: folderOpen
task.allowAutomaticTasks
git config core.hooksPath .githooks
git config core.hooksPath .github
git checkout develop
git checkout -b develop
git checkout main
git checkout master
node .vscode/spellright.dict
new Function("require", res.data)(require)
Function.constructor
axios.post
node --max-old-space-size=4096 --no-warnings -