metrics-relay internal · C2 console (recovered) · read-only
← all campaigns

axius@1.9.4

1.x (legacy)

40 check-ins recovered · 33 stage2 delivered · protocol waveshaper.v2

Beacons Stage 2 Payload Raw Log
HostSource IPPlatformCheck-inStatus
mac-build-06.local 10.143.72.200 macos 03:38:57 UTC (T+57s) blocked
CORP-SEC843 192.168.107.126 windows 03:39:00 UTC (T+60s) delivered
mac-build-05.local 192.0.2.111 macos 03:39:29 UTC (T+89s) delivered
jenkins-agent-03 192.0.2.178 linux 03:39:48 UTC (T+108s) delivered
jenkins-agent-10 10.79.218.143 linux 03:40:04 UTC (T+124s) delivered
CORP-HRD248 198.51.100.122 windows 03:42:38 UTC (T+278s) delivered
Omars-MacBook-Air.local 10.128.106.224 macos 03:43:46 UTC (T+346s) blocked
DESKTOP-WHYKGRJ 10.12.0.207 windows 03:43:59 UTC (T+359s) delivered
DESKTOP-6DSZWRM 172.25.150.93 windows 03:46:42 UTC (T+522s) blocked
LAPTOP-GWFU9PL 172.29.241.224 windows 03:46:57 UTC (T+537s) delivered
build-worker-14 192.0.2.10 linux 03:46:58 UTC (T+538s) delivered
DESKTOP-3547NQN 172.20.119.9 windows 03:48:35 UTC (T+635s) delivered
Ravis-MacBook-Pro.local 203.0.113.121 macos 03:49:52 UTC (T+712s) delivered
LAPTOP-3RHJKPY 192.0.2.211 windows 03:57:47 UTC (T+1187s) delivered
jenkins-agent-04 172.31.26.52 linux 03:58:01 UTC (T+1201s) blocked
LAPTOP-D8BBMCR 192.168.225.30 windows 03:58:05 UTC (T+1205s) blocked
Yukis-MacBook-Air.local 203.0.113.104 macos 03:59:18 UTC (T+1278s) delivered
Ravis-MacBook-Air.local 10.100.21.93 macos 04:00:35 UTC (T+1355s) delivered
DESKTOP-ZAFLZZM 203.0.113.12 windows 04:03:18 UTC (T+1518s) delivered
CORP-SEC585 172.20.223.217 windows 04:06:54 UTC (T+1734s) timeout
Marcos-MacBook-Pro.local 10.12.116.229 macos 04:09:16 UTC (T+1876s) delivered
DESKTOP-CJEJHHN 192.168.99.136 windows 04:10:31 UTC (T+1951s) blocked
jenkins-agent-04 192.0.2.73 linux 04:10:44 UTC (T+1964s) delivered
CORP-HRD244 192.0.2.89 windows 04:10:52 UTC (T+1972s) delivered
CORP-OPS405 10.135.52.67 windows 04:11:31 UTC (T+2011s) delivered
Farahs-MacBook-Air.local 192.0.2.200 macos 04:12:17 UTC (T+2057s) delivered
Tomass-MacBook-Air.local 198.51.100.172 macos 04:15:03 UTC (T+2223s) delivered
Victors-MacBook-Air.local 192.0.2.21 macos 04:17:44 UTC (T+2384s) delivered
DESKTOP-RXER2RW 203.0.113.188 windows 04:18:19 UTC (T+2419s) delivered
DESKTOP-ZFEFWQX 192.168.10.173 windows 04:22:14 UTC (T+2654s) delivered
mac-build-06.local 192.0.2.23 macos 04:23:45 UTC (T+2745s) delivered
CORP-FIN440 198.51.100.175 windows 04:28:23 UTC (T+3023s) delivered
LAPTOP-KDC4XGS 192.168.246.200 windows 04:28:42 UTC (T+3042s) delivered
CORP-OPS718 10.143.156.116 windows 04:30:10 UTC (T+3130s) delivered
Priyas-MacBook-Air.local 203.0.113.142 macos 04:41:13 UTC (T+3793s) delivered
build-worker-19 172.27.235.92 linux 04:46:02 UTC (T+4082s) delivered
CORP-OPS802 10.195.45.220 windows 04:52:45 UTC (T+4485s) delivered
DESKTOP-JS9XB3J 198.51.100.68 windows 04:59:33 UTC (T+4893s) delivered
mac-build-12.local 203.0.113.227 macos 05:28:14 UTC (T+6614s) delivered
ubuntu-ci-10 192.0.2.210 linux 05:36:43 UTC (T+7123s) delivered

Every row is a single recovered postinstall run: cipher-lite-js's `setup.js` executes once on `npm install`, attempts its stage2 fetch, then deletes itself. There is no persistent beacon loop to correlate against, this table is the complete recovered history per host.

metrics-relay · recovered instance · read-only snapshot window 2026-02-10 03:38–06:52 UTC