Indicator of Compromise
dropbox[.]com
A domain observed in malicious infrastructure. Block or monitor it in DNS and web proxies. Shown defanged for safe viewing; use Copy live value for the functional form.
Included in theDomains feed(live, machine-readable).
Related indicators
Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.
04ef48b104d6ebd05ad70f6685ade26c1905495456f52dfe0fb42f550bd43388178[.]16[.]54[.]253179[.]43[.]176[.]32adbcdb613c04fd51936cb0863d2417604db0cd04792ab7cae02526d48944c77baefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fabulletmailer[.]netclaude[.]aiclawdbot[.]getintwopc[.]siteCVE-2026-21509CVE-2026-21513d1e0c26774cb8beabaf64f119652719f673fb530368d5b2166178191ad5fcbeadarkgptprivate[.]come20b920c7af988aa215c95bbaa365d005dd673544ab7e3577b60fecf11dcdea2egest[.]filen[.]iofilen[.]iogateway[.]filen-1[.]netgateway[.]filen-6[.]netgateway[.]filen[.]iogateway[.]filen[.]netgetintwopc[.]sitehxxp://clawdbot[.]getintwopc[.]site/config[.]json'hxxp://clawdbot[.]getintwopc[.]site/dl/Lightshot[.]dll'hxxp://clawdbot[.]getintwopc[.]site/dl/Lightshot[.]exe'hxxps://darkgptprivate[.]com/d111"hxxps://www[.]aikido[.]dev/blog/fake-clawdbot-vscode-extension-malwarehxxps://www[.]dropbox[.]com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate[.]msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&st=q93av9p6&dl=1ingest[.]filen[.]iomeeting[.]bulletmailer[.]netwellnesscaremed[.]comwww[.]aikido[.]devwww[.]dropbox[.]com