Thomas Geiger

{
    "slug": "duracelltomi-google-tag-manager",
    "pattern": "hardcoded_ip_url",
    "kind": "builtin",
    "version": "1.22.3",
    "hit_count": 38,
    "first_hit": {
        "file": "integration/whichbrowser/data/profiles.php",
        "line": 647,
        "snippet": "'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML'                                              => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],"
    },
    "explanation": "plugin source hardcodes a raw IPv4 URL (e.g. `https://94.156.79.8/...`) \u2014 legitimate plugins use DNS hostnames because IPs change. Hardcoded IPs in plugin code are almost always either dev leftovers or attacker C2 infrastructure. The June 2024 social-warfare keylogger (audit #14) used `https://94.156.79.8/sc-top.js` for the JS payload host, `/AddSites` for victim registration, `/CMSUsers` for filesystem-recon exfil. Operator infrastructure on raw IPs avoids domain registration / RDAP detection paths. Post-filtered to skip RFC1918/loopback/link-local ranges and `vendor/`/`tests/` paths."
}

{
    "slug": "duracelltomi-google-tag-manager",
    "previous_version": "1.22.3",
    "current_version": "1.22.3",
    "new_findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 647,
            "snippet": "'http://112.74.195.169/upload/xmlfiles/STUDIO_X8_HD.XML'                                              => [ 'BLU', 'Studio X8 HD', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 699,
            "snippet": "'http://221.176.65.117/uaprof/CMDC_M601.xml'                                                          => [ 'China Mobile', 'M601', 'Android', DeviceType::TABLET ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 701,
            "snippet": "'http://221.176.65.117/uaprof/CMCC-M812.xml'                                                          => [ 'China Mobile Device', 'and M812', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 702,
            "snippet": "'http://221.176.65.117/uaprof/M821.xml'                                                               => [ 'China Mobile Device', 'and M821', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 703,
            "snippet": "'http://221.176.65.117/uaprof/M823.xml'                                                               => [ 'China Mobile Device', 'and M823', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 722,
            "snippet": "'http://122.200.68.229/docs/mini3ix.xml'                                                              => [ 'Dell', 'Mini 3ix', 'Android', DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 754,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-2040i.xml'                                                       => [ 'Fly', '2040', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 755,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-2040L.xml'                                                       => [ 'Fly', '2040', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 758,
            "snippet": "'http://211.42.201.70/ua_profile/Fly-E300.xml'                                                        => [ 'Fly', 'E300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 814,
            "snippet": "'http://211.42.201.70/ua_profile/Fly-LX610.xml'                                                       => [ 'Fly', 'LX610', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 817,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX200i.xml'                                                      => [ 'Fly', 'MX200', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 818,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX230.xml'                                                       => [ 'Fly', 'MX230', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 819,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX300.xml'                                                       => [ 'Fly', 'MX300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 820,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-MX330.xml'                                                       => [ 'Fly', 'MX330', null, DeviceType::MOBILE ],",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "integration/whichbrowser/data/profiles.php",
            "line": 821,
            "snippet": "'http://211.42.201.70/ua_profile/FLY-SL300m.xml'                                                      => [ 'Fly', 'SL300', null, DeviceType::MOBILE ],",
            "confidence": "high"
        }
    ],
    "new_finding_count": 38
}

{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "51coolpad.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-04-08",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 4215,
    "domain_age_at_release": 251,
    "active_installs": 700000
}

{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "museui.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2024-06-13",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 3916,
    "domain_age_at_release": 550,
    "active_installs": 700000
}

{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "n-keitai.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2024-02-04",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 3786,
    "domain_age_at_release": 680,
    "active_installs": 700000
}

{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "panasonicbox.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-09-29",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 4389,
    "domain_age_at_release": 77,
    "active_installs": 700000
}

{
    "slug": "duracelltomi-google-tag-manager",
    "domain": "bluhelp.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-08-10",
    "plugin_earliest_commit": "2013-09-22 17:52:53",
    "plugin_latest_release": "2025-12-15 14:45:45",
    "gap_days": 4339,
    "domain_age_at_release": 127,
    "active_installs": 700000
}