Connection to rogue registry.coder.com hosting IP (Coder supply chain compromise)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•2

Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.