auth.qgtxtebl.workers[.]devDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 8 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)“The Velociraptor server URL, hxxps://auth.qgtxtebl.workers[.]dev/, utilizes a Cloudflare Worker from the same Cloudflare account we have seen before across multiple intrusions involving ToolShell exploitation, and Warlock ransomware deployment, identified by the shared per-account…”
Indicators reported together
named in the same reports- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiin 1 report
- hxxps://files.catbox[.]moe/tmp9fc.msiin 1 report
- hxxps://auth.qgtxtebl.workers[.]dev/in 1 report
- hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msiin 1 report
- v2-api.mooo[.]comin 1 report
- worker[.]devin 1 report
- 897eae49e6c32de3…c85cd538a189in 1 report
- 46831be6e577e312…90396393b751in 1 report
- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/code.txtin 1 report
- 34b2a6c334813adb…b13bbd2381f4in 1 report
- bbd6e120bf553091…b2edfa97ef44in 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2025-26399, CVE-2025-40551, CVE-2025-40536
Thanks — we review every report.