bewildered-cock-lover[.]onlineDomain
Reported by 1 independent source · first reported by GreyNoise · last reported
Last reported 10 months ago
What the reports say
1 report, newest first · the exact sentence from each-
There's Payloads, And Then There's pAIloads: A Look At Selected Opportunistic (And Possibly AI-"Enhanced") React2Shell Probes and Attacks“The use of childish naming conventions such as WormBoner, bewildered-cock-lover[.]online likely means the human prompter provided a "Mad Libs" style prompt, asking the "AI" to write a robust downloader/executor script but provided the crude filenames and domains as the specific var…”
Indicators reported together
named in the same reports- hxxp://200.4.115[.]1/promocionao.phpin 1 report
- 200.4.115[.]1in 1 report
- 267b27460704e41e27d6f2591066388fin 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2025-55182
Thanks — we review every report.