checkmarx[.]zoneDomain
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 6 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
TeamPCP’s Telnyx Attack Marks a Shift in Tactics Beyond LiteLLM“`https[://]checkmarx[.]zone/raw`”
-
Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise“A separate persistent backdoor polls checkmarx[.]zone every 50 minutes for second-stage payloads, abusing the trusted Checkmarx brand name to bypass DNS allowlists.”
-
Your AI Stack Just Handed Over Your Root Keys: Inside the litellm PyPI Breach“Finally, it encrypts your data and ships it to an attacker-controlled server, establishing a secondary connection to checkmarx[.]zone to deliberately abuse a trusted brand name and bypass your DNS allowlists.”
Indicators reported together
named in the same reports- models.litellm[.]cloudin 3 reports
- 83.142.209[.]203in 1 report
- scan.aquasecurtiy[.]orgin 1 report
- 45.148.10[.]212in 1 report
- 83.142.209[.]11in 1 report
- mirror.gcr[.]ioin 1 report
- 46.151.182[.]203in 1 report
- litellm[.]cloudin 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2024-3400
Thanks — we review every report.