litellm[.]devDomain
Reported by 5 independent sources · first reported by Datadog Security Labs · last reported
Last reported today
What the reports say
7 reports, newest first · the exact sentence from each-
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline“The data is then compressed and sent to "litellm[.]dev/healthcheck" using an HTTP POST request.”
-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks“| where RemoteHost in ("www.litellm.dev", "litellm[.]dev")”
-
LiteLLM Compromised in Fresh Supply Chain Attack“The stolen data is encrypted and sent to litellm[.]dev.”
-
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials“The collected data is encrypted and sent to a “healthcheck” address on the litellm[.]dev domain.”
-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release“…s a stealer routine named "privcollect" to gather system, browser, developer, cloud, and AI tool secrets, and exfiltrate the data to "litellm[.]dev/healthcheck" via an HTTP POST request.”
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor“The collected data is packaged into a GZIP-compressed TAR archive and sent to "litellm[.]dev/healthcheck" by means of an HTTP POST request.”
-
LiteLLM supply chain compromise: What you need to know“litellm[.]dev”
Indicators reported together
named in the same reports- www.litellm[.]devin 2 reports
- litellm-1.107.0[.]datain 1 report
- hxxp://www.litellm[.]dev/healthcheckin 1 report
- 7598727f209d7170…375729aeb86din 1 report
- 9dd0a3926f96a37e…e9531390be25in 1 report
- 34bef04fe88ac9d0…acf5968305fain 1 report
- 1bbcb1443bc962e4…d3ac126c339ein 1 report
- 0aaf7ba346d41ef2…78a9969d9a1ain 1 report
- 462d0c9f67ca522d…3a1ec4a6fcf7in 1 report
- 668169d35b87bf51…89abd5e02ae6in 1 report
- 1bbce8caa94f01c0…3272aff7ad00in 1 report
- c2e32d0ce2548aa6…dd02fdcde054in 1 report
- 12d4ccc5c6f8d35c…e210005b9484in 1 report
- 168.100.8[.]57in 1 report
- 165.227.201[.]8in 1 report
- workloads[.]microsoftin 1 report
- compromise[.]microsoftin 1 report
- remediation[.]microsoftin 1 report
- 03ac2a8b752605d1…8ce3d6f897eain 1 report
- b6122440d0d9cb1e…680dfa528465in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.