m[.]groupDomain

Reported by 2 independent sources · first reported 13 May 2026 by Datadog Security Labs · last reported 21 Sep 2026

Last reported 1 month ago

What the reports say

2 reports, newest first · the exact sentence from each

“return m[.]group(1).strip() if m else body”

GreyNoiseVendor21 Sep 2026
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
“if m[.]group(3) == 'r':”

Datadog Security LabsVendor13 May 2026
Shai-Hulud Goes Open Source

Indicators reported together

named in the same reports

com[.]twin 1 report
httpbin[.]orgin 1 report
re[.]searchin 1 report
resp[.]readin 1 report
hxxp://74.48.66[.]73:9860/sshin 1 report
74.48.66[.]73in 1 report
2ff2945b13a4cd0e…bf9f8a4000b1in 1 report
p3.981666[.]xyzin 1 report

Copy these 8 indicators · defanged

8 indicators, defanged, one per line

com[.]tw
httpbin[.]org
re[.]search
resp[.]read
hxxp://74.48.66[.]73:9860/ssh
74.48.66[.]73
2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1
p3.981666[.]xyz

Also named with it: CVE-2026-60004, CVE-2022-0847, CVE-2026-60137, CVE-2026-63030, CVE-2023-54391, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-7273, CVE-2026-56271, CVE-2026-79756, CVE-2026-54569

Thanks — we review every report.

Report a wrong value