oast[.]funDomain
Reported by 2 independent sources · first reported by GreyNoise · last reported
Last reported 24 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570“…d execution using lightweight out-of-band probes to unique subdomains hosted on public interaction and collaborator services, including oast[.]fun, oast.online, dnslog.pp.ua, requestrepo.com, and campaign-associated infrastructure under bypass.eu.org.”
-
The Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 Attacks“oast[.]fun”
-
Threat Actors Actively Targeting LLMs“*.oast[.]fun”
Indicators reported together
named in the same reports- oast[.]onlinein 3 reports
- oast[.]livein 2 reports
- oast[.]mein 2 reports
- oast[.]proin 2 reports
- oast[.]sitein 2 reports
- 134.122.136[.]119in 2 reports
- 134.122.136[.]96in 2 reports
- 45.88.186[.]70in 1 report
- 204.76.203[.]125in 1 report
- oast[.]todayin 1 report
- 112.134.208[.]214in 1 report
- 146.70.124[.]188in 1 report
- 146.70.124[.]165in 1 report
- requestrepo[.]comin 1 report
- hxxps://aka[.]ms/downloadazcopy-v10-linuxin 1 report
- wsweb03.blob.core.windows[.]netin 1 report
- credentials[.]microsoftin 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2025-55182, CVE-2026-73570, CVE-2023-1389
Thanks — we review every report.