qgtxtebl.workers[.]devDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
A Threat Actor Abuses Another Free Trial“… very same random email prefixes matched the exact same subdomain that we observed used for the Cloudflare Worker pages: like one qgtxtebl.workers[.]dev as an example.”
Indicators reported together
named in the same reports- quieresmail[.]comin 1 report
- firstmail[.]ltdin 1 report
- 7c00a38569a8471083b6b34e1511b9dein 1 report
- 154.26.156[.]181in 1 report
- 51.161.152[.]26in 1 report
- rel-1.16.3-0-ga6ed6b70-prebuilt.dady[.]orgin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.