s3.filebase[.]comDomain
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 6 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting“The scanner was configured to watch its local results/ directory, batch *.env files into ZIPs, and upload them to hxxps://s3.filebase[.]com in bucket bissapromax under the archives/ prefix.”
Indicators reported together
named in the same reports- cs2.ip.thc[.]orgin 1 report
- denemekulubum.com[.]trin 1 report
- wiprz[.]comin 1 report
- hxxps://s3.filebase[.]comin 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2025-55182, CVE-2025-9501
Thanks — we review every report.