turn[.]idDomain

Reported by 1 independent source · first reported 8 Oct 2026 by SANS Internet Storm Center · last reported 8 Oct 2026

Last reported 16 days ago

What the reports say

1 report, newest first · the exact sentence from each

“jq -c ' select(.turn.error != null) | {id: .turn[.]id, role: .turn.role, error: .turn.error} ' chat.jsonl”

SANS Internet Storm CenterVendor8 Oct 2026
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)

Indicators reported together

named in the same reports

hxxps://github[.]com/clausing/scripts/blob/master/opencode-chat-replay.pyin 1 report
hxxps://github[.]com/clausing/scripts/blob/master/hermes_forensic_extract.pyin 1 report

Copy these 2 indicators · defanged

2 indicators, defanged, one per line

hxxps://github[.]com/clausing/scripts/blob/master/opencode-chat-replay.py
hxxps://github[.]com/clausing/scripts/blob/master/hermes_forensic_extract.py

Thanks — we review every report.

Report a wrong value