hxxp://www.litellm[.]dev/healthcheckURLExfiltrationURL

Reported by 1 independent source · first reported 23 Oct 2026 by Microsoft Security Blog · last reported 23 Oct 2026

Last reported yesterday

What the reports say

1 report, newest first · the exact sentence from each

“hxxp://www.litellm[.]dev/healthcheckURLExfiltration URL”

Microsoft Security BlogVendor23 Oct 2026
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks

Indicators reported together

named in the same reports

litellm-1.107.0[.]datain 1 report
hxxp://www.litellm[.]dev/healthcheckin 1 report
www.litellm[.]devin 1 report
9dd0a3926f96a37e…e9531390be25in 1 report
34bef04fe88ac9d0…acf5968305fain 1 report
litellm[.]devin 1 report
workloads[.]microsoftin 1 report
compromise[.]microsoftin 1 report
remediation[.]microsoftin 1 report
03ac2a8b752605d1…8ce3d6f897eain 1 report
b6122440d0d9cb1e…680dfa528465in 1 report
hxxps://raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txtURLC2in 1 report

Copy these 12 indicators · defanged

12 indicators, defanged, one per line

litellm-1.107.0[.]data
hxxp://www.litellm[.]dev/healthcheck
www.litellm[.]dev
9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25
34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa
litellm[.]dev
workloads[.]microsoft
compromise[.]microsoft
remediation[.]microsoft
03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea
b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465
hxxps://raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txtURLC2

Thanks — we review every report.

Report a wrong value