hxxp://127.0.0[.]1URL
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack“Approximately 50 minutes later, the attacker also created a quick tunnel using tunnel --url hxxp://127.0.0[.]1:80, which exposes a local HTTP server through a Cloudflare-provided public URL, likely as a secondary access method to proxy traffic to the compromised SharePoint server.”
Indicators reported together
named in the same reports- litter.catbox[.]moein 1 report
- code.translatevv[.]comin 1 report
- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiin 1 report
- hxxps://litter.catbox[.]moe/zqqxb3.txtin 1 report
- hxxps://files.catbox[.]moe/wzsjlw.dllin 1 report
- hxxps://litter.catbox[.]moe/uaw2gm.txtin 1 report
- 198.13.158[.]193in 1 report
- blnwx[.]comin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.