hxxp://jenkins.test[.]net:8080/login?from=%2FURL
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 5 years ago
What the reports say
1 report, newest first · the exact sentence from each-
The source of everything“172.17.0.19 - - [08/Jan/2021:15:18:45 +0000] "POST /j_acegi_security_check HTTP/1.1" 302 0 "hxxp://jenkins.test[.]net:8080/login?from=%2F" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0"”
Indicators reported together
named in the same reports- hxxp://gitlab.test[.]net/in 1 report
- gitlab.test[.]netin 1 report
- hxxp://gitlab.test[.]net/admin/users/ferdinandin 1 report
- hxxp://gitlab.test[.]net/-/profile/personal_access_tokensin 1 report
- hxxp://jenkins.test[.]net:8080/in 1 report
- jenkins.test[.]netin 1 report
- hxxp://jenkins.test[.]net:8080/loginErrorin 1 report
- hxxp://jenkins.test[.]net:8080/managein 1 report
- hxxp://jenkins.test[.]net:8080/securityRealm/in 1 report
- hxxp://jenkins.test[.]net:8080/securityRealm/addUserin 1 report
- hxxp://jenkins.test[.]net:8080/job/secure-service/in 1 report
- hxxp://gitlab.test[.]net/root/secure-servicein 1 report
- hxxp://jenkins.test[.]net:8080/job/secure-service/12/ws/in 1 report
- hxxp://jenkins.test[.]net:8080/job/secure-service/12/execution/node/3/ws/in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.