hxxp://127.0.0[.]1:4096/global/upgradeURL
Reported by 1 independent source · first reported by Datadog Security Labs · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)“Finally, the attacker hosts a webpage that sends a top-level cross-origin request to hxxp://127.0.0[.]1:4096/global/upgrade:”
Indicators reported together
named in the same reports- hxxp://127.0.0[.]1:4096/in 1 report
- calculator[.]appin 1 report
- httpapibuilder[.]groupin 1 report
- effect[.]mapin 1 report
- hxxp://165.227.82[.]252:4444in 1 report
- 165.227.82[.]252in 1 report
- hxxp://165.227.82[.]252:4444/in 1 report
- hxxp://165.227.82[.]252/opencode-malicious.tgzin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.