Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
15 IOCs
GreyNoise Labs Weekly OAST (Well-known Out-of-band Interaction Domains) Report • Week Ending 2026-02-13
Excerpt
Overview OAST domains appeared across multiple HTTP fields: request bodies (4,331 occurrences, 52.8%), URI paths (1,709, 20.8%), request header values (1,272, 15.5%), URL paths (392, 4.8%), cookies (383, 4.7%), and user-agent strings (122, 1.5%). The distribution across multiple injection vectors indicates automated vulnerability scanning toolkits that embed callback domains into every exploitable parameter. Five Interactsh domain variants were observed: oast.pro (4,182…
Read the original report →Indicators of Compromise
Open the mindmap →15 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2018-10561 | High | Score 59/100 | First seen |
| CVE | CVE-2025-34028 | Medium | Score 51/100 | First seen |
| CVE | CVE-2021-39152 | Medium | Score 51/100 | First seen |
| CVE | CVE-2024-32113 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-8085 | Medium | Score 51/100 | First seen |
| MD5 | 5567e9ce23e5549e0fcd7195f3882816 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-0770 | Medium | Score 59/100 | First seen |
| CVE | CVE-2025-4123 | Medium | Score 54/100 | First seen |
| CVE | CVE-2026-1281 | High | Score 63/100 | First seen |
| MD5 | 11a384388ad36777e1a2e121495037fe | Medium | Score 53/100 | First seen |
| CVE | CVE-2022-26134 | High | Score 82/100 | First seen |
| CVE | CVE-2025-8943 | Medium | Score 54/100 | First seen |
| CVE | CVE-2025-2777 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-61882 | High | Score 62/100 | First seen |
| CVE | CVE-2025-2775 | Medium | Score 54/100 | First seen |
IOC Relationship Graph
Building graph…