webhook.site
Classification: Whitelisted
webhook.site is a whitelisted (trusted) hostname. Reported by 7 threat sources, last seen 2026-03-03. IoC context and downloadable threat intel on Maltiverse.
Current activity
- Online — resolving/reachable. Last checked 2026-08-04 08:02:40.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: SHAI-HULUD (S9008) CORESHELL (S0137)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Top Popularity Site | Tranco | 2026-03-03 12:55:18 | 2026-03-03 12:55:18 | ||
| naver phishing | Maltiverse | 2026-02-20 01:01:13 | 2026-02-20 01:01:13 | malicious-activity | T1566 Phishing |
| Disposable email host | Maltiverse Threat Observatory | 2021-07-02 00:00:38 | 2026-01-05 00:00:08 | country_code:ec industry:financial-services | |
| hacked_npmrepos | Maltiverse Threat Observatory | 2025-09-16 12:40:07 | 2025-11-26 12:40:07 | country_code:ec industry:financial-services | |
| Top Popularity Site | Cisco Umbrella | 2023-03-04 02:13:34 | 2025-10-21 12:57:29 | benign | |
| Generic Malware | Maltiverse Threat Observatory | 2025-09-30 07:10:09 | 2025-10-01 17:10:08 | country_code:ec industry:financial-services | |
| Shai-Hulud | ThreatFox Abuse.ch | 2025-09-30 06:17:10 | 2025-09-30 06:17:10 | malicious-activity | S9008 Shai-Hulud |
| Coreshell | Maltiverse Threat Observatory | 2025-09-11 12:40:04 | 2025-09-11 12:40:04 | country_code:ec industry:financial-services | S0137 CORESHELL |
| Xworm | Maltiverse Threat Observatory | 2025-06-13 18:40:06 | 2025-06-13 18:40:06 | country_code:ec industry:financial-services | |
| Top 1M Site | Cisco Umbrella | 2022-07-18 23:56:49 | 2025-05-24 08:43:44 | benign | |
| Malicious URL | Hybrid-Analysis | 2023-09-07 11:30:03 | 2024-01-12 15:15:05 | ||
| Alexa Top 1 Million | Alexa | 2020-04-27 20:46:15 | 2022-07-04 01:54:12 | benign | |
| Malicious site | Hybrid-Analysis | 2020-10-20 14:45:08 | 2022-01-07 12:15:07 | ||
| Malware | Hybrid-Analysis | 2021-06-10 12:45:19 | 2021-07-15 20:15:04 | ||
| Gen:Variant.Bulz | Hybrid-Analysis | 2021-06-21 10:00:41 | 2021-06-21 10:00:41 | ||
| Wacapew.C | Hybrid-Analysis | 2021-06-01 16:46:11 | 2021-06-01 16:46:11 | ||
| Generic.Malware | Hybrid-Analysis | 2020-10-25 11:45:09 | 2021-04-27 08:30:23 | ||
| CVE-2017-0199 | Hybrid-Analysis | 2021-03-04 17:00:46 | 2021-03-04 17:00:46 | ||
| Probably Heur.W97Obfuscated | Hybrid-Analysis | 2021-02-11 10:00:13 | 2021-02-11 10:00:13 | ||
| Malware.Generic | Hybrid-Analysis | 2020-10-06 03:45:29 | 2020-10-06 03:45:29 | ||
| Trojan.Malware.300983 | Hybrid-Analysis | 2020-06-23 17:15:08 | 2020-06-23 17:15:08 | ||
| Blocker | Hybrid-Analysis | 2020-05-05 18:00:36 | 2020-05-05 18:00:36 |
Tags
phishingIP addresses resolved by this hostname
- 46.4.105.116 (2020-04-27 20:46:15)
- 178.63.67.106 (2026-08-04 08:02:40)
- 2a01:4f8:121:11a5::2 (2026-08-04 08:02:40)
- 178.63.67.153 (2026-08-04 08:02:40)
- 2a01:4f8:121:114d::2 (2026-08-04 08:02:40)
Whois information
- AS name
- AS24940 Hetzner Online GmbH
- Domain
- webhook.site
- TLD
- site
- First indexed
- 2020-04-27 20:46:15
- Last updated
- 2026-08-04 08:02:41