# Bulwark Black - extracted indicators
# LIVE indicators

## Domains (19)
asyncio.run
atomicmail.io
datetime.datetime.now
docs.litellm.ai
f.read
ghcr.io
gradle.properties
hmac.new
litellm-1.107.0.data
litellm.ai
litellm.dev
m.group
models.litellm.cloud
os.open
r.read
re.search
subprocess.run
tarfile.open
www.litellm.dev

## URLs (4)
http://www.litellm.dev/healthcheck
https://docs.litellm.ai/blog/security-incident-oct-21-2026#how-this-happened
https://github.com/Berri-AI/litellm
https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt

## sha1 (2)
20535d8fa11f786a6c24df7488a0e449ed5f09ad
66c8f5b1a9cefaa7c55b758f86f4ab552f2e859e

## sha256 (15)
0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a
12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484
1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00
20a59e5a285799e7cf7fa16cfba1c1414f1e84a8459e14207cfd4e998c2cd24b
2befe2a79fb4fbbd9a543b5b40b530c8cffa8771bab22b8fb22b2e4ae3b1f819
34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa
462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7
56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf
668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6
6ea3d8ef6cf73a72d8df24f663b7a31ce67494eeb9b0d707b93484e66675d2df
7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d
9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25
a898fd08ad220fed52488906eb45d196f332b972ad5d85214e7726545ecc4218
bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5
c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054