{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/railway-secrets-incident-downstream-credential-recovery/",
    "fang": "live",
    "exported_at": "2026-10-22T16:54:44Z",
    "total": 19,
    "categories": 2
  },
  "iocs": {
    "Domains": [
      "blog.railway.com",
      "docs.railway.com",
      "station.railway.com",
      "status.railway.com"
    ],
    "URLs": [
      "https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access",
      "https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-gcp-access",
      "https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-github-access",
      "https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-anthropic-usage",
      "https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-grok-usage",
      "https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-openai-usage",
      "https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-openrouter-usage",
      "https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-usage-in-stripe",
      "https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset",
      "https://blog.railway.com/p/security-disclosure-recommendation-rotate-mongodb-database-credentials",
      "https://blog.railway.com/p/security-disclosure-recommendation-rotate-mysql-database-credentials",
      "https://blog.railway.com/p/security-disclosure-recommendation-rotate-postgresql-database-credentials",
      "https://blog.railway.com/p/security-disclosure-recommendation-rotate-redis-database-credentials",
      "https://blog.railway.com/p/security-disclosure-wednesday-october-21st",
      "https://docs.railway.com/integrations/api"
    ]
  }
}