gitlab.com
Checking live DNS resolution...
100/100
CRITICAL RISK
796
Malware URLs
1
Resolved IPs
717
Abuse Reports
371
Active URLs

Threat Intelligence Summary: gitlab.com

Risk Level: CRITICAL — Threat Score: 100/100

Assessment: gitlab.com is a high-volume malware distribution domain with 371 currently active malicious URLs. The scale of activity indicates a dedicated threat infrastructure rather than a compromised legitimate site. Immediate network-level blocking is strongly recommended. Malware families associated with this domain include ssh, RemcosRAT, SirkeiraStealer.

Recommendation: Block immediately at DNS and firewall level

Total Malware URLs: 796 — Active: 371 — Resolved IPs: 1 — Abuse Reports: 717

First Seen: 2025-10-01T07:09:09 — Last Online: 2026-10-12T02:52:48

Data aggregated from threat intelligence feeds including URLhaus and community reports.

Domain Threat Analysis

gitlab.com has been associated with 796 malware URLs , of which 371 are currently active . The primary threat types are malware_download.

Active threat. This domain is currently serving malicious content. With over 796 tracked malware URLs, this domain is a significant malware distribution point and should be blocked at the DNS or firewall level.

Associated malware families include: CheatSheet, exe, gitlab.

Look Up Another Domain or IP

Check any domain or IP address against our threat intelligence database.

Access This Data via API

Integrate WAYSCloud domain threat intelligence into your security tools, SIEM, or firewall rules. Query any domain programmatically for malware URLs, resolved IPs, and threat scores.

API Documentation Integration Guide

See how we classify and verify threats →

Related Threat Intelligence

Top Threats Today Latest Attacks Active Malware Domains Understanding Botnets SSH Attack Explainer How to Block Threats What is a Phishing Domain? About Malware Distribution Check Another Domain
Timeline
First Seen
2025-10-01T07:09:09
Last Seen Online
2026-10-12T02:52:48
Data Last Updated
2026-10-12T05:00:47.545297
Status Activity Timeline (50 changes recorded)

Complete history of all status changes detected for URLs on this domain. Tracking online/offline transitions helps identify malware lifecycle patterns.

ONLINE
https://gitlab.com/SpinRain/warzoneexternalcheat/-/raw/HEAD/Loader.exe
First detected as online
ONLINE
https://gitlab.com/GrizzleBugg/monotone-hwid-spoofer/-/raw/HEAD/Monotone-HWID-Spoofer-master.zip
First detected as online
ONLINE
https://gitlab.com/downshifts/valorantexternalcheat/-/raw/HEAD/Loader.exe
First detected as online
ONLINE
https://gitlab.com/chaingangs/fivem-mod-menu/-/raw/HEAD/Loader.exe
First detected as online
ONLINE
https://gitlab.com/LoraHex/lunaexecutor/-/raw/HEAD/LunaExecutor.zip
First detected as online
ONLINE
https://gitlab.com/fredostorm/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/HEAD/eft_hack.zip
First detected as online
OFFLINE → ONLINE
https://gitlab.com/mogh739/static-assets/-/raw/main/agent-install.sh
Status changed from offline to online
OFFLINE → ONLINE
https://gitlab.com/mogh739/metrics-agents/-/raw/main/agent-install.sh
Status changed from offline to online
ONLINE → OFFLINE
https://gitlab.com/Devilsprite/xeno-executor/-/raw/main/XenoExecutor.zip
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/mindgone/eulencheats-fivem/-/raw/main/Loader.exe
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/MysteryBless/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/Loader.exe
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/Spazedurk/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/AmillyRow/quantv-sp-fivem-ragemp-altv/-/raw/main/QuantV_Latest_2026.zip
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/JANNECLIMB/lunaexecutor/-/raw/main/LunaExecutor.zip
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/randydiva/monotone-hwid-spoofer/-/raw/main/Monotone-HWID-Spoofer-master.zip
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/khannrover/fivem-external-cheat/-/raw/main/Loader.exe
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/StayFlye/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/Loader.exe
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/burnlights/fortnitespoofer/-/raw/main/FortniteSpoofer.zip
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/evolintent/fluxus-executor/-/raw/main/FluxusExecutor.zip
Status changed from online to offline
ONLINE → OFFLINE
https://gitlab.com/spindoctors/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip
Status changed from online to offline
Showing 20 most recent changes of 50 total
Associated IP Addresses (1)

All IP addresses this domain has resolved to (current and historical). These IPs may host or have hosted malware URLs.

172.65.251.78
717 abuse reports Severity: high
Malware Classification
ssh
Malware family "ssh" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
RemcosRAT
Malware family "RemcosRAT" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
SirkeiraStealer
Malware family "SirkeiraStealer" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
NyxStealer
Malware family "NyxStealer" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
rev-base64-loader
Malware family "rev-base64-loader" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
github
Malware family "github" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
umbralstealer
Malware family "umbralstealer" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
MassLogger
Malware family "MassLogger" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
elf
Malware family "elf" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
CrealStealer
Malware family "CrealStealer" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.
Malware URLs (796)

All malicious URLs identified on this domain. Status reflects last known state from threat intelligence feeds.

https://gitlab.com/SpinRain/warzoneexternalcheat/-/raw/HEAD/Loader.exe
Active Threat
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-11
CheatSheet exe gitlab
https://gitlab.com/GrizzleBugg/monotone-hwid-spoofer/-/raw/HEAD/Monotone-HWID-Spoofer-master.zip
Active Threat
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-11
CheatSheet gitlab zip
https://gitlab.com/downshifts/valorantexternalcheat/-/raw/HEAD/Loader.exe
Active Threat
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-11
CheatSheet exe gitlab
https://gitlab.com/chaingangs/fivem-mod-menu/-/raw/HEAD/Loader.exe
Active Threat
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-11
CheatSheet exe gitlab
https://gitlab.com/LoraHex/lunaexecutor/-/raw/HEAD/LunaExecutor.zip
Active Threat
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-11
CheatSheet gitlab zip
https://gitlab.com/fredostorm/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/HEAD/eft_hack.zip
Active Threat
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-11
CheatSheet gitlab zip
https://gitlab.com/mogh739/metrics-agents/-/raw/main/agentd-linux-arm64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/mogh739/static-assets/-/raw/main/agent-install.sh
Active Threat
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
docker sh ssh
https://gitlab.com/mogh739/static-assets/-/raw/main/collector-linux-x64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/mogh739/static-assets/-/raw/main/agentd-linux-x64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/mogh739/metrics-agents/-/raw/main/collector-legacy-linux-x64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/mogh739/metrics-agents/-/raw/main/agentd-linux-x64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/mogh739/metrics-agents/-/raw/main/agent-install.sh
Active Threat
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
docker sh ssh
https://gitlab.com/mogh739/metrics-agents/-/raw/main/collector-linux-arm64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/mogh739/metrics-agents/-/raw/main/collector-linux-x64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/mogh739/static-assets/-/raw/main/collector-linux-arm64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/mogh739/static-assets/-/raw/main/agentd-linux-arm64
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
elf ssh
https://gitlab.com/MysteryBless/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/Loader.exe
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
CheatSheet exe gitlab
https://gitlab.com/mindgone/eulencheats-fivem/-/raw/main/Loader.exe
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
CheatSheet exe gitlab
https://gitlab.com/Spazedurk/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip
Taken Down
IP: 172.65.251.78
Type: malware_download
First Seen: 2026-10-09
CheatSheet gitlab zip
Showing 20 of 796 URLs