{
  "name": "Paste Bins - Code",
  "observable_types": [
    "domain"
  ],
  "published": "2026-09-09T00:00:00",
  "modified": "2026-09-09T00:00:00",
  "authors": [
    "Mike Bunner (B'ad Samurai)"
  ],
  "description": "Functionally similar to \"paste bins\" with the added features of code storage, allowing abuse for C2.\n\nUnlike regular paste bins, many organizations may implicitly trust these services for development code snippets and training. These services may also allow updating of code snippets via API.\n\nThese are not IOCs, but legitimate services that may be leveraged by an actor. Use this list to mitigate organizational risk accordingly.\n",
  "references": [
    "https://authentic8.com/blog/what-is-pastebin-cyberthreat-intelligence/",
    "https://socradar.io/blog/top-5-paste-sites-used-by-threat-actors/",
    "https://community.hpe.com/t5/hpe-threat-labs/new-pastebin-like-service-used-in-multiple-malware-campaigns/ba-p/7265783"
  ],
  "techniques": [
    "T1102.001",
    "T1204.004",
    "T1105",
    "T1567.003",
    "T1608.001"
  ],
  "observables": [
    {
      "type": "domain",
      "value": "admeducation.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "aionote.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "codebin.cc",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "coderstool.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "copyandshare.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "ctrlv.codes",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "ctxt.io",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "devbeaver.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "fragbin.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "mypaste.dev",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "ofcode.org",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "pastefy.app",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "pastepool.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "pasteshare.ninja",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "pastevoid.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "pastezen.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "pym.dev",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "pythonmorsels.com",
      "description": "Code Paste Bin"
    },
    {
      "type": "domain",
      "value": "ctxt.io",
      "description": "Code Paste Bin"
    }
  ]
}