{
  "name": "Paste Bins",
  "observable_types": [
    "domain"
  ],
  "published": "2026-09-09T00:00:00",
  "modified": "2026-09-09T00:00:00",
  "authors": [
    "Mike Bunner (B'ad Samurai)"
  ],
  "description": "Public \"paste bin\" services allow (usually) anonymous posting and retrieval of arbitrary text.\n\nThese services are commonly abused as dead-drop resolvers, staging locations for second-stage payloads and scripts, and low-cost exfiltration destinations. Many are permitted by default because they aren't categorized well by security vendors.\n\nThese are not IOCs, but legitimate services that may be leveraged by an actor. Use this list to mitigate organizational risk accordingly.\n",
  "references": [
    "https://authentic8.com/blog/what-is-pastebin-cyberthreat-intelligence/",
    "https://socradar.io/blog/top-5-paste-sites-used-by-threat-actors/",
    "https://community.hpe.com/t5/hpe-threat-labs/new-pastebin-like-service-used-in-multiple-malware-campaigns/ba-p/7265783"
  ],
  "techniques": [
    "T1102.001",
    "T1204.004",
    "T1105",
    "T1567.003",
    "T1608.001"
  ],
  "observables": [
    {
      "type": "domain",
      "value": "0bin.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "1clickpaste.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "app.textbin.theenthusiast.dev",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "beanpaste.fun",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "bitbin.it",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "bpa.st",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "cl1p.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "clbin.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "clipboardify.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "cliper.click",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "clipnote.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "cobrowse.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "codepad.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "codeshare.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "commie.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "controlc.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "copybucket.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "copypaste.me",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "copy-paste.online",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "cryptobin.co",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "cutapaste.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "defuse.ca",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "dotnetfiddle.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "dpaste.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "dpaste.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "everfall.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "file.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "filebin.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "friendpaste.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "gisto.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "glot.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "gofile.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "ideone.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "innomi.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "ivpaste.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "ix.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "jpst.it",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "justpaste.app",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "justpaste.it",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "justpaste.me",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "justpasteit.com.in",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "klipit.in",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "kpaste.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "masscode.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "n0paste.eu",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "n0paste.tk",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "nekobin.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "nopaste.info",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "notes.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "oneview.it",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "p.ip.fi",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.ax",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.centos.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.ee",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.fo",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.jp",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.js.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.lv",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.mod.gg",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.mozilla.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.myst.rs",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.org.ru",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.rohitab.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste.sh",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste2.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste4btc.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastebin.ai",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastebin.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastebin.fi",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastebin.fr",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastebin.osuosl.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastebin.pt",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "paste-bin.xyz",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastebox.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastecode.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pasted.co",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pasteform.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastefs.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pasteio.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastejustit.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastelink.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastequest.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastes.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastey.icu",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "pastie.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "privatebin.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "rentry.co",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "rentry.org",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "serv00.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "sharetext.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "snippet.host",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "snippleaf.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "snipplr.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "sprunge.us",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "telegra.ph",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "temp.sh",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "tempisite.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "tempshare.io",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "termbin.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "textbins.online",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "tny.cz",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "toptal.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "tutpaste.com",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "txtbin.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "vaultb.in",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "vpaste.net",
      "description": "Paste bin"
    },
    {
      "type": "domain",
      "value": "zerobin.net",
      "description": "Paste bin"
    }
  ]
}