IPHighVerifiedSignal 25/100
2.1.2.1
Location
United StatesWashington, District of Columbia
First Seen
Sep 26, 2025
Last Seen
May 22, 2026
Found in 5 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
25%
Signal Score
25 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionWashington, District of Columbia
OrganizationOracle America Inc
Feed Intelligence Summary
5 reports25% confidence
5
Source reports
25%
Confidence score
Category tags
active scanactive scanningalfperanimeaptas autonomousbackbankingbodybotnetbotnet activitybrute forcebrute force attackbuttonc2canadacanada canadacanada unknownchoosecircleck idck matrixclosecnamecode executioncommandcommand & controlcommand and controlcommand executioncommon headercommon upatrecompromised hostconfigcontactcopycopy md5copy sha1copy sha256creation datecredential accesscredential stuffingcredit card servicescursedata accessdata copyingdata exfiltrationdata store exposuredata transferddosdeepseadefense evasiondetail domaindevelopment attdistributed attacksdns attackdnssecdockdownloaderdropperentityentrieserroreuropeexe downloadexecutable fileexploitation activityexpressfilesfinancefinancial servicesfinancial technologyfirstflagfooterformfrancegeneral fullget updatesgooglehandlehashhostname enumerationhrefhstrhttp attackiana registraridentity & access exploitationiframeindicatorinformation gatheringingress tool transferinjection activityinputinput urlinput validation bypassiot securityipv4ipv4 addkittylearnlinklinkslinks domainmainmalicious linksmalicious softwaremalwaremetametadata analysismitre attmovedmsilname serversname tacticsname valuenamecheap incnetworknetwork relatednetwork scanningnetwork trafficnetwork traffic analysisnextnext associatednorth americaontarioopenp2p zeuspassive dnspassword attackspathpath traversalpaymentpayment processingphishingpleasepresent sepprocess injectionprotocol h3pulse pulsesravenrdap databasereconnaissanceremote servicesrequestresearchedreverse dnsrolesscriptscript domainsscript urlssesearchsecurity operationsshopifyshow techniquesignssizesmallsocial media securitysoftware exploitationspanspawnsst booleanstopstringsstructswedensystemt1005t1021t1027t1030t1040t1045t1055t1057t1059t1071t1071.001t1105t1110.001t1110.002t1110.003t1110.004t1112t1129t1143t1189t1190t1203t1204t1204.001t1480t1486t1496t1499.002t1499.003t1553t1562t1565t1566t1568t1573t1583t1589.001t1595.001t1595.002t1595.003targeted attacktarottersethreat actorthreat intelligencetitletor nodetrojantrojan malwaretrojandroppertrojanspytwittertypeunitedunited statesunknown nsurlsusvaluevulnerability scanwealth managementweb application attackweb application exploitationweb securitywebglwin32 malwarewindowwindows malwarewrite
Activity Timeline
May 22May 22
Threat Activity Heatmap
· Peak: 2026-05-22LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreLow Risk
25
SIGNAL
Signal Score
25%
Confidence
5
Reports
First seenSep 26, 2025
Last seenMay 22, 2026
Verified IOC
GeolocationUS
CountryUnited States
LocationWashington, District of Columbia
OrgOracle America Inc
Coords48.8582, 2.3387
VirusTotal
Not checked
WHOIS
- description
- DiabloFans.com redirects to curse.llc a shopify storefront that offering witchcraft related products and/or services. It will take time to break down the true intent of the website. Maybe it’s hacked maybe it’s a tool. I think targeting is involved because of the constant appearance of diablofans.com in various types of research over time including a most recent pulse related to a target There are multiple checkins, bots, Trojans , worms, etc. This entire pulse will be populated by OTX , I won’t be able to annotate for this pulse, Let’s see what happens. #Lowfi:HSTR:MSIL/Obfuscator.Deepsea.C
- raw
- inetnum: 2.1.0.0 - 2.1.255.255 netname: ORCL-AMER-OCI-21 country: US admin-c: ORCL1-RIPE tech-c: ORCL1-RIPE status: SUB-ALLOCATED PA org: ORG-OAI2-RIPE mnt-by: ORCL-MNT created: 2024-10-04T14:22:49Z last-modified: 2024-10-04T14:22:49Z source: RIPE organisation: ORG-OAI2-RIPE org-name: Oracle America Inc. country: US org-type: OTHER address: 2300 Oracle Way Austin, TX 78741 USA abuse-c: AR17199-RIPE mnt-ref: ORCL-MNT mnt-by: ORCL-MNT created: 2023-05-02T20:16:11Z last-modified: 2023-05-05T09:48:35Z source: RIPE # Filtered role: Domain Administrator address: 500 Oracle Parkway, M/S 501ip3 address: Redwood Shores address: CA, 94065 admin-c: RN3825-RIPE admin-c: CM16298-RIPE admin-c: MP29448-RIPE admin-c: JH27328-RIPE admin-c: GB21983-RIPE admin-c: SS33835-RIPE abuse-mailbox: [email protected] nic-hdl: ORCL1-RIPE mnt-by: ORCL-MNT created: 2016-03-15T11:29:38Z last-modified: 2019-02-06T16:27:54Z source: RIPE # Filtered
- references
- https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
highFirst detected 8 months ago · Last seen 22 days ago
Appeared in 5 threat reports