IOC Radar
DomainMediumSignal 78/100

b27.icu

Location
JapanJapan
First Seen
Mar 3, 2026
Last Seen
Jun 9, 2026
Mar 3
First Seen
99d ago
Jun 9
Last Seen
yesterday
11
Reports
source reports
78%
Confidence
medium
17/91
VirusTotal
detections
Found in 11 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
78%
Signal Score
78 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

33 techniques

Feed Intelligence Summary

11 reports78% confidence
11
Source reports
78%
Confidence score
Category tags
active scanactive scanningasiaautomated analysisautomated exploitationautomated reconnaissanceautomated scanautomated scanningautomated sweepautomated-scanningblocklistbotnet activitybotnet infrastructurebrute forcebrute force attemptbrute force attemptsbrute_forcebrute_force_attackc2c2 activityc2 communicationc2 infrastructurec2_activitycommand & controlcommand and controlcommunication protocolcompromised hostcredential accesscredential stuffingcryptocryptocurrencydata encryptiondata exfiltrationdata store exposuredestroylist_phishingdomainsdrainerencryptionexploitexploitation activityfraudftpftp brute forcehttp scannerhttp/https c2httpsidentity & access exploitationindicatorinjection activityjapanlateral movementmalicious network activitymalicious softwaremalwaremalware deliverymalware detectionmalware distributionmalware trafficmalware_detectedmanual-collectionmedium-riskmonthlynetworknetwork intrusionnetwork intrusion attemptnetwork probingnetwork protocolnetwork scanningnetwork securitynovel iocnovel ioc detectionnovel iocsnovel-iocnovel_iocphishingpotential exploitprecogprocess injectionprotocol exploitationreconnaissanceremote accessremote servicesresearchedscamscams & fraudsecurity operationssmtpssh attackt1016t1021t1021.001t1021.002t1040t1046t1048t1053t1055t1059t1071t1071.001t1076t1077t1078t1110t1110.002t1190t1203t1204t1486t1499.002t1563t1565t1569t1571t1583t1584t1588t1595t1595.001t1595.002t1595.003tcp-scanningtelnet threatthreat intelligencetype osintweb traffic

Activity Timeline

1 total obs
Jun 9Jun 9

Threat Activity Heatmap

Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
78
SIGNAL
Signal Score
78%
Confidence
11
Reports
First seenMar 3, 2026
Last seenJun 9, 2026

VirusTotal

17/ 91vendors flagged
19% detection rateJun 10, 2026

WHOIS

registrar
Gname.com Pte. Ltd.
creation date
2025-06-01T12:19:47
expiration date
2027-06-01T23:59:59
updated date
2026-06-02T00:14:07
name servers
EXPIRE1.GNAME-DNS.COM, EXPIRE2.GNAME-DNS.COM
country
US
emails
[email protected]
org
Redacted for privacy
status
autoRenewPeriod https://icann.org/epp#autoRenewPeriod, clientTransferProhibited https://icann.org/epp#clientTransferProhibited

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 3 months ago · Last seen 1 day ago
Appeared in 11 threat reports