IOC Radar
DomainMediumSignal 17/100

backoffice.gate2way.vip

First Seen
Jun 12, 2025
Last Seen
Jun 12, 2025
Jun 12
First Seen
367d ago
Jun 12
Last Seen
367d ago
2
Reports
source reports
17%
Confidence
medium
Found in 2 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
17%
Signal Score
17 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

29 techniques

Feed Intelligence Summary

2 reports17% confidence
2
Source reports
17%
Confidence score
Category tags
.cc domainaccount compromiseaccount discoveryaccount profilingaccount takeoveractive scanninganalysis ob0001analysis ob0002ascii textblack bastablack-bastabotnetbotnet activitycatalog treecjutxgcnmicrosoft ecccommandcommand and controlcontrol ta0011covacova cryptbotcredential accesscryptbotcus subjectdata exfiltrationdata oc0004defense evasiondenial of servicedistributed attacksdnserror httpsevasion ta0005exchange metafollow bot activitygeckoget httpget httpsgoogle taghtml documenthtml interneticmpiframe tagsimpact ta0040indicatorkhtmllearnmalicious softwaremalwarenetworknetwork probingnumberob0007 impactob0012 fileomicrosoft copen threatpost httpsprocess injectionprocess oc0003reconnaissancerequestresearchedresolved ipsscript tagsserver casocial media attacksocial media manipulationstealerstwa lredmondsystem oc0001t1005t1027t1055t1059t1068t1071t1071.001t1078t1105t1189t1190t1204t1486t1496t1499t1499.002t1499.003t1565t1566t1567t1573t1583t1583.001t1588.002t1589t1595t1595.001t1595.002t1595.003ta0004 defenseta0009 commandtags twittertwitterupdate securewindows nt

Activity Timeline

1 total obs
Jun 12Jun 12

Threat Activity Heatmap

Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreLow Risk
17
SIGNAL
Signal Score
17%
Confidence
2
Reports
First seenJun 12, 2025
Last seenJun 12, 2025

VirusTotal

Not checked

WHOIS

description
Surprised: Follow bot account affects threat researcher(s)account(s). % path , attempts DoS. Threatening account name,. (00285c99b52d41679b1aa3b8a80895b037df8a7500f4ad97ce06068eac4a95b7 | = follow) || {2025-05-20_bf3a6ba6e3421a7214ffbfe97642a578_amadey_black-basta_cova_cryptbot_elex_luca-stealer FastCopy5.9.0.exe} ET DNS Query for .cc PROTOCOL-ICMP PATH MTU denial of service attempt PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set
raw
Administrative city: REDACTED FOR PRIVACY Administrative country: REDACTED FOR PRIVACY Administrative state: REDACTED FOR PRIVACY Create date: 2024-02-14 00:00:00 Domain name: gate2way.vip Domain registrar id: 146 Domain registrar url: whois.godaddy.com Expiry date: 2029-02-14 00:00:00 Name server 1: ns19.domaincontrol.com Name server 2: ns20.domaincontrol.com Query time: 2024-02-15 11:47:10 Registrant city: 1f8f4166599d23ee Registrant company: b46a98a26fe2fd9f Registrant country: United States Registrant email: f651612a2f356ad3s@ Registrant fax: 1f8f4166599d23ee Registrant name: 1f8f4166599d23ee Registrant phone: 1f8f4166599d23ee Registrant state: 30bdd2917a604c83 Registrant zip: 1f8f4166599d23ee Technical city: REDACTED FOR PRIVACY Technical country: REDACTED FOR PRIVACY Technical state: REDACTED FOR PRIVACY Update date: 2024-02-14 00:00:00

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 1 year ago
Appeared in 2 threat reports