IOC Radar
DomainMediumSignal 100/100

comfyupdate.org

Location
CanadaCanada
First Seen
Jul 5, 2025
Last Seen
Jun 18, 2026
Jul 5
First Seen
351d ago
Jun 18
Last Seen
3d ago
11
Reports
source reports
99%
Confidence
medium
Found in 11 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

64 techniques

Feed Intelligence Summary

11 reports99% confidence
11
Source reports
99%
Confidence score
Category tags
active scanningaisocaisoc dnsakamaiaptaptq95asp.net backdoorassessment blogattack targetsbackdoorblogbotnetbrute forcebuilding constructioncanadacanada daychamd5 blogchiselchisel malwarecommand and controlcommunication protocolcommunications networksconstruction materialsconstruction safetyconstruction technologycontactcredential accesscredential harvestingcredential stuffingcritical infrastructurecustom malwaredata encryptiondata exfiltrationdefense systemsdetection tooldistributed attacksdll injectionemergency servicesenergyenergy distributionenergy systemsexchange serverexploitationfileless malwarefilesfinancial systemsfraud riskftpgogovernment facilitiesgrouphigh-tech sectorhttp scannerindicatoriot icslateral movementmalicious dllmalicious softwaremalwarememory injectionmicrosoft exchangemultiple threat actorsnetworknetwork probingnetwork protocolnetwork scanningnetwork securitynighteaglenighteagle aptnorth americaoil & gasowa/authpathsphishingphishing attackpost-exploitationpower generationpower systemsprocess injectionprotocol exploitationr1090reconnaissanceremote accessremote servicesrenewable energyresearchedsoarsocial engineeringssh attackstringssupply chain attackt1003t1003.003t1005t1008t1021t1021.001t1021.002t1027t1027.002t1040t1041t1046t1053.005t1055t1059t1059.001t1059.003t1059.004t1068t1070t1071t1071.001t1071.004t1076t1077t1078t1083t1090t1090.001t1090.003t1105t1110t1110.002t1114.002t1133t1189t1190t1204.002t1205.001t1486t1496t1499.002t1499.003t1505.003t1518.001t1552.001t1555t1563t1565t1565.001t1566t1566.001t1566.002t1566.003t1566.004t1567.002t1568.002t1573.001t1583.001t1584.004t1595t1595.001t1595.002t1595.003telnet threatthe constant companytransportation networkstucowsus-based c2water systemsweb shellweb trafficzero-day exploit

Activity Timeline

1 total obs
Jun 18Jun 18

Threat Activity Heatmap

Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Intelligence SummaryAI Generated

The domain **comfyupdate.org** has been identified as an active indicator of compromise (IOC) associated with multiple cyber threats, including botnet activity, malware distribution, and phishing campaigns. First observed on July

Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
11
Reports
First seenJul 5, 2025
Last seenJun 18, 2026

VirusTotal

Not checked

WHOIS

domain rank
-1
raw
Administrative city: REDACTED FOR PRIVACY Administrative country: REDACTED FOR PRIVACY Administrative state: REDACTED FOR PRIVACY Create date: 2025-03-20 00:00:00 Domain name: comfyupdate.org Domain registrar id: 69 Domain registrar url: http://www.tucows.com Expiry date: 2026-03-20 00:00:00 Query time: 2025-03-21 13:26:38 Registrant city: 1f8f4166599d23ee Registrant company: 0a2e43e2178cddfc Registrant country: Saint Kitts and Nevis Registrant email: 29e2c061f3c9524es@ Registrant fax: 31d1617d95c9a75c Registrant name: 1f8f4166599d23ee Registrant phone: 31d1617d95c9a75c Registrant state: 5c1896d54f3bb30d Registrant zip: 1f8f4166599d23ee Technical city: REDACTED FOR PRIVACY Technical country: REDACTED FOR PRIVACY Technical state: REDACTED FOR PRIVACY Update date: 2025-03-21 00:00:00
references
Julypt1.pdf, https://github.com/RedDrip7/NightEagle_Disclose/blob/main/Exclusive%20disclosure%20of%20the%20attack%20activities%20of%20the%20APT%20group%20NightEagle.pdf, https://github.com/RedDrip7/NightEagle_Disclose/blob/main/checksum.txt, https://cyberarmor.tech/phishing-attack-targets-canadian-infrastructure-on-canada-day/, https://www.ctfiot.com/259781.html
subdomains count
0

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 11 months ago · Last seen 3 days ago
Appeared in 11 threat reports