DomainMediumSignal 84/100
diagramfiremonkeyowwa.fun
Location
TurkeyFirst Seen
Dec 11, 2023
Last Seen
Apr 7, 2026
Found in 13 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
84%
Signal Score
84 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Feed Intelligence Summary
13 reports84% confidence
13
Source reports
84%
Confidence score
Category tags
active scanactive scanninganonymization abuseaptbad reputationbelleza equiposbotnetbotnet activitybrute forcebrute force attemptsc2c2 servercertciudadcommand & controlcommand and controlcompromised infrastructurecredential accesscredential harvestingcredential stealingcredential stuffingdata exfiltrationdata store exposuredata theftdgadistributed attacksexploitation activityfigureidentity & access exploitationindicatorinfostealerinfrastructure acquisitionreconnaissanceinjection activityiociocsleer mslummalumma stealermalicious softwaremalwaremalware analysismalware distributionmobile threatnetworknetwork probingnetwork reconnaissancenetwork scanningoperating systempalo altophishingphishing attackpolticapotential intrusion attemptprocess injectionquasarquasar ratreconnaissanceredlineredline stealerremcos trojanremote accessremote servicesresearchedsalascanning activitysocial engineeringt1005t1016t1021t1021.001t1036t1041t1055t1056t1059t1059.003t1069.001t1071t1071.001t1078t1083t1105t1110.001t1133t1190t1486t1496t1499.002t1499.003t1565t1566t1566.001t1566.002t1566.003t1571t1573t1587.001t1589t1590.001t1595t1595.001t1595.002t1595.003threat actortor exit nodetor networktor nodeturkeyunitutensiliosvaporalvidarvidar stealervistawin32 malwarewindows malwarewishlist vista
Activity Timeline
Apr 7Apr 7
Threat Activity Heatmap
· Peak: 2026-04-07LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreHigh Risk
84
SIGNAL
Signal Score
84%
Confidence
13
Reports
First seenDec 11, 2023
Last seenApr 7, 2026
VirusTotal
Not checked
WHOIS
- registrar
- PDR Ltd. d/b/a PublicDomainRegistry.com
- description
- Command and Control domains for Win32.Lumma. These domains are extracted from a number of sources, and are suspicious.
- domain rank
- -1
- raw
- Admin City: Moscow Admin Country: RU Admin Email: [email protected] Admin Organization: Alex Kurskov Admin Postal Code: 108063 Admin State/Province: Moscow Creation Date: 2023-12-10T13:02:07.0Z Creation Date: 2023-12-10T13:02:07Z DNSSEC: Unsigned DNSSEC: unsigned Domain Name: DIAGRAMFIREMONKEYOWWA.FUN Domain Status: REDEMPTIONPERIOD https://icann.org/epp#redemptionPeriod Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: pendingDelete https://icann.org/epp#pendingDelete Domain Status: redemptionPeriod https://icann.org/epp#redemptionPeriod Domain Status: serverHold https://icann.org/epp#serverHold Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited Name Server: DNS11.PARKPAGE.FOUNDATIONAPI.COM Name Server: DNS12.PARKPAGE.FOUNDATIONAPI.COM Registrant City: 04154ce0aa2604d4 Registrant Country: RU Registrant Email: [email protected] Registrant Email: f651612a2f356ad3s@ Registrant Fax Ext: 3432650ec337c945 Registrant Fax: 3432650ec337c945 Registrant Name: 71968451df961f21 Registrant Organization: 71968451df961f21 Registrant Phone Ext: 3432650ec337c945 Registrant Phone: 003229ed074dc6cf Registrant Postal Code: 44c8a9846392fca4 Registrant State/Province: 04154ce0aa2604d4 Registrant Street: 089f8781111e1aa8 Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +1.2013775952 Registrar IANA ID: 303 Registrar Registration Expiration Date: 2024-12-10T23:59:59Z Registrar URL: https://publicdomainregistry.com Registrar URL: www.publicdomainregistry.com Registrar WHOIS Server: whois.PublicDomainRegistry.com Registrar WHOIS Server: whois.publicdomainregistry.com Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Registry Admin ID: Not Available From Registry Registry Domain ID: D416635944-CNIC Registry Domain ID: Not Available From Registry Registry Expiry Date: 2024-12-10T23:59:59.0Z Registry Registrant ID: Not Available From Registry Registry Tech ID: Not Available From Registry Tech City: Moscow Tech Country: RU Tech Email: [email protected] Tech Organization: Alex Kurskov Tech Postal Code: 108063 Tech State/Province: Moscow Updated Date: 2025-01-16T01:28:22.0Z Updated Date: 2025-01-16T01:28:23Z
- references
- https://unit42.paloaltonetworks.com/accelerating-malware-analysis/, https://www.virustotal.com/graph/g5ef5c7968912451381b5c5b910a19b36108111b6831c4e72aae475c8b49545d9
- subdomains count
- 0
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 2 years ago · Last seen 2 months ago
Appeared in 13 threat reports