IOC Radar
DomainHighVerifiedSignal 26/100

idwhosting.site

Location
PeruPeru
First Seen
Jul 8, 2025
Last Seen
Apr 2, 2026
Jul 8
First Seen
342d ago
Apr 2
Last Seen
74d ago
5
Reports
source reports
26%
Confidence
high
6/91
VirusTotal
detections
Found in 5 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
26%
Signal Score
26 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

138 techniques

Feed Intelligence Summary

5 reports26% confidence
5
Source reports
26%
Confidence score
Category tags
abuseadvanced persistent threatappleaptapt groupbad reputationbingbotnetbotnet activitybrute forcecivilcivil servicescivilian targetingcommand and controlcommunication technologiescompromised routercredential harvestingcredential stuffingdata exfiltrationdata store exposureddosddos attacksdefense evasiondefense-evasiondistributed attacksdnsdns attackelectronic health recordsenterprise securityexecutable fileexploitexploitation activityfirmware infectionfirmware modificationgovernment technologyhealth care and social assistancehealth information technologyhealthcare information systemshospital managementidentity & access exploitationindicatorinjection activityinternet of thingsiosios malwareiot botnetiot securityiot/ics attacklazarus grouplinklinuxlinux malwaremacmalicious softwaremalwaremass surveillancemedical servicesmirai botnetmobilemobile carriersmobile malwaremobile networksmobile securitymobile threatnation-state activitynetworkoperating systempatch managementpatient carepdfpegasuspegasus projectperuphishingphishing attackpoliceprocess injectionpublic administrationpublic infrastructurepublic policyregulatory agenciesresearchedsmssms exploitsocial engineeringsoftware vulnerabilitiessouth americastatestate-promovedstate-sponsoredt1003t1003.001t1003.004t1004t1005t1016t1018t1020t1021.001t1021.006t1027t1036t1037t1037.003t1041t1053t1055t1056t1059t1062t1064t1068t1069.001t1070t1071t1071.001t1071.004t1076t1078t1082t1084t1087t1110t1113t1130t1133t1156t1185t1187t1189t1190t1192t1193t1199t1204t1204.002t1205t1210t1211t1212t1485t1486t1490t1491t1495t1496t1497t1499.002t1499.003t1505t1529t1530t1539t1543t1546t1552t1553t1553.003t1555t1556t1557t1562t1564t1565t1566t1566.001t1566.002t1566.003t1566.004t1567t1568t1569t1571t1573t1574t1578t1580t1583t1584t1585t1586t1587t1587.003t1588t1589t1590t1591t1592t1593t1594t1595t1596t1596.001t1596.004t1597t1598t1599t1600t1601t1602t1602.001t1602.002t1606t1608t1609t1610t1611t1612t1613t1614t1615t1619t1620t1621t1622t1647t1648t1649t1650t1651t1652t1653t1654t1656t1657t1659t1665t1666targeted spyware campaigntargeted-attackstelecom servicestelecommunicationsthreat actortor nodevulnerability scanwindows malwarezero click exploitzero-day exploit

Activity Timeline

1 total obs
Apr 2Apr 2

Threat Activity Heatmap

· Peak: 2026-04-02
Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Intelligence SummaryAI Generated

The domain **idwhosting.site**, originating from Peru, has been identified as a significant indicator of compromise (IOC) associated with advanced persistent threat (APT) activities. First observed on July

Threat ScoreLow Risk
26
SIGNAL
Signal Score
26%
Confidence
5
Reports
First seenJul 8, 2025
Last seenApr 2, 2026
Verified IOC

VirusTotal

6/ 91vendors flagged
7% detection rateJun 8, 2026

WHOIS

description
Operation Endgame: Mass, permanent surveillance targeting civilians without warrants. Advanced tools infect devices via malicious links (WhatsApp/SMS/email) or PDFs with zero-day exploits. Clicking executes malware: Pegasus (Android/iOS) or **Mirai** (Linux/Windows), enrolling devices into a botnet. Infections are persistent, often replacing device/router firmware, requiring hardware changes. Malicious traffic hides via Google/Cloudflare DNS. Thousands of companies collaborate (Amazon, Google, Microsoft, Facebook, WhatsApp, Apple, etc.), providing servers, domains, and websites to mask attacks. This enables agencies to infect targets even when accessing legitimate services (e.g., logging into Amazon) if the browser is vulnerable. Attacks are targeted, evading firewalls, and expose private data, risking targets' physical safety. The operation involves multiple allied states.
domain rank
-1
raw
Create date: 2025-03-13 00:00:00 Domain name: idwhosting.site Domain registrar id: 1068 Domain registrar url: https://namecheap.com Expiry date: 2026-03-13 00:00:00 Name server 1: ns1.idwhosting.biz Name server 2: ns2.idwhosting.biz Query time: 2025-03-14 12:39:07 Registrant company: 4b7a0912c26a13e2 Registrant country: Iceland Registrant email: 29e2c061f3c9524es@ Registrant state: 3e0204199d8ebf9c Update date: 2025-03-13 00:00:00
subdomains count
19

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 11 months ago · Last seen 2 months ago
Appeared in 5 threat reports