IOC Radar
DomainMediumSignal 14/100

inbound.mail.znet.net

Location
NetherlandsNetherlands
First Seen
Apr 20, 2025
Last Seen
Apr 26, 2025
Apr 20
First Seen
433d ago
Apr 26
Last Seen
427d ago
2
Reports
source reports
14%
Confidence
medium
Found in 2 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
14%
Signal Score
14 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

47 techniques

Feed Intelligence Summary

2 reports14% confidence
2
Source reports
14%
Confidence score
Category tags
academic institutionsactive scanningarubabotnetbrrnyaw8 peexebrute forcecanadacertificate analysiscode injectioncommand and controlcondrv textcredential accessdata exfiltrationdistributed attackseducationeducational resourceseducational serviceseducational technologyelectronic health recordsentitygegkn peexehd0 bluescsihd1 bluescsihealth care and social assistancehealth information technologyhealthcare information systemshero designerhigher educationhistorical sslhospital managementindicatorinformation technologyit infrastructurek-12 educationlettermalicious network activitymalicious softwaremalwaremedical servicesnetherlandsnetworknetwork scanningno meaningfulnorth americapanamapatient carepleaseprocess injectionreconnaissanceresearchedsoftware developmentsslt1005t1016t1018t1027t1036t1047t1048t1053t1055t1057t1059t1059.007t1068t1071t1071.001t1078t1082t1083t1105t1190t1204t1204.001t1486t1496t1499.002t1499.003t1547t1565t1566t1567t1574t1583t1584t1586t1587t1588t1589t1590t1591t1592t1593t1594t1595t1595.001t1595.002t1595.003t1598united statesweb exploitation

Activity Timeline

1 total obs
Apr 26Apr 26

Threat Activity Heatmap

Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Intelligence SummaryAI Generated

The domain **inbound.mail.znet.net**, originating from the Netherlands, has been identified as an active indicator of compromise (IOC) associated with botnet and malware activities. First observed on April

Threat ScoreLow Risk
14
SIGNAL
Signal Score
14%
Confidence
2
Reports
First seenApr 20, 2025
Last seenApr 26, 2025

VirusTotal

Not checked

WHOIS

description
Quick look at XUSOM

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 1 year ago
Appeared in 2 threat reports