DomainMediumSignal 29/100
kpahvip.com
Location
NetherlandsFirst Seen
Jul 8, 2025
Last Seen
Sep 22, 2025
Found in 4 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
28%
Signal Score
29 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Feed Intelligence Summary
4 reports28% confidence
4
Source reports
28%
Confidence score
Category tags
aaaaabuseacceptaccount securityaddressaddress domainaddress googleadvanced persistent threatakamaialertsanalysis dateapache xappleaptapt groupascii textasiaassociated urlsatomaustraliaautorunav detectionsavast avgbingbodybody doctypebotnetch uacivilcivil servicescivilian targetingck idck matrixclick-based attackcnletcode executioncode injectioncommandcommand and controlcommand executioncommunication protocolcommunication technologiescompromised routercontent typecopy md5copy sha1copy sha256creation datecredential harvestingcrlf linedata accessdata copyingdata exfiltrationdata transferdata uploadddos attacksdefense evasiondefense-evasiondeletedelphidetailed errordetections namedevelopment attdistributed attacksdnsdnssecdocument filedomains showdropperdynamicdynamicloadere safeelectronic health recordselton avundanoencryptenterprise securityentrieserrorerror juleu alexeyeu cyber policieseuropeexploitfileless malwarefilesfiles domainfiles ipfiles locationfiles relatedfiles showfirmware infectionfirmware modificationflagflag unitedfoundfrance asngeckogenericgoogle safegovernment technologyheader http2health care and social assistancehealth information technologyhealthcare information systemshighhospital managementhostilehostinghostname addhostname enumerationhostname queryhttp scannerhybridicmp trafficids detectionsii llcindicatorinformation gatheringinformation technologyinfrastructure acquisitionreconnaissanceingress tool transferinput validation bypassintelinternet of thingsiosios malwareiot botnetiot/ics attackit infrastructureitre attkeyskhtmllazarus grouplearnless whoislinklinuxlinux malwarelocallookmacmalicious linksmalicious softwaremalwaremass surveillancemediamedical servicesmediummetadata analysismirai botnetmitre attmobilemobile carriersmobile malwaremobile networksmobile secmobile securitymodel secmovednamename servername serversname tacticsnetherlandsnetworknetwork scanningnetwork trafficnextnext associatednext passivenext relatednext yaranreumobjectoceaniaogoogle trustok transferoletopenurl coperating systemoperating system securityoutbound m3overview ippacking t1045passive dnspatch managementpath traversalpatient carepattern matchpdfpe filepegasuspegasus projectperfect privacyphishingphishing attackpoliceportprecreate readpresentpresent aprpresent augpresent decpresent febpresent janpresent julpresent marpresent novpresent octpresent sepprocess injectionpublic administrationpublic infrastructurepublic policypulse pulsespulse submitpulses nonepushransomransom:win32/cvereadread creconnaissancerecord valuerefreshregional securityregistry modificationregistry runregulatory agenciesrelated nidsrelated tagsremote servicesresearchedresponse iprestartresults janresults julreverse dnsreviewsafe browsingscript urlssearchserver responseserviceshowshow processshow techniqueshowingsizesmssms exploitsocial engineeringsocial media securitysoftware developmentsoftware exploitationsoftware vulnerabilitiesspanspawnsssl castatestate-promovedstate-sponsoredstatusstringssuspt1003t1003.001t1003.004t1004t1005t1012t1016t1018t1020t1021t1021.001t1021.006t1023t1027t1030t1031t1036t1037t1037.003t1040t1041t1045t1053t1055t1056t1057t1059t1060t1062t1064t1068t1069.001t1070t1071t1071.001t1071.004t1076t1078t1082t1083t1084t1087t1091t1105t1110t1112t1113t1119t1129t1130t1133t1156t1185t1187t1189t1190t1192t1193t1199t1203t1204t1204.001t1204.002t1205t1210t1211t1212t1480t1480 executiont1485t1486t1490t1491t1495t1496t1497t1499.002t1499.003t1505t1529t1530t1539t1543t1546t1552t1553t1553.003t1555t1556t1557t1562t1564t1565t1566t1566.001t1566.002t1566.003t1566.004t1567t1568t1569t1571t1573t1574t1578t1580t1583t1584t1585t1586t1587t1587.001t1587.003t1588t1589t1589.001t1590t1590.001t1591t1592t1593t1594t1595t1596t1596.001t1596.004t1597t1598t1599t1600t1601t1602t1602.001t1602.002t1606t1608t1609t1610t1611t1612t1613t1614t1615t1619t1620t1621t1622t1647t1648t1649t1650t1651t1652t1653t1654t1656t1657t1659t1665t1666targeted spyware campaigntargeted-attackstelecom servicestelecommunicationstexastitle objecttlsv1toolstor analysistrojan malwaretrojandroppertrojanspytype datatypeofua archua bitnessua fullua platformunitedunknown nsunknown soaurlsurls showuser executionusersutf8 textverdictverifyversion secvietnamvirtoolweb application exploitationweb trafficwin32 malwarewindirwindows malwarewindows ntwine emulatorwritex poweredxhr loadxhr startyara detectionszero click exploitzero-day exploit
Activity Timeline
Sep 22Sep 22
Threat Activity Heatmap
· Peak: 2025-09-22LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Intelligence SummaryAI Generated
The domain **kpahvip.com** has emerged as a significant indicator of compromise (IOC) linked to multiple cyber threats, including botnets, exploits, malware, and phishing campaigns. First observed on July
Threat ScoreLow Risk
29
SIGNAL
Signal Score
28%
Confidence
4
Reports
First seenJul 8, 2025
Last seenSep 22, 2025
VirusTotal
Not checked
WHOIS
- description
- Operation Endgame: Mass, permanent surveillance targeting civilians without warrants. Advanced tools infect devices via malicious links (WhatsApp/SMS/email) or PDFs with zero-day exploits. Clicking executes malware: Pegasus (Android/iOS) or **Mirai** (Linux/Windows), enrolling devices into a botnet. Infections are persistent, often replacing device/router firmware, requiring hardware changes. Malicious traffic hides via Google/Cloudflare DNS. Thousands of companies collaborate (Amazon, Google, Microsoft, Facebook, WhatsApp, Apple, etc.), providing servers, domains, and websites to mask attacks. This enables agencies to infect targets even when accessing legitimate services (e.g., logging into Amazon) if the browser is vulnerable. Attacks are targeted, evading firewalls, and expose private data, risking targets' physical safety. The operation involves multiple allied states.
- domain rank
- -1
- raw
- Administrative city: HCM Administrative country: Vietnam Create date: 2025-02-21 00:00:00 Domain name: kpahvip.com Domain registrar id: 1649 Domain registrar url: http://www.pavietnam.vn Expiry date: 2026-02-21 00:00:00 Name server 1: ns2.host69.vietnix.vn Name server 2: ns1.host69.vietnix.vn Query time: 2025-02-22 11:42:49 Registrant city: e8c8e13068144f14 Registrant company: 9236497c5216c6cc Registrant country: Vietnam Registrant email: b53809c5e370dbb6s@ Registrant name: edeae57e15fec50a Registrant phone: 0241535a93694082 Registrant zip: bf3fe9629b4f7946 Technical city: HCM Technical country: Vietnam Update date: 2025-02-22 00:00:00
- subdomains count
- 0
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 11 months ago · Last seen 8 months ago
Appeared in 4 threat reports