IOC Radar
DomainHighVerifiedSignal 100/100

ocadomail.com

Location
Korea, Republic ofKorea, Republic of
First Seen
Jan 2, 2024
Last Seen
Jun 7, 2026
Jan 2
First Seen
890d ago
Jun 7
Last Seen
3d ago
6
Reports
source reports
99%
Confidence
high
1/91
VirusTotal
detections
Found in 6 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

146 techniques

Feed Intelligence Summary

6 reports99% confidence
6
Source reports
99%
Confidence score
Category tags
#potentialus-origin_falseflag_obfuscation.pla indicatoraaaaaaaa nxdomainabuseabused infrastructureabuseipdbacademic institutionsacceptaccept chaccept encodingaccept expiryaccessaccess controlaccess ta0001access ta0006account compromiseaccount discoveryaccount profilingaccount securityaccount takeoveracintactive relatedactive scanactive scanningactive threatactive threatsactivity beaconactivity miraiad tevdagadaptivebeeadded activeaddressaddress domainaddress googleadjfprem ordadloadadobeaadult mobileadvanced emailadvertising botnetadwareadware affiliateadware malwareadwindaerospace & defenseaf81 httpafricaag albertoag ingoagentagent teslaai cloudail tvnasain addair forceakamaiakamai rankalertsalexaalexa topalexis fawxalienvault_ransomwareall octoseekall pagesall quietall scoreblueall searchallmul vbaget4altsvc h3amadeyamazonamazon rsaamazon sesamericaamerica asnamerica cityamerica flaganalysis dateanalyzeanalyzer pasteanalyzer threatandarielandroidannuletanomalous fileapacheapeaksoft iosapi abuseappdataappleapple app capableapple iosapple mobileapple phoneapple privateapple webapplication developmentare you hiringarial helveticaarizonaarkeistealerartemisartroarvadaas35994 akamaiascii textasiaasnoneasnone denmarkasnone dnsasnone germanyasnone relatedasnone unitedassembly commonassembly nameasyncratattackattack badattorney brian sabeyauroraaustraliaaustralia asnaustriaauthentication bypassauthentication flawauthentihashauthor avatarauthorityautoitav detectionsavailable fromavast avgave suiteavg clamavavg win32awfulazorult cncb functionb serverb3viles0 febbackbackdoorbad loginbad reputationbad requestbankbankerbankingbanloadbasebauer namebehavbelgiumbenjamin cberbewbillbing adsbiosbitcoinbitcoinaltcoinbitsbittorrent dhtblackblacklist httpblacklist httpsblacknet ratblisterbloat-ablockchainblogbodybody doctypebody headbody htmlbody lengthbonusbitcoinborland delphibotbot networksbotnetbotnet activitybouvet islandbrain sabeybrandi lovebrandi lovesbrazilbrazil unknownbreaking newsbrianbrian sabeybrontokbrowse scanbrowser hijackingbrute forcebrute force attackbublikbundledbusyboxbusybox busyboxbuttonsc&cc2c2 channelc2:prioritywirreles.comca idca validitycachecallback phishingcanadacanada unknowncancel anytimecancercapacapecapturecarter cruisecatalog treeccbasecentos webcgb stgreatercharter communicationscheckchecked urlcheckercheckinchecks amountchi2chilechinachina domainchina flagchina telecomchina unknownchromecidrcins activecisco umbrellacitycity redmondcivilcivil societyck idck idsck matrixclasscleanerclickclick-based attackclickable urlsclosecloud computingcloud infrastructurecloud migrationcloud securitycloud servicescloud storageclr versioncms brute forcecms: expresscnamecnapple istcnapple publiccnccnc beaconcnsectigo rsacnusco sheriffcobalt strikecobaltstrikecodecode executioncode injectioncode signingcom laudecommandcommand & controlcommand and controlcommand decodecommand executioncommand typecommodity contracts intermediationcommunication protocolcommunication securitycommunication technologiescommunity managementcompany limitedcompanyname gmcompromised websitecomspecconduitconfigconhostconnected devicescontactcontacted urlscontentcontent lengthcontent sharingcontent typecontinent nacontrolcontrol panelcontrol ta0011cookiecopycopy md5copy sha1copy sha256copyright ccorecorporate espionagecorporate lawcount blacklistcountrycountry unitedcountry uscp buscp cybercrazy dollcreation datecredential accesscredential brutingcredential harvestingcredential stealingcredential stuffingcredential theftcredit card servicescrimecrlf linecrypcryptcryptbotcryptocrypto exchangecrypto miningcrypto walletcryptocurrencycryptocurrency threatscryptographycryptojackingcsc corporatecur conocus cndigicertcus cngtscus cnr3cus ouservercus stcoloradocve typecybercyber crimecyber criminalcyber defensecyber espionagecyber folkscyber harassmentcyber stalkingcyber threatcyber threatscyber warfarecyberfolkscycbotczechczechia unknowndaddydagadanabotdangerdapatodarknet servicedatadata accessdata breachdata collectiondata copyingdata encryptiondata exfiltrationdata miningdata misusedata redacteddata rtversiondata store exposuredata transferdata uploaddays agoddosddos attacksdebugdecentralized financedecodedecoy systemdefensedefense contractingdefense evasiondefense logisticsdefense systemsdefense technologydelawaredeletedelete cdelete filedelete shadowsdelphidelphi genericdemonbotdenied trackersdenverdenver coloradodetailsdetails moduledetected m1detection listdetections elfdetections typedeuteronomy 28:7development attdevelopment methodologiesdevice managementdevopsdgadigicert incdigital certificatedigital currencydigital mediadigital platformsdigital signaturedirectordiscovery attdiscovery e1082discovery t1082displaynamedistributed attacksdistribution managementdiv divdiv iddiv sectiondk summarydlldll readdnsdns attackdnspionagednssecdockdocument filedom namedomaindomainsdomains domaindomains domainsdomains filesdomains iidomains showdonedos borlanddos executabledoscom cdot netdotnet_encrypteddouble clickdouglas countydownldrdownloaderdowntown denverdr citydraiedroppeddropped cdropperdrwebduo insightdviddynadot incdynamicdynamic function loadingdynamic loadingdynamic_function_loadingdynamicloadere weowe64ee-signature securitye1203 datae1564 hiddene5.spikeaex.dynhasheanioaeeasteasyredir cacheec oidecaccecacc sed5906echo requesteducational resourceseducational serviceseducational technologyee edcje4jekyxeelderlyelectronic health recordselementelevated exposureelfelf infoelf malwareelf32elf64 cryptoemailemailsemails infoemails metaemotetemotet typeencpkencryptencryptionendgameendpoints allengineeringenigmaprotectorenjoyenomenter soudcetdienterprise securityentertainment technologyentityentriesentries foundentries httpentries relatedentropy chi2entry pointenumerateeofaeepocheraseerrorerror allerror fes formet cinset exploitet infoet p2pet toret trojanetproetpro malwareetpro tretpro trojanetpro trojan win32/tofsee.axeu cyber policieseuropeeurope/asiaeva120evaderevasion ob0006evasion ta0005example domainexcelexcludeexclude suggesexeexe sizeexe uploadexe32executable fileexecutable uploadexfiltrationexif dataexif standardexitexpirationexpiration dateexpires thuexplexploitexploit noneexploitationexploitation activityexpressexpress frameworkexternal-resourcesextortionextr dataextraction dataextri dataextri includef2f2f2 colorfailedfailurefakedout threatfalsefalse informationfareitfastfastly errorfe fffederation asnfilefilehash-sha256filerepmalwarefilesfiles cfiles deletedfiles domainfiles filesfiles hostnamefiles ipfiles locationfiles matchingfiles relatedfilesadobe cfin ivdofinal urlfinancefinancial crimesfinancial servicesfinancial technologyfindfind peoplefind sfirstfixed lineflagflag unitedfloxiffolderfont formatfooterfor privacyformformatformatpng febformbook cncfoundfound httpsfound pefoundryframingfrancefraud servicesfreefreight forwardingfri novfunction readfusioncoreg1 validitygafgytgamersgamesgandcrab dnsgeckogeneral fullgeneratorgenericgeneric flagsgeneric httpgeneric windosgermanyget dnsget httpgetdc copyimagegeturlghost ratgirlsgithubgithub pagesgnulinux aptgobrutgoldmaxgooglegoogle llcgoogle safegoogle taggothamgpt analyzergraphgreat britaingroupgrumguardguatemalaguidguloadergvb gelimedgvt mitmhack typehackerhackershackers for hirehall renderhappywifehappylifehashhasheshashes capehashes hasheshat serverhauthawkeyeheader intelheader targetheadersheaders dateheaders nelhealth care and social assistancehealth information technologyhealth phonehealth typehealthcare information systemshellhelloworldhelvetica neueheodoheurhichinahide artifactshighhigh defensehigh levelhigher educationhistoricalhistorical otxhistorical sslhitmenholidaycheck aghomehome networkhome pghondurashospital managementhosthostinghostnamehostname addhostname enumerationhostname serverhr rtdhstrhtmlhtml documenthtml infohtml publichtml_smugglinghttphttp attackhttp attackerhttp gethttp headershttp hosthttp methodhttp requesthttp requestshttp responsehttp scannerhttp spammerhttpshttps httphuawei hg532huawei remotehungaryhunkhx88x89hybridianaiana reficloudicmp trafficico rtgroupiconid loggedided iocsidentity & access exploitationidentity searchidentity theftidlogin sepidnischdr httpids detectionsieedge chrome1ietfdtd htmliframeiframesilike searchimagenimmobilien agimpact ob0008impact ta0040inboundinc orgidinc usageinclude reviewincludec reviewindicatorindicators showindonesiaindustrial iotinfoinfo compilerinfo headerinfo performsinfo titleinformation gatheringinformation ispinformation stealerinformation technologyinfostealerinfrastructure acquisitionreconnaissanceingestion timeingress tool transferiniciar sesininjection activityinjection rwxinjection_rwxinno setupinputinput validation bypassinstallintelintellectual property lawintellectual property theftinternal nameinternet of thingsinvalid pointerinvalid urlinvalid variantinventory managementiobitiociocsionos seiosiot analyticsiot applicationsiot botnetiot platformsiot securityiot/ics attackipv4ipv4 addipv6irelandireland unknownisp charterisp hostnameisrael unknownissuer criteriaissuing caist cait infrastructureitalyitaly unknownitemjapanjapan as17676japan unknownjavascript cjeffrey reimerjeffrey reimer ptjeffrey scottjfifjpegjpeg imagejsonjujuboxjul jank-12 educationkeeperkelihoskenyakenzie reeveskey algorithmkey identifierkey infokey valuekeybasekeygenkeyloggerkgs0khtmlkianakiana arellanokls0known torkrakenkratonakraupakrunchymalpackerkurt waltherlabs pulseslanc typelance muellerlarimer stlaw practicelearnlearn morelegal consultinglegal researchlegal serviceslegal technologylengthlenovo tabletlenovo typeless seeless whoislevel 3li ullicesslimitedline isplinklink librarylinkerlinuxlinux x8664livelylnmplnmp aloaderlocallockbitlocuologinlogin yaralogin0logistics technologylooklookuplos angeleslovelowfiltd dbalucky guym1macmachine intelmagecartmagic pdfmagic pe32mail spammermainmaldocmalicious activitymalicious downloadmalicious file transfersmalicious linksmalicious powershell activitymalicious redirectmalicious sitemalicious softwaremalicious urlmalvertizingmalwaremalware beaconmalware cvemalware distributionmalware fightermalware httpmalware packermalware signingmalware sitemalware spreading evadermalware trafficmalware uploadmalware wormmalware_win_zgratmark brian sabeymarkmonitormarkusmatch infomaudio firewiremaudio fwmaui ransomwarembsmcig sepmediamedia & entertainmentmedia centermedia distributionmedical servicesmediummemory patternmeowmesh digitalmessagemetameta httpmeta namemetadata analysismetadata headermethod statusmetrometro t-mobilemetrobymexicomexico unknownmicrosoft waymilitary operationsmillionmindminermineral processingminiigd upnpminingmining equipmentmining operationsmining sustainabilitymining technologymiori hackersmiraimirai botnetmirai typemirai variantmisc attackmitmmitre attmitre att&ckmobilemobile carriersmobile devicemobile exploitmobile networksmobile securitymobile threatmodelmodify systemmodulemodule loadmodules t1129moldova relatedmoldova unknownmon sepmoniker onlinemonitored targetmonitored tsaramonitoringmonths agomoroccomorphexmost viewedmovedmozillams visualms windowsms wordmsdefender aprmsf stylemsiemsilmtb descriptionmuellermulti-cloud managementmultimedia productionmustang pandamutexesmyappmysql brute forcenamename andrewname domainname md5name serversname tacticsname valuename verdictnamesnanjingnanocore ratnation-state activitynational securityneshtaneshta virusnetherlandsnetherlands asnnetname uchnettype directnetworknetwork communicationnetwork compromisenetwork icmpnetwork probingnetwork scanningnetwork trafficnetwork_cnc_httpnetwork_cnc_https_genericnetwormneutralnextnext associatednext httpnext relatednextc typengnidsnigerianiniteninite aprninite febninite marnircmdnitronjratno datano entriesno expirationno redirectnode tcpnode trafficnoname057nondnsnone relatednordvpnsetupnorth americanospltezraxufnovno jannsonso groupnumbernumbersnymaimob0005 defenseobjectobject movedobz4usfn0 httpoc0006 httpoccamyoceaniaocomodo caodigicert incofficeogoogle trustoletonloadopenopen portsopen threatoperating systemoperating system securityorbiting tsara brashearsorg microsoftorgabusephoneorgidoriginal nameorionorion logoorion wios versionos2 executableostname addotx octoseekotx scoreblueotx telemetryouserver caoutbound trafficoverlayoverview domainoverview ipoxfordpapackerpackingpacking t1045palantir foundrypandapanel forumparagonparent domainparent net168parisparking crewpassive dnspasswordpassword attackspastepatch managementpatcherpathpath traversalpatient carepattern domainspattern ipspattern matchpayload deliverypayload hellopayment processingpcappdb pathpdf documentpdf executionpdf reportpe resourcepe sectionpe32 compilerpe32 executablepe32 installerpe32 protectorpedrazpegasuspegasus attackspeoplepepo campaignspersonal dataperuphishingphishing attackphishing bankphishing campaignphishing sitephy samopixelrzplatform interferenceplayplaygamepleaseplesk forumplugxpng imagepointpolandpoland unknownponypoor reputationpornporn relatedporn typeporn videospornhubpornography distributionportpostpost httppost httpspost utcorepowershellpragmapredatorpremiumpresent aprpresent augpresent decpresent janpresent julpresent junpresent marpresent sepprivacy adminprivacy incprivacy policyprivacy techprivilege httpsprobeprobe ms17010processprocess injectionprocess t1543process32nextwprocesses treeproductproduct developmentproducts idprojectproject piproofproperty valueprotectprotocol h2protocol-devipsexecpublic keypulse httppulse pulsespulse submitpulsespulses emailpulses nonepulses otxpulses urlpuma sepurpose p5pushpushdopythonqaejhqbotqbot qakbotqbot typeqmountquackbotquality assurancequantum fiberquasarquasar ratqueryqwestrank positionransomransomexxransomwarereadread creads selfreads softwarereads_selfreagan foxxrealtek sdkreconreconnaissancerecord keepingrecord typerecord valuerecording industryrecycle binred teamredacted forredlineredline stealerredlinestealerreferenrefloadapihashrefreshregional securityregistry arinregistry keysregulatory compliancereimer dptrelatedrelated nidsrelated pulsesrelated tagsrelicremcos trojanremoteremote accessremote code executionremote servicesreport spamreputation attacksreputation damagereputation ipreputation manipulationrequestrequest idresearchedresolved ipsresolverrorresource extractionresource hashresource hijackingresources cyberresponse iprestartresults aprresults julreverse dnsreviewrgbarims httpsrisk assessmentrms modulerobots contentrockrole titleromania unknownrootkitroundrounduprpcsrsa sha256rsa tlsrticon englishrticon neutralrticon russianrun keysrunnerruntime processrussiarussia unknownrussian federationrva entryryan keelysa victimsabeysafe browsingsafe sitesahilsaint louissakulasalitysamplessamsungsandboxscams & fraudscan endpointsscans showsceneschemescoreblue team 8scriptscript domainsscript scriptscript urlsscripting attackssddlse extrase extrisea psea xsearc typesearchsearch otxsecrisksecuresecure serversecurity operationssecurity policysecurity risksecurity scansecurity tlsseenselect acrossselfserce internetuserverserver caserver errorserver headerserver responseserver rsaserver tsaserver tsa bserversserviceserving ipset cookiesettings cshared csharedink csharedinkarsa csharedinkbgbg csharedinkcscz csharedinkdadk cshawshellshell codeshell commandsshellexecuteexwshinjiru mscshipping servicesshowshow processshow techniqueshowingsiblings domainsibotsid namesidesiem compliancesign upsignals mutexessigning casigning defensesim unlocksingaporesinkhole cookiesitesizeskipskynetslcc2slovakiasmart devicessmbds ipcsmear campaignsmoke loadersnatchsneaky serversoa nxdomainsoap commandsocial analyticssocial engineeringsocial mediasocial media abusesocial media marketingsocial media securitysocial networkingsoftware architecturesoftware developmentsoftware engineeringsoftware exploitationsoftware integritysoftware testingsoftware vulnerabilitiessonysourcesouth americasouth koreaspainspamspammerspanspan h2span spanspawnsspoofedsportsspotify artistsptoxspyrixkeyloggerspytox ogspywaressdeepssh attackssl certssl certificatestackstalking tacticsstarfieldstartupstatic pe anomalystatic_pe_anomalystatusstatus actionsstatus codestealerstopstop xstoragestorystrangestreamstreaming servicesstreams sizestrikesstringsstrongstrong namestudiostudiosstudios metastudios ogstusstylestyle1subjectsubject keysubject publicsuggessuggest datasuitesummarysummary iocssummersupply chain attacksupply chain managementsuricata alertsuricata ipv4suricata udpv4surveillance campaignsuspsvg scalablesweepswipperswitchswitch dnsswrortsymantec timesystemsystem compromisesystem disruptiont servicest whoist1001t1003t1003.008t1005t1012t1016t1020t1021t1021.001t1023t1027t1029t1030t1031t1036t1036.004t1036.005t1040t1041t1045t1047t1053t1055t1056t1056.001t1057t1059t1059 veryt1059.001t1059.003t1059.004t1059.007t1060t1064t1068t1069.001t1070t1071t1071.001t1071.002t1071.003t1071.004t1078t1078.004t1080t1082t1083t1083 readst1086t1087t1088t1089t1095t1096t1098t1102.002t1105t1106t1110t1110.001t1110.002t1110.003t1110.004t1112t1113t1114t1119t1120t1122t1129t1133t1140t1143t1147t1183t1189t1189 foundt1190t1192t1195t1199t1202t1203t1204t1204.001t1204.002t1210t1212t1218t1480t1480 executiont1483t1485t1486t1489t1490t1496t1497t1499.001t1499.002t1499.003t1528t1534t1535t1539t1547t1553t1553.002t1553.006t1554.001t1554.003t1555t1560t1562t1564t1565t1566t1566.001t1566.002t1566.003t1566.004t1567t1568t1568.002t1569.002t1570t1573t1573.001t1583t1583.001t1583.005t1584t1587.001t1588t1588.004t1589t1589.001t1590t1590.001t1592t1595t1595.001t1595.002t1595.003t1598t1598.003t1598.004t1602t1608t1608.001ta0002 commandta0003 createta569tabx explorertag counttag managertagstags nonetags ogtags viewporttaiwantaiwan as3462targettargeted attacktargets sataskjobtcp includetcp syn scanteamteam alexateamstech emailtechnology onetelecom servicestelecommunicationstelpertempteslatexttext ctext/htmlthailandthe bazarthird-party-cookiesthreatthreat actorthreat actor groupthreat intelligencethreat networkthreat preventionthreat reportthreat roundthreat roundupthreats ettiff imagetiggretime stampingtimestamp inputtimo salzsiedertinbatitletitle accesstitle addedtitle denvertitle errortitle metatitle spytoxtitle styletld counttlstls handshaketls rsatlsv1tlsv1 aprtmitmobiletmobile metrotofseetoolstop destinationtop ratedtop sourcetor knowntor nodetor relayroutertotaltptjswtraffictransportation managementtreatstrending videostrextrid adobetrid windowstridenttrojantrojan downloadertrojan droppertrojan featurestrojan malwaretrojanclickertrojandroppertrojanspytrue defensetsa btsaratsara brashearsttl valuetulachtulach typetwittertypetype fixedtype gettype indicatortype nametype win32typeid1typelib idtypeoftypestypes oftyposquattingu0019ubuntuuchaunauthorizedunicode textuninstall iobitunionunion blvdunisunitedunited kingdomunited statesunknown nsunruyunsafeuny inuuueupdate dateupdated dateurlsurls httpurls httpsurls showurls urlursnifusage typeuse collectionuseruser engagementuser executionusersuswvutc entryutc googleutc redirectionutc submissionsutf8 textv2 documentv3 serialvalidvalid usagevaluevalue emailsvalue snkzvanvariantvaryverdictverdict vpnverifyversion idvhashvideosvietnamviewsviprevirgin islandsvirtoolvirusvirutvitrovoidvpnvt graphvtapivulnerability scanw32.bloat-awacatacwarehouse operationswatchwealth managementweatherweb applicationweb application attackweb application exploitationweb exploitationweb openweb securityweb trafficweinedoewse netwhitewhitelisted ipwhitelisting bypasswhoiswhois domainwhois lookupwhois lookupswhois recordwhois showwhois sslwhois sslcertwhois whoiswild westwin16 newin32 dllwin32 dynamicwin32 exewin32 malwarewin32 typewin32/obfuscator.adbwin32/upatrewin32/vflooderwin32berbew julwin32mydoom febwin32mydoom janwin32spigot aprwin32upatre febwindirwindowswindows activexwindows checkwindows createwindows malwarewindows ntwindows servicewininet c0005wixworldwormwritewrite cwrite filewritten cwsasendx cachex contentx framex00bx00x00x00x509v3 keyx509v3 subjectx86 baddrx92xacxamzexpires300xe exml titlexor obfuscationxportxslayerxtratyahoo titleyandexyara detectionyara detectionsyara ruleyexe yeyomi hunterzbotzenboxzeuszpevdozunezusy

Activity Timeline

1 total obs
Jun 7Jun 7

Threat Activity Heatmap

· Peak: 2026-06-07
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Intelligence SummaryAI Generated

The domain **ocadomail.com** has emerged as a significant indicator of compromise (IOC) linked to multiple cyber threats originating from the Republic of Korea. First observed on January

Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
6
Reports
First seenJan 2, 2024
Last seenJun 7, 2026
Verified IOC

VirusTotal

1/ 91vendors flagged
1% detection rateJun 8, 2026

WHOIS

registrar
CSC Corporate Domains, Inc.
domain rank
-1
raw
Creation Date: 2008-07-02T12:01:32Z DNSSEC: unsigned Domain Name: OCADOMAIL.COM Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: DNS1.CSCDNS.NET Name Server: DNS2.CSCDNS.NET Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: 8887802723 Registrar IANA ID: 299 Registrar URL: http://cscdbs.com Registrar WHOIS Server: whois.corporatedomains.com Registrar: CSC Corporate Domains, Inc. Registry Domain ID: 1505905650_DOMAIN_COM-VRSN Registry Expiry Date: 2026-07-02T12:01:32Z Updated Date: 2025-06-28T05:07:32Z
subdomains count
0

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 2 years ago · Last seen 3 days ago
Appeared in 6 threat reports