IOC Radar
DomainMediumSignal 68/100

spl-express.help

Location
IndiaIndia
First Seen
Apr 12, 2025
Last Seen
Apr 6, 2026
Apr 12
First Seen
435d ago
Apr 6
Last Seen
76d ago
7
Reports
source reports
68%
Confidence
medium
Found in 7 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
68%
Signal Score
68 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

33 techniques

Feed Intelligence Summary

7 reports68% confidence
7
Source reports
68%
Confidence score
Category tags
account compromiseafricaargentinaasiaaustraliabankingbanking malwarebanking trojanbotnetbotnet activitybrazilbritish indian ocean territorybrute forcecanadachinachinese threat actorscivil servicescommand and controlcommunication technologiesconsumer goodscredential harvestingcredential stuffingcredential theftcredit card servicescyber threatsdata exfiltrationdata store exposuredistributed attacksecrimeecrime groupeuropeeurope/asiaexploitation activityfinancefinance and insurancefinancial institutionfinancial servicesfinancial technologyfleet managementfrancefraudfreight servicesgermanyglobal campaigngovernment technologyhosting provider: alibabahosting provider: tencentidentity & access exploitationindiaindicatorinjection activityiot securityitalyjapanmalicious softwaremalwaremaritime transportmexicomobile bankingmobile carriersmobile malwaremobile networksmobile phishingmobile threatnetworknorth americaoceaniapassenger transportationpayment processingphishingphishing attackphishing kitprocess injectionpublic administrationpublic infrastructurepublic policyrail transportransomwareregulatory agenciesresearchedretail traderussiarussian federationscams & fraudsmishing triadsmssms phishingsocial engineeringsouth africasouth americaspaint1047t1055t1071t1071.001t1078t1189t1192t1195.002t1486t1496t1499.001t1499.002t1499.003t1565t1566t1566.001t1566.002t1566.003t1567.001t1583t1583.001t1584t1584.001t1585t1585.002t1586t1586.002t1589t1589.002t1598t1598.003t1608t1608.004telecom servicestelecommunicationsthreat actortor nodetransportation and warehousingtransportation infrastructuretransportation technologyunited kingdomunited stateswealth management

Activity Timeline

1 total obs
Apr 6Apr 6

Threat Activity Heatmap

· Peak: 2026-04-06
Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Intelligence SummaryAI Generated

The domain **spl-express.help** has emerged as a significant indicator of compromise (IOC) linked to multiple cyber threats, including botnets, malware, phishing, and ransomware activities. Originating from India, this malicious domain was first observed on April

Threat ScoreMedium Risk
68
SIGNAL
Signal Score
68%
Confidence
7
Reports
First seenApr 12, 2025
Last seenApr 6, 2026

VirusTotal

Not checked

WHOIS

domain rank
-1
raw
Create date: 2025-03-01 00:00:00 Domain name: spl-express.help Domain registrar id: 1479 Domain registrar url: https://www.namesilo.com Expiry date: 2026-03-01 00:00:00 Name server 1: cleo.ns.cloudflare.com Name server 2: elaine.ns.cloudflare.com Query time: 2025-03-02 11:06:52 Registrant company: 566bb814321610e4 Registrant country: United States Registrant email: 29e2c061f3c9524es@ Registrant state: e1c7c1911395a3cf Update date: 2025-03-01 00:00:00
references
https://www.silentpush.com/blog/smishing-triad
subdomains count
0

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 2 months ago
Appeared in 7 threat reports