IOC Radar
DomainHighVerifiedSignal 64/100

www.nhanoithanh.com

Location
NetherlandsNetherlands
First Seen
Jul 8, 2025
Last Seen
Nov 5, 2025
Jul 8
First Seen
340d ago
Nov 5
Last Seen
221d ago
4
Reports
source reports
64%
Confidence
high
Found in 4 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
64%
Signal Score
64 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

159 techniques

Feed Intelligence Summary

4 reports64% confidence
4
Source reports
64%
Confidence score
Category tags
aaaaabuseacceptaccount securityaddressaddress domainaddress googleadvanced persistent threatakamaialertsanalysis dateapache xappleaptapt groupascii textassociated urlsatomaustraliaautorunav detectionsavast avgbingbodybody doctypebotnetch uacivilcivil servicescivilian targetingck idck matrixclick-based attackcnletcode executioncode injectioncommandcommand and controlcommand executioncommunication protocolcommunication technologiescompromised routercontent typecopy md5copy sha1copy sha256creation datecredential harvestingcrlf linedata accessdata copyingdata exfiltrationdata transferdata uploadddos attacksdefense evasiondefense-evasiondeletedelphidetailed errordetections namedevelopment attdistributed attacksdnsdnssecdocument filedomains showdropperdynamicdynamicloadere safeelectronic health recordselton avundanoencryptenterprise securityentrieserrorerror juleu alexeyeu cyber policieseuropeexploitfileless malwarefilesfiles domainfiles ipfiles locationfiles relatedfiles showfirmware infectionfirmware modificationflagflag unitedfoundfrance asngeckogenericgoogle safegovernment technologyheader http2health care and social assistancehealth information technologyhealthcare information systemshighhospital managementhostilehostinghostname addhostname enumerationhostname queryhttp scannerhybridicmp trafficids detectionsii llcindicatorinformation gatheringinformation technologyinfrastructure acquisitionreconnaissanceingress tool transferinput validation bypassintelinternet of thingsiosios malwareiot botnetiot/ics attackit infrastructureitre attkeyskhtmllazarus grouplearnless whoislinklinuxlinux malwarelocallookmacmalicious linksmalicious softwaremalwaremass surveillancemediamedical servicesmediummetadata analysismirai botnetmitre attmobilemobile carriersmobile malwaremobile networksmobile secmobile securitymodel secmovednamename servername serversname tacticsnetherlandsnetworknetwork scanningnetwork trafficnextnext associatednext passivenext relatednext yaranreumobjectoceaniaogoogle trustok transferoletopenurl coperating systemoperating system securityoutbound m3overview ippacking t1045passive dnspatch managementpath traversalpatient carepattern matchpdfpe filepegasuspegasus projectperfect privacyphishingphishing attackpoliceportprecreate readpresentpresent aprpresent augpresent decpresent febpresent janpresent julpresent marpresent novpresent octpresent sepprocess injectionpublic administrationpublic infrastructurepublic policypulse pulsespulse submitpulses nonepushransomransom:win32/cvereadread creconnaissancerecord valuerefreshregional securityregistry modificationregistry runregulatory agenciesrelated nidsrelated tagsremote servicesresearchedresponse iprestartresults janresults julreverse dnsreviewsafe browsingscript urlssearchserver responseserviceshowshow processshow techniqueshowingsizesmssms exploitsocial engineeringsocial media securitysoftware developmentsoftware exploitationsoftware vulnerabilitiesspanspawnsssl castatestate-promovedstate-sponsoredstatusstringssuspt1003t1003.001t1003.004t1004t1005t1012t1016t1018t1020t1021t1021.001t1021.006t1023t1027t1030t1031t1036t1037t1037.003t1040t1041t1045t1053t1055t1056t1057t1059t1060t1062t1064t1068t1069.001t1070t1071t1071.001t1071.004t1076t1078t1082t1083t1084t1087t1091t1105t1110t1112t1113t1119t1129t1130t1133t1156t1185t1187t1189t1190t1192t1193t1199t1203t1204t1204.001t1204.002t1205t1210t1211t1212t1480t1480 executiont1485t1486t1490t1491t1495t1496t1497t1499.002t1499.003t1505t1529t1530t1539t1543t1546t1552t1553t1553.003t1555t1556t1557t1562t1564t1565t1566t1566.001t1566.002t1566.003t1566.004t1567t1568t1569t1571t1573t1574t1578t1580t1583t1584t1585t1586t1587t1587.001t1587.003t1588t1589t1589.001t1590t1590.001t1591t1592t1593t1594t1595t1596t1596.001t1596.004t1597t1598t1599t1600t1601t1602t1602.001t1602.002t1606t1608t1609t1610t1611t1612t1613t1614t1615t1619t1620t1621t1622t1647t1648t1649t1650t1651t1652t1653t1654t1656t1657t1659t1665t1666targeted spyware campaigntargeted-attackstelecom servicestelecommunicationstexastitle objecttlsv1toolstor analysistrojan malwaretrojandroppertrojanspytype datatypeofua archua bitnessua fullua platformunitedunknown nsunknown soaurlsurls showuser executionusersutf8 textverdictverifyversion secvirtoolweb application exploitationweb trafficwin32 malwarewindirwindows malwarewindows ntwine emulatorwritex poweredxhr loadxhr startyara detectionszero click exploitzero-day exploit

Activity Timeline

1 total obs
Nov 5Nov 5

Threat Activity Heatmap

· Peak: 2025-11-05
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Intelligence SummaryAI Generated

The domain www.nhanoithanh.com has been identified as a significant indicator of compromise (IOC) associated with multiple cyber threats, including botnet activity, exploits, malware distribution, and phishing campaigns. Originating from the Netherlands, this malicious IP has been observed in at least one threat intelligence report, highlighting its role in ongoing cyber operations. First detected on July

Threat ScoreMedium Risk
64
SIGNAL
Signal Score
64%
Confidence
4
Reports
First seenJul 8, 2025
Last seenNov 5, 2025
Verified IOC

VirusTotal

Not checked

WHOIS

registrar
NameSilo, LLC
description
Operation Endgame: Mass, permanent surveillance targeting civilians without warrants. Advanced tools infect devices via malicious links (WhatsApp/SMS/email) or PDFs with zero-day exploits. Clicking executes malware: Pegasus (Android/iOS) or **Mirai** (Linux/Windows), enrolling devices into a botnet. Infections are persistent, often replacing device/router firmware, requiring hardware changes. Malicious traffic hides via Google/Cloudflare DNS. Thousands of companies collaborate (Amazon, Google, Microsoft, Facebook, WhatsApp, Apple, etc.), providing servers, domains, and websites to mask attacks. This enables agencies to infect targets even when accessing legitimate services (e.g., logging into Amazon) if the browser is vulnerable. Attacks are targeted, evading firewalls, and expose private data, risking targets' physical safety. The operation involves multiple allied states.
raw
Admin City: Phoenix Admin Country: US Admin Email: [email protected] Admin Organization: See PrivacyGuardian.org Admin Postal Code: 85016 Admin State/Province: AZ Creation Date: 2022-01-31T07:00:00Z Creation Date: 2022-02-01T05:34:38Z DNSSEC: unsigned Domain Name: NHANOITHANH.COM Domain Name: nhanoithanh.com Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: clientTransferProhibited https://www.icann.org/epp#clientTransferProhibited Name Server: NS1.HOST160.VIETNIX.VN Name Server: NS2.HOST160.VIETNIX.VN Name Server: ns1.host160.vietnix.vn Name Server: ns2.host160.vietnix.vn Registrant City: 7a96e04d2a2490b3 Registrant Country: US Registrant Email: [email protected] Registrant Fax Ext: 3432650ec337c945 Registrant Fax: 3432650ec337c945 Registrant Name: 1f33d7151e7ebf55 Registrant Organization: 566bb814321610e4 Registrant Phone Ext: 3432650ec337c945 Registrant Phone: 4e9226e7e27a4c0c Registrant Postal Code: c692e0cb8851b160 Registrant State/Province: e1c7c1911395a3cf Registrant Street: 4450dc66882e5a1e Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +1.4805240066 Registrar IANA ID: 1479 Registrar Registration Expiration Date: 2025-01-31T07:00:00Z Registrar URL: http://www.namesilo.com Registrar URL: https://www.namesilo.com/ Registrar WHOIS Server: whois.namesilo.com Registrar: NameSilo, LLC Registry Domain ID: 2672256031_DOMAIN_COM-VRSN Registry Expiry Date: 2025-02-01T05:34:38Z Tech City: Phoenix Tech Country: US Tech Email: [email protected] Tech Organization: See PrivacyGuardian.org Tech Postal Code: 85016 Tech State/Province: AZ Updated Date: 2024-02-02T08:03:05Z Updated Date: 2024-11-21T07:00:00Z

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 11 months ago · Last seen 7 months ago
Appeared in 4 threat reports