Source descriptions describe reported observations. They are not a CTIDAO verdict.
This source did not provide an event description.
malware · malicious
First observed date unavailable · Last observed date unavailable
Reported source: CTIBrain;role=reported_malicious_url;tier=research;first=2026-11-03T03:16:28Z;seen=2026-11-03T03:16:28Z;expires=2026-11-06T03:16:28Z;state=active;via=tweetfeed
4 observed relationships
4 current DNS records
Not present in the current list
Popularity is neutral context, not threat evidence.
Use the evidence tabs to inspect complete observations and follow related entities. An absence of observations does not establish safety.
| Indicator | Type | Tag | Source | Last seen |
|---|---|---|---|---|
| https://secure-xdomain-54494.w-group.shop/ | url | malware, malicious | Published 2026-11-03 03:31:30 |
Observed relationships do not establish maliciousness.
| Hostname | IP | Last seen | Hits | Provenance |
|---|---|---|---|---|
| secure-xdomain-54494.w-group.shop | 2a06:98c1:3121::3 | Nov 2026First seen: Nov 2026 | 1 | CTIDAO DNS |
| secure-xdomain-54494.w-group.shop | 2a06:98c1:3120::3 | Nov 2026First seen: Nov 2026 | 1 | CTIDAO DNS |
| secure-xdomain-54494.w-group.shop | 188.114.97.3 | Nov 2026First seen: Nov 2026 | 1 | CTIDAO DNS |
| secure-xdomain-54494.w-group.shop | 188.114.96.3 | Nov 2026First seen: Nov 2026 | 1 | CTIDAO DNS |
AAAA · First seen Nov 2026
AAAA · First seen Nov 2026
A · First seen Nov 2026
A · First seen Nov 2026
Active DNS lookup; this is separate from passive DNS history.
Checked 11/3/2026, 3:31:31 AM
Daily link and hosting prominence from top1m.org; not a security verdict or traffic estimate.
Not present in the current Top 1M lists.
4 public pDNS relationships are available. Account research adds exact timing, focused pivots, and matching paid-feed intelligence.