TF-1931854
high
📛 Threat Title
Unknown Loader: Domain name that delivers a malware payload paniprints.in
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:37:12 UTC. Last seen: 2026-09-24 07:47:42 UTC. Reporter: varysz. Tags: etherhiding, victim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
paniprints.in
VT 3 / 91
UrlVoid 3 / 36
IOC database
- Type
- domain
- Value
paniprints.in- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to Unknown Loader
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 3 of 91 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| CRDF | malicious | malicious |
| SOCRadar | malicious | malware |
| alphaMountain.ai | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Registrar | GoDaddy |
| TLD | in |
History
| Creation date | 2025-06-26 14:43 UTC |
| Last analysis | 2026-09-24 08:46 UTC |
| Last modified on VirusTotal | 2026-09-24 14:17 UTC |
| Last WHOIS update | 2025-07-08 13:58 UTC |
| WHOIS record date | 2026-09-24 08:52 UTC |
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-24 07:37:12 UTC. Last seen: 2026-09-24 07:47:42 UTC. Reporter: varysz. Tags: etherhiding, victim.
Remediations (10)
-
web:blog.sicuranext.com
EtherHiding: blockchain-based payload delivery Two seconds after the page loaded, the injected JavaScript initiated outbound queries to the BNB Smart Chain (BSC) Testnet. The BSC Testnet (Chain ID 97) is a free-to-use Ethereum Virtual Machine-compatible blockchain.
-
web:darkwebinformer.com
A new domain -based indicator has been identified associated with payload delivery activity tied to the malware unknown_loader . This domain , advertised under the guise of a mobile advertising and monetization platform, poses a high-confidence threat to users and organizations.
-
web:reliaquest.com
Learn about the role of malware loaders in cybercriminal campaigns, their distribution methods, and strategies for detection and mitigation .
-
web:socradar.io
Multiple independent ClickFix social engineering campaigns observed between April and June 2026 are delivering three distinct malware loaders BabaDeda Loader , Lorem Ipsum Loader , and Potemkin that fetch information stealers, remote access trojans, and ransomware-linked tooling onto Windows hosts. Victims are lured into pasting attacker supplied commands into the Run dialog or terminal, after ...
-
web:socradar.io
What Is a Malware Loader ? A malware loader is code whose primary purpose is to retrieve, unpack, inject, or execute another malicious payload . Loaders give operators a small initial foothold that can be updated with an infostealer, ransomware, remote access Trojan, or campaign-specific module after the victim is assessed. A loader is defined by its role in the infection chain, not by one file ...
-
web:urlhaus.abuse.ch
URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...
-
web:www.elastic.co
Elastic Security Labs uncovers OXLOADER: a new Windows loader using .reloc section abuse and anti-VM checks to drop infostealer malware via Google Ads.
-
web:www.malwarebytes.com
We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader .
-
web:www.malwarebytes.com
We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware .
-
web:www.threatlog.com
ThreatLog tracks 380,000+ malicious domains linked to malware , phishing, scams and fraud. A continuously growing database of malicious domains .
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.