TF-1933865
high
📛 Threat Title
Unknown Loader: Domain name that delivers a malware payload upvc-painting.uk
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:33 UTC. Reporter: varysz. Tags: etherhiding, victim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
upvc-painting.uk
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/domains/upvc-painting.uk
UrlVoid 3 / 36
IOC database
- Type
- domain
- Value
upvc-painting.uk- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/domains/upvc-painting.uk
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:33 UTC. Reporter: varysz. Tags: etherhiding, victim.
Remediations (10)
-
web:cybersecuritynews.com
A sophisticated DNS-based malware campaign has emerged, utilizing thousands of compromised websites worldwide to deliver the Strela Stealer information-stealing malware through an unprecedented technique involving DNS TXT records. The threat, tracked as Detour Dog by security researchers, represents a significant evolution in malware distribution methods that leverages the Domain Name System ...
-
web:precisionsec.com
Recent Malware Domain List indicators Live domain indicators, including phishing lures, C2 and payload -hosting infrastructure, pulled straight from our threat feed and refreshed hourly. For full coverage and API delivery, start a free trial. A sample from our threat feed.
-
web:sitecheck.sucuri.net
Free website malware and security checker Enter a URL like example.com and the Sucuri SiteCheck scanner will check the website for known malware , viruses, blacklisting status, website errors, out-of-date software, and malicious code.
-
web:threatfox.abuse.ch
The statistics below consider indicators of compromise (IOCs) submitted to ThreatFox within the past 14 days. Number of IOCs shared
-
web:urlhaus.abuse.ch
URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...
-
web:urlhaus.abuse.ch
Here you can propose new malware urls or just browse the URLhaus database. If you are looking for a parsable list of the dataset, you might want to check out the URLhaus API.
-
web:www.hybrid-analysis.com
Free automated malware analysis service powered by CrowdStrike Falcon Sandbox. Submit files and URLs for deep behavioral analysis and threat detection.
-
web:www.illumio.com
Understanding malware beacons and knowing how to block them can help keep your organization safer. A beacon, also known as a payload , is an executable or program that communicates back to a cyberattacker via some communication channel. From the threat actor's point of view, beacon management is the foundation for their malicious campaign. Depending on the type and capability of a beacon, it ...
-
web:www.illumio.com
In the final part of this series, we focus on some of the obfuscation techniques used to disguise malware payloads and examine mitigation techniques organizations can employ.
-
web:www.silentpush.com
Expose pre-weaponized adversary infrastructure with Indicators of Future Attack®.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.