s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932716 high

📛 Threat Title

Unknown malware: Domain name that delivers a malware payload ai.lzgqin.cc.cd

Category: Unknown malware Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 75. First seen: 2026-09-25 08:12:44 UTC. Reporter: ClickFixer. Tags: ClickFix.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain ai.lzgqin.cc.cd VT 4 / 91 UrlVoid 3 / 36

IOC database

Type
domain
Value
ai.lzgqin.cc.cd
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 4 of 91 VirusTotal vendors

VendorVerdictDetection
alphaMountain.ai malicious malicious
Certego malicious malicious
CRDF malicious malicious
SOCRadar malicious malicious

Details From VirusTotal

Basic Properties
RegistrarNIC CD Migration
TLDcc.cd
History
Creation date2021-01-15 00:00 UTC
Last analysis2026-09-24 18:05 UTC
Last modified on VirusTotal2026-09-26 00:30 UTC
Last WHOIS update2023-05-15 13:24 UTC

References (3)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 75. First seen: 2026-09-25 08:12:44 UTC. Reporter: ClickFixer. Tags: ClickFix.

  • External reference ThreatFox IOCs

Remediations (10)

  • Check IPs, Domains, Emails & Crypto Wallets | isMalicious
    web:ismalicious.com

    Check IPs, domains , URLs, emails, phones and crypto wallets against indexed threat indicators. Streaming reports, blocklist API, free API key.

  • When Trusted AI Platforms Become Malware Delivery Infrastructure
    web:labs.cloudsecurityalliance.org

    Key Takeaways Over the summer of 2026, threat actors repeatedly turned the public-facing, user-generated-content features of major AI platforms into malware delivery infrastructure, abusing the inherent trust users place in domains such as claude.ai and chatgpt.com.

  • Malware Domain List - PrecisionSec
    web:precisionsec.com

    Recent Malware Domain List indicators Live domain indicators, including phishing lures, C2 and payload -hosting infrastructure, pulled straight from our threat feed and refreshed hourly. For full coverage and API delivery, start a free trial. A sample from our threat feed.

  • URL Scanner | Cloudflare Radar
    web:radar.cloudflare.com

    Understand the security, performance, technology, and network details of a URL with a publicly shareable report.

  • CRDF Threat Center: Predictive CTI, Malicious URL & Domain Intelligence
    web:threatcenter.crdf.fr

    CRDF Threat Center provides predictive threat intelligence, malicious URL and domain detection, CRDF AI scoring, WHOIS and NRD enrichment, public lookups, private feeds and APIs.

  • ThreatFox | Unknown malware
    web:threatfox.abuse.ch

    ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with unknown . You can also get this data through the ThreatFox API. Database Entry

  • URLhaus | Malware URL exchange
    web:urlhaus.abuse.ch

    URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  • URLhaus | Browse - abuse.ch
    web:urlhaus.abuse.ch

    URLhaus is a project operated by abuse.ch with the purpose of sharing malicious URLs that are being used for malware distribution

  • Counterfeit installers to system compromise: Tracking a deceptive ...
    web:www.microsoft.com

    An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat.

  • VirusTotal - Search - malware
    web:www.virustotal.com

    VirusTotal provides a free online service to scan files and URLs for viruses, malware , and other threats using multiple antivirus engines.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.