← All actors Recent activity

REDFOXTROT

REDFOXTROT

Indicators
148
Source reports
29
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20192025

Overview 148 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

domain144REDFOXTROT-domain.txt
ipv44REDFOXTROT.json

Principal sources 29 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 148 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 4 domain, 4 ipv41 yr ago

    x.com/Cyberteam008/status/1882654346804080880 · virustotal.com/gui/file/8571f53a54efaf13ab5a1eabe1f33e… · virustotal.com/gui/file/fd03a2d1c9ece4db62da7b4f8ca0f7… · virustotal.com/gui/file/44538a8b50c093cf17c6fbd799a51a…

    domainanywheres.run.place
    domainappsupport.my-router.de
    domainappupdate.firewall-gateway.de
    domainappupdate.my-router.de
    ipv4135.181.243.34:8080
    ipv4164.132.27.225:8080
    ipv4192.51.188.47:443
    ipv4194.126.202.217:443

  2. 2 domain2 yrs ago

    x.com/Cyberteam008/status/1873548744593232365 · virustotal.com/gui/ip-address/139.84.168.246/relations · virustotal.com/gui/ip-address/64.227.184.126/relations

    indiabs.nl
    indiabsnl.net

  3. 1 domain2 yrs ago

    x.com/Cyberteam008/status/1817738163387023520 · virustotal.com/gui/ip-address/23.227.196.31/relations

    ncell.app

  4. 1 domain2 yrs ago

    x.com/Cyberteam008/status/1808321922087936030 · virustotal.com/gui/ip-address/103.218.240.213/relations · virustotal.com/gui/ip-address/103.45.68.125/relations · virustotal.com/gui/ip-address/144.91.66.12/relations · virustotal.com/gui/ip-address/154.26.153.129/relations · virustotal.com/gui/ip-address/167.179.105.81/relations · virustotal.com/gui/ip-address/192.236.195.253/relations · virustotal.com/gui/ip-address/193.124.93.153/relations · virustotal.com/gui/file/e4fe0bd698d7d4b346f2a77440f991…

    newseason.online

  5. 1 domain2 yrs ago

    x.com/Cyberteam008/status/1808321922087936030 · virustotal.com/gui/ip-address/103.218.240.213/relations · virustotal.com/gui/ip-address/103.45.68.125/relations · virustotal.com/gui/ip-address/144.91.66.12/relations · virustotal.com/gui/ip-address/154.26.153.129/relations · virustotal.com/gui/ip-address/167.179.105.81/relations · virustotal.com/gui/ip-address/192.236.195.253/relations · virustotal.com/gui/ip-address/193.124.93.153/relations · virustotal.com/gui/file/e4fe0bd698d7d4b346f2a77440f991…

    jiocircle.site

  6. 7 domain2 yrs ago

    x.com/Cyberteam008/status/1808321922087936030 · virustotal.com/gui/ip-address/103.218.240.213/relations · virustotal.com/gui/ip-address/103.45.68.125/relations · virustotal.com/gui/ip-address/144.91.66.12/relations · virustotal.com/gui/ip-address/154.26.153.129/relations · virustotal.com/gui/ip-address/167.179.105.81/relations · virustotal.com/gui/ip-address/192.236.195.253/relations · virustotal.com/gui/ip-address/193.124.93.153/relations · virustotal.com/gui/file/e4fe0bd698d7d4b346f2a77440f991…

    cheapnews.online
    kazcell.info
    kazinfo.net
    kaznews.shop
    newtelecom.shop
    nur-tv.shop
    protondiscover.com

  7. 7 domain2 yrs ago

    x.com/Cyberteam008/status/1808321922087936030 · virustotal.com/gui/ip-address/103.218.240.213/relations · virustotal.com/gui/ip-address/103.45.68.125/relations · virustotal.com/gui/ip-address/144.91.66.12/relations · virustotal.com/gui/ip-address/154.26.153.129/relations · virustotal.com/gui/ip-address/167.179.105.81/relations · virustotal.com/gui/ip-address/192.236.195.253/relations · virustotal.com/gui/ip-address/193.124.93.153/relations · virustotal.com/gui/file/e4fe0bd698d7d4b346f2a77440f991…

    googiao.top
    gov4us.online
    indiavoice.site
    kaztelecom.shop
    kz-news.site
    newsforname.site
    nurkaz.shop

  8. 10 domain2 yrs ago

    twitter.com/Cyberteam008/status/1781204417481679199 · virustotal.com/gui/ip-address/165.22.211.185/relations · virustotal.com/gui/ip-address/5.188.228.165/relations · virustotal.com/gui/file/ed34d7d905f4169ea14e27410028b6…

    bbsaili.camdvr.org
    ciscoteam.ignorelist.com
    ftp.isronrsc.giize.com
    indiabsnl.com
    indiabsnl.in
    isronrsc.giize.com
    isrosdsc.camdvr.org
    mail.indiabsnl.com
    mail.indiabsnl.in
    sts.isronrsc.giize.com

  9. 3 domain4 yrs ago

    virustotal.com/gui/file/00efd6ece111a99e1aea36636baba3… · virustotal.com/gui/file/8a3e3de44128ae2abada62c68f1e9f…

    holyshit.dynamic-dns.net
    mobai.moshen.xyz
    moshen.xyz

  10. 2 domain4 yrs ago

    recordedfuture.com/chinese-apt-groups-target-afghan-teleco… · otx.alienvault.com/pulse/61544024e496818edcda5f98

    darkpapa.chickenkiller.com
    dhsg123.jkub.com

  11. 93 domain5 yrs ago

    go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf · github.com/Insikt-Group/Research/blob/master/RedFo… · otx.alienvault.com/pulse/60cc709013f5498fe7e60120

    adobesupport.net
    adtl.mywire.org
    appinfo.camdvr.org
    billing.epac.to
    chock.mywire.org
    coreldraw.kozow.com
    czconnections.ddns.info
    drdo.dumb1.com
    drdo.mypop3.net
    dsgf.chickenkiller.com
    elienceso.kozow.com
    exat.dnset.com
    exat.zyns.com
    execserver.giize.com
    exujjat.xxuz.com
    fashget.theworkpc.com
    fivenum.mooo.com
    foreverlove.zzux.com
    forum.camdvr.org
    fukebutt.zzux.com
    googleupdate.myz.info
    gulistan.wikaba.com
    hcl.sexidude.com
    hostmail1.com
    https.dnset.com
    https.otzo.com
    https.vizvaz.com
    inbsnl.ddns.info
    inbsnl.ddns.ms
    indiaeducation.mefound.com
    indian.mefound.com
    indianmail.zyns.com
    itsupport.firewall-gateway.net
    jpgdowngaussip.ddns.info
    kelimelerdunyasi.org
    koreckaccord01.zzux.com
    lexuz.dns05.com
    lexuz.x24hr.com
    linkedin.organiccrap.com
    locker.camdvr.org
    login.kozow.com
    logonfaker.longmusic.com
    macfee.webredirect.org
    macfeesyn.ns01.info
    macfeeupdate.ddns.info
    mall.mywire.org
    manual.gleeze.com
    manuals.wikaba.com
    menus.giize.com
    menus.kozow.com
    mfedownload.freetcp.com
    mfeupdate.ddns.info
    mfeupload.freetcp.com
    miche.justdied.com
    msgsober.xxuz.com
    msn.dnsnet.com
    notice.theworkpc.com
    nproccshow.zyns.com
    otc.toythieves.com
    pisces.zzux.com
    prace.gleeze.com
    pracute.camdvr.org
    queryinfo.mrbonus.com
    quickheal.firewall-gateway.net
    randomanalyze.freetcp.com
    rastelcs.kozow.com
    rci.ddns.info
    redhatboy.dynamic-dns.net
    scorpio.zzux.com
    secindia.mywire.org
    secssl.ooguy.com
    secssl.theworkpc.com
    secupdate.kozow.com
    skylineline.crabdance.com
    smcupdate.mooo.com
    srcrail.kozow.com
    stratejibilimi.com
    sunway2.chickenkiller.com
    superkelimeler.com
    supports.casacam.net
    supports.gleeze.com
    sysman.ddnsgeek.com
    sysmantec.firewall-gateway.net
    sysmantec.organiccrap.com
    thinkv.dynamic-dns.net
    thinkv.epac.to
    trand.mefound.com
    updateinfo.kozow.com
    water.xxuz.com
    wawaqq.ddns.info
    whitepages.dynamic-dns.net
    wsliversourcecor.epac.to
    yatedo.organiccrap.com

  12. 1 domain7 yrs ago

    go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf · github.com/Insikt-Group/Research/blob/master/RedFo… · otx.alienvault.com/pulse/60cc709013f5498fe7e60120

    capture.kozow.com

  13. 8 domain7 yrs ago

    go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf · github.com/Insikt-Group/Research/blob/master/RedFo… · otx.alienvault.com/pulse/60cc709013f5498fe7e60120

    aries.epac.to
    honoroftajik.dynamic-dns.net
    https.ikwb.com
    laugh.toh.info
    nicodonald.accesscam.org
    niteast.strangled.net
    tajikstantravel.dynamic-dns.net
    trendiis.sixth.biz

  14. 4 domain7 yrs ago

    go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf · github.com/Insikt-Group/Research/blob/master/RedFo… · otx.alienvault.com/pulse/60cc709013f5498fe7e60120

    kastygost.compress.to
    skylineqaz.crabdance.com
    tele.zyns.com
    uzwatersource.dynamic-dns.net

Further reading 29