RaqibCTI
URLSUSPICIOUS

hxxps[://]toolshare[.]com[.]tr/files/jqqvLru0VAiH3z[.]exe

Sourced from threatfox
Type
url
Risk score
2 / 3
First seen
Last seen
2026-09-11

Passive DNS

Historical resolution (pDNS)
Historical IPs
193[.]38[.]34[.]5
pDNS first seen
2025-04-21

Infrastructure fingerprint

Censys
ASN
207279 · MARKAHOST-TELEKOMUNIKASYON-LIMITED-SIRKETI - Markahost Telekomunikasyon Ve Ticaret Limited Sirketi
SSH host key SHA-256
89683f92b51cb009
Open ports
21, 25, 53, 80, 110, 111, 143, 443, 587, 993, 1453, 2077

Historical hosting pivot

Validin
Co-resolved domains (250)
mail[.]deyerli[.]cloud, ftp[.]deyerli[.]cloud, hayallerweb[.]eu[.]cc, webdisk[.]portfoy[.]me, webmail[.]portfoy[.]me, cpcontacts[.]portfoy[.]me, cpanel[.]portfoy[.]me, mail[.]portfoy[.]me, cpcalendars[.]portfoy[.]me, whm[.]portfoy[.]me, portfoy[.]me, www[.]portfoy[.]me, ftp[.]portfoy[.]me, feslegen12[.]life, ftp[.]feslegen12[.]life, webdisk[.]feslegen12[.]life, cpcalendars[.]feslegen12[.]life, www[.]feslegen12[.]life, cpanel[.]feslegen12[.]life, mail[.]feslegen12[.]life, webmail[.]feslegen12[.]life, whm[.]feslegen12[.]life, cpcontacts[.]feslegen12[.]life, deyerli[.]cloud, cpanel[.]deyerli[.]cloud, webdisk[.]deyerli[.]cloud, webmail[.]deyerli[.]cloud, whm[.]deyerli[.]cloud, smm[.]deyerli[.]cloud, cpcontacts[.]deyerli[.]cloud, www[.]smm[.]deyerli[.]cloud, cpcalendars[.]deyerli[.]cloud, www[.]deyerli[.]cloud, fallenangelmusic[.]online, webdisk[.]fallenangelmusic[.]online, webmail[.]fallenangelmusic[.]online, cpanel[.]fallenangelmusic[.]online, whm[.]fallenangelmusic[.]online, cpcalendars[.]fallenangelmusic[.]online, cpcontacts[.]fallenangelmusic[.]online

ThreatMiner

No ThreatMiner enrichment
Registrant / related-sample enrichment is pending for this indicator.