RaqibCTI
URLSUSPICIOUS

hxxps[://]alahlam[.]sa/wp-includes/sitemaps/uscnvym/c1vhrea/p1mujne/K15crypted[.]ps1

Sourced from urlhaus
Type
url
Risk score
2 / 3
First seen
2026-08-19
Last seen
2026-09-18

Passive DNS

Historical resolution (pDNS)
Historical IPs
152[.]53[.]247[.]157, 104[.]21[.]84[.]10, 172[.]67[.]184[.]135, 54[.]36[.]166[.]12, 2606:4700:3036::6815:4c60, 2606:4700:3030::ac43:c070, 104[.]21[.]76[.]96, 172[.]67[.]192[.]112, 176[.]9[.]22[.]102, 176[.]9[.]22[.]78, 136[.]243[.]104[.]240, 136[.]243[.]109[.]146
Subdomains
www[.]server[.]alahlam[.]sa, server[.]alahlam[.]sa, www[.]f[.]alahlam[.]sa, f[.]alahlam[.]sa, ns2[.]alahlam[.]sa, ns1[.]alahlam[.]sa, cpcalendars[.]alahlam[.]sa, cpcontacts[.]alahlam[.]sa, www[.]alahlam[.]sa
pDNS first seen
2019-11-24

Infrastructure fingerprint

Censys
ASN
197540 · netcup-AS - netcup GmbH
SSH host key SHA-256
ed3f59e27d66a48f
Open ports
21, 25, 53, 80, 110, 143, 443, 465, 587, 993, 2077, 2078

Historical hosting pivot

Validin
No historical-hosting pivot
No co-resolved domains recorded for this indicator's infrastructure.

ThreatMiner

No ThreatMiner enrichment
Registrant / related-sample enrichment is pending for this indicator.