◇ SIGN IN

Radar Signals

15 extracted items · 12-week window

Deterministic statistics over the extracted Radar corpus — emerging techniques (spike detection), targeting concentration, and source metrics. No model calls; a spike is a frequency signal, not a verdict.

Brand-impersonation watch · Certificate Transparency

Domains that mimic a MENA high-value brand but sit on a non-owned domain — from certificate transparency (CT, substring on issued certs) and registered typosquats (DNS, homoglyph/typo permutations). Impersonation candidates, not confirmed phishing. Independent of AI extraction.

Hosting via passive DNS · ⚇ = co-hosted (shares an IP with another candidate — likely the same operator).

Lookalike domainImpersonatesSectorRiskViaHostingFirst seen
adnoc.xyzADNOC (adnoc.ae)Energy3/3DNSSEDO-AS 2017⚇2026-08-08
zian.comZain (zain.com)Telecom2/3DNS2a00:18e0:5:2:7577:4e4d:413b:f507 20172026-08-08
ibeg.comCIB Egypt (cibeg.com)Banking2/3DNSHETZNER-AS 2016⚿2026-08-08
aramco.sbsSaudi Aramco (aramco.com)Energy3/3DNS2a02:4780:3f:2125:0:1eb1:3fe1:5 20232026-08-08
aramc.comSaudi Aramco (aramco.com)Energy2/3DNSAMAZON-02 20152026-08-08
emiratesbd.comEmirates NBD (emiratesnbd.com)Banking2/3DNS76.223.54.146 2014⚇2026-08-08
aracmo.comSaudi Aramco (aramco.com)Energy2/3DNSSQUARESPACE 20212026-08-08
aramco.liveSaudi Aramco (aramco.com)Energy3/3DNSAMAZON-02 2020⚇2026-08-08
ssabic.comSABIC (sabic.com)Chemicals2/3DNS136.143.185.12 20202026-08-08
dpw0rld.comDP World (dpworld.com)Logistics3/3DNSAMAZON-AES 20162026-08-08
anoc.aeADNOC (adnoc.ae)Energy2/3DNSGOOGLE-CLOUD-PLATFORM 2017⚇2026-08-08
armaco.comSaudi Aramco (aramco.com)Energy2/3DNSwix_com 20202026-08-08
saibc.comSABIC (sabic.com)Chemicals2/3DNS34.149.87.45 2019⚇2026-08-08
araco.comSaudi Aramco (aramco.com)Energy2/3DNS157.230.161.221 20172026-08-08
adonc.comADNOC (adnoc.ae)Energy2/3DNSAMAZON-AES 20192026-08-08
adnco.comADNOC (adnoc.ae)Energy2/3DNSBIZLAND-SD 20212026-08-08
addnoc.comADNOC (adnoc.ae)Energy2/3DNSAMAZON-02 20212026-08-08
mashrqe.comMashreq Bank (mashreq.com)Banking2/3DNSAMAZON-02 20252026-08-08
cibe.comCIB Egypt (cibeg.com)Banking2/3DNSAMAZON-02 2019⚇2026-08-08
sbaic.comSABIC (sabic.com)Chemicals2/3DNSCLOUDFLARENET 20202026-08-08
etisalt.comEtisalat / e& (etisalat.ae)Telecom2/3DNSAKAMAI-LINODE-AP 20192026-08-08
azin.comZain (zain.com)Telecom2/3DNS69.163.226.76 20152026-08-08
alarjhibank.comAl Rajhi Bank (alrajhibank.com.sa)Banking2/3DNSOVH 20222026-08-08
cibge.comCIB Egypt (cibeg.com)Banking2/3DNSgsp 20182026-08-08
ramco.comSaudi Aramco (aramco.com)Energy2/3DNSCLOUDFLARESPECTRUM 20152026-08-08
aamco.comSaudi Aramco (aramco.com)Energy2/3DNSGOOGLE-CLOUD-PLATFORM 20122026-08-08
armco.comSaudi Aramco (aramco.com)Energy2/3DNSAMAZON-02 2015⚇2026-08-08
alrajihbank.comAl Rajhi Bank (alrajhibank.com.sa)Banking2/3DNS13.248.169.48 2024⚇2026-08-08
cieg.comCIB Egypt (cibeg.com)Banking2/3DNSALIBABA-CN-NET 20172026-08-08
aramoc.comSaudi Aramco (aramco.com)Energy2/3DNSAMAZON-02 2021⚇2026-08-08
arramco.comSaudi Aramco (aramco.com)Energy2/3DNS93.191.168.52 2021⚇2026-08-08
arammco.comSaudi Aramco (aramco.com)Energy2/3DNS67.223.118.136 20212026-08-08
aramcco.comSaudi Aramco (aramco.com)Energy2/3DNS168.119.12.242 20192026-08-08
aramcoo.comSaudi Aramco (aramco.com)Energy2/3DNS2600:1f18:4ae:c605:dd5d:b838:5816:d7fb 20202026-08-08
aramco.xyzSaudi Aramco (aramco.com)Energy3/3DNSAMAZON-02 2015⚇2026-08-08
adnoc.liveADNOC (adnoc.ae)Energy3/3DNSAMAZON-02 2023⚇2026-08-08
cibbeg.comCIB Egypt (cibeg.com)Banking2/3DNSAMAZON-02 20222026-08-08
raamco.comSaudi Aramco (aramco.com)Energy2/3DNSRMH-14 2015⚿2026-08-08
aarmco.comSaudi Aramco (aramco.com)Energy2/3DNSAMAZON-02 2017⚇2026-08-08
aaramco.comSaudi Aramco (aramco.com)Energy2/3DNSAMAZON-AES 20182026-08-08
alrjahibank.comAl Rajhi Bank (alrajhibank.com.sa)Banking2/3DNS208.91.197.27 20242026-08-08
zzain.comZain (zain.com)Telecom2/3DNS2606:4700:30::6818:77da 20192026-08-08
aramco.topSaudi Aramco (aramco.com)Energy3/3DNSGOOGLE-CLOUD-PLATFORM 20212026-08-08
adnco.aeADNOC (adnoc.ae)Energy2/3DNSAMAZON-02 20262026-08-08
mmashreq.comMashreq Bank (mashreq.com)Banking2/3DNS2.57.91.91 20252026-08-08
aramco.supportSaudi Aramco (aramco.com)Energy3/3DNSNAMECHEAP-NET 2021⚿2026-08-08
abic.comSABIC (sabic.com)Chemicals2/3DNS209.15.37.6 20162026-08-08
saic.comSABIC (sabic.com)Chemicals2/3DNS52.87.65.167 20172026-08-08
sabc.comSABIC (sabic.com)Chemicals2/3DNS64.190.63.222 2021⚇2026-08-08
sabi.comSABIC (sabic.com)Chemicals2/3DNS3.7.113.62 20142026-08-08
asbic.comSABIC (sabic.com)Chemicals2/3DNS183.181.88.150 20212026-08-08
aramo.comSaudi Aramco (aramco.com)Energy2/3DNSSEDO-AS 20152026-08-08
zin.comZain (zain.com)Telecom2/3DNS204.44.192.18 20132026-08-08
aramco.clickSaudi Aramco (aramco.com)Energy3/3DNSNAMECHEAP-NET 20162026-08-08
aramco.icuSaudi Aramco (aramco.com)Energy3/3DNSAKAMAI-ASN1 2020⚇2026-08-08
s4bic.comSABIC (sabic.com)Chemicals3/3DNSCLOUDFLARENET 20152026-08-08
adnoc.clickADNOC (adnoc.ae)Energy3/3DNSM247 2022⚿2026-08-08
adnoc.onlineADNOC (adnoc.ae)Energy3/3DNSAMAZON-02 20212026-08-08
andoc.comADNOC (adnoc.ae)Energy2/3DNSLGDACOM-KR 20212026-08-08
sabic.xyzSABIC (sabic.com)Chemicals3/3DNSAMAZON-02 20232026-08-08

Active C2 infrastructure · Shodan fingerprints

Live hosts matching a known C2 / offensive-tool fingerprint (Havoc, Responder, SimpleHelp…) from public research. Global reference (C2 is hosted anywhere) — the value is cross-matching: a lookalike resolving to one of these IPs is flagged ☠ above. MENA-hosted ones badged.

HostFrameworkProductPortCountryASN / org
20.39.60.137Havoc C2Havoc C2443USMicrosoft Corporation
142.93.88.220Havoc C2Havoc C2443USDigitalOcean, LLC
161.35.176.231Havoc C2Havoc C2443USDigitalOcean, LLC
146.190.80.105Havoc C2Havoc C2443SGDigitalOcean, LLC
164.92.79.49Havoc C2Havoc C2443USDigitalOcean, LLC
47.83.134.97Havoc C2Havoc C2443HKAlibaba Cloud LLC
172.239.45.42Havoc C2Ncat http proxy81USLinode
43.134.169.103Havoc C2Havoc C28080SGAsia Pacific Network Information Center, Pty. Ltd.
82.156.224.184Havoc C2Havoc C28080CNTencent Cloud Computing (Beijing) Co., Ltd
20.69.167.4Havoc C2Havoc C2443USMicrosoft Corporation
107.172.22.3Havoc C2Havoc C2443USRackNerd LLC
143.198.120.167Havoc C2Havoc C280USDigitalOcean, LLC
35.179.229.71Havoc C2Havoc C280GBAmazon Data Services UK
172.189.57.198Havoc C2Havoc C2443FRMicrosoft Limited
20.188.119.195Havoc C2Havoc C2443SGMicrosoft Corporation
20.188.119.195Havoc C2Havoc C280SGMicrosoft Corporation
43.106.14.139Havoc C2Havoc C28085SGAlibaba Cloud (Singapore) Private Limited
40.85.252.198Havoc C2—443CAMicrosoft Corporation
2.56.212.64Havoc C2—8443NLMVPS LTD
20.109.3.175Havoc C2—80USMicrosoft Corporation
158.247.194.144Havoc C2—80KRThe Constant Company, LLC
104.251.181.73Havoc C2—443USTri-County Wireless, LLC
8.222.192.153Havoc C2—8000SGAlibaba Cloud (Singapore) Private Limited
20.220.29.224Havoc C2—8443CAMicrosoft Corporation
194.163.154.86Havoc C2—443DEContabo GmbH
3.15.234.162Responder (OST)Microsoft IIS httpd80USAmazon Technologies Inc.
161.35.239.147Havoc C2Havoc C2443USDigitalOcean, LLC
173.249.41.141Havoc C2Havoc C280DEContabo GmbH
84.247.133.139Havoc C2Havoc C2443DEContabo GmbH

Infrastructure pivot hubs · Validin

IPs (from our flagged hosts + C2 references) with many co-resolved domains over time — an operator's wider footprint. Hosting-provider PTR / cloud noise is filtered. Historical association, not live proof — confirm each domain independently.

84.247.133.139Havoc C227 of 42 domains
c2.lfema.esaadcdn.lfema.eslogin.lfema.eslogincdn.login.lfema.eswww.login.lfema.esaadcdnmsft.lfema.esaadcdn.login.lfema.eslogin.login.lfema.eslfema.esln.lfema.esaccount.login.lfema.eswww.lfema.eslogincdn.lfema.esifemaes-my.sharepoint.lfema.esquarantine.lfema.esaccount.lfema.essharepoint.lfema.esclienteplus.ptwww.clienteplus.ptwebmail.rosillospizza.comcpanel.rosillospizza.comcpcontacts.rosillospizza.comwebdisk.rosillospizza.commail.rosillospizza.com
173.249.41.141Havoc C216 of 21 domains
pm.bitpull.dex.bitpull.deomv.bitpull.dewww.aicloudagent.netaicloudagent.netmail.aicloudagent.netn8n.aicloudagent.netmail-pivotgate.commail.mail-pivotgate.comimap.mail-pivotgate.compop3.mail-pivotgate.compop.mail-pivotgate.comsmtp.mail-pivotgate.comx.x5w.deip.bitpull.denas.bitpull.de
161.35.239.147Havoc C27 of 12 domains
h1.redethics.esha.redethics.xyzhavoc.redethics.onlinereadityou.comlamper.liveluckyjack.livemail.luckyjack.live
172.189.57.198Havoc C22 of 2 domains
login.infovexis.comlogin.vocamedproject.com
40.85.252.198Havoc C22 of 7 domains
appleid-fraud-operations.infowww.appleid-fraud-operations.info

Shared-hosting clusters

Impersonation candidates resolving to the same IP, classified by hosting ASN (Censys): hosting/VPS spanning multiple brands is the stronger lead; parking and big-cloud shares are weaker (unrelated lookalikes commonly co-park there).

AS-HOSTINGER3 domains · 2 brandshosting
mmashreq.comddpworld.commashreq.support
ARAMCO-AS2 domains · 1 brandshosting
mobile.aramcoservices.commisentry.aramcoservices.com
ARAMCO-AS2 domains · 1 brandshosting
aurum-atx.aramcoservices.comatx-aurum.aramcoservices.com
AKAMAI-ASN12 domains · 1 brandshosting
arramco.comaramco.icu
AMAZON-027 domains · 5 brandscloud
aramco.livearamoc.comadnoc.livedpworldd.comdpworld.liveooredoo.livezani.com
AMAZON-024 domains · 4 brandscloud
cibe.comarmco.comemiratesbd.comooredoo.online
AMAZON-024 domains · 3 brandscloud
aramco.xyzaarmco.comalrajihbank.comadno.com
AMAZON-023 domains · 1 brandscloud
mashrqe.commahsreq.commsahreq.com
GOOGLE-CLOUD-PLATFORM2 domains · 2 brandscloud
anoc.aesaibc.com
AMAZON-022 domains · 2 brandscloud
adnoc.onlinemashrq.com

MENA malware IOCs · abuse.ch

Confirmed-malicious indicators tagged by malware family, from abuse.ch — ThreatFox + URLhaus(domain/URL, MENA-scoped) and Feodo (botnet C2 IPs, global high-confidence reference for cross-matching). Independent of AI extraction.

IndicatorTypeMalware / tagThreatConfViaFirst seen
https://01pr.com.tr/shed/sdy.pngurlxwormmalware download—URLhaus2026-07-16
https://01pr.com.tr/shed/MSI_PRODJ5TH.pngurlxwormmalware download—URLhaus2026-07-16
https://arromaseis.com.tr/glory/Ikuku.binurlPhantomStealermalware download—URLhaus2026-07-15
27.133.154.218ipQakBotbotnet cc—Feodo2026-03-04
178.62.3.223ipQakBotbotnet cc—Feodo2026-02-17
34.204.119.63ipQakBotbotnet cc—Feodo2026-01-13
50.16.16.211ipQakBotbotnet cc—Feodo2025-12-30
162.243.103.246ipEmotetbotnet cc—Feodo2022-06-04
fkd.co.ildomainIClickFixpayload delivery100ThreatFox—
watt.qadomainClearFakepayload delivery90ThreatFox—
mefks.aedomainIClickFixpayload delivery50ThreatFox—
oxygenmc.aedomainIClickFixpayload delivery50ThreatFox—
shaitashdod.co.ildomainClearFakepayload delivery50ThreatFox—
jetmail.com.trdomainIClickFixpayload delivery50ThreatFox—
one-pager.noamvolk-studio.co.ildomainIClickFixpayload delivery50ThreatFox—
Extracted items by week · last 12▉ = current

Emerging techniques

Ranked by momentum (last 4 weeks vs prior 4). z = std-devs above the 11-week baseline.

Technique12-weekRecentΔ vs priorz
T1078 ↗
4▲ 43.0
T1059 ↗
2▲ 23.0
T1189 ↗
2▲ 23.0
T1552 ↗
2▲ 23.0
T1005 ↗
2▲ 23.0
T1566 ↗
2▲ 23.0
T1021 ↗
2▲ 23.0
T1027 ↗
2▲ 16.6
T1071.001 ↗
1—3.2
T1090 ↗
1—3.2

Targeted sectors · 90d

Technology
4 ▲
Government
3 ▲
Military
1 ▲
Defense
1 ▲
Software development
1 ▲
Financial Services
1 ▲
AI/Software Development
1 ▲
Cloud Computing
1 ▲
Artificial Intelligence
1 ▲
Critical Infrastructure
1 ▲

Targeted countries · 90d

Ukraine
1 ▲
Italy
1 ▲
Qatar
1 ▲
China
1 ▲
United States
1 ▲
Iran
1 ▲
Israel
1 ▲

Top sector × country · 90d

Government · Ukraine1Government · Italy1Military · Ukraine1Military · Italy1Defense · Ukraine1Defense · Italy1Financial Services · Qatar1Government · Qatar1

Source metrics

SourceReliabilityItemsLast seen
Recorded Future / Insikt GroupA41d ago
Microsoft MSTICA33d ago
Unit 42 (Palo Alto Networks)A31d ago
Check Point ResearchA22d ago
Mandiant / Google Threat IntelligenceA144d ago
CrowdStrike BlogA11d ago
Kaspersky SecurelistA111d ago