IoC Investigation

DEAD.HTA

DOMAIN IN DATABASE

Domain · threat 0.50 · 1× seen · 0 datasets · Ransomware Actors · last seen 8h ago

🔄 Pivot:📁 Ransomware Actors

Threat Score

0.50

Sightings

0 sources

Detected Type

DOMAIN

Enrichments

Related IoCs

URL / Domain Dossier → Full OSINT Pivot + Case Create Case Takedown Export STIX/MISP ← Browse All

Domain / URL Intelligence

Host	`DEAD.HTA`
WHOIS	Not cached locally.

DNS / WHOIS Dossier DNS Audit Passive DNS ↗ Subdomains (crt.sh)

Seen in Datasets (0)

Not linked to any dataset.

OSINT Pivots

Full OSINT (30+ lookups) ↗ VirusTotal ↗ urlscan.io ↗ SecurityTrails ↗ crt.sh ↗ ThreatFox ↗ URLhaus Link Analysis ↗ OpenSanctions

Related Indicators (20)

Indicators sharing the same category.

Indicator	Type	Category
`https://www.ransomlook.io/group/crpx0`	URL	Ransomware Actors	investigate →
`http://crpx0.su/`	URL	Ransomware Actors	investigate →
`http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7…`	URL	Ransomware Actors	investigate →
`https://www.ransomlook.io/group/redact`	URL	Ransomware Actors	investigate →
`http://ursba4dbibo27dtwtgy3l2pc3ekut7helebvm…`	URL	Ransomware Actors	investigate →
`http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurq…`	URL	Ransomware Actors	investigate →
`https://www.ransomlook.io/group/sevyware`	URL	Ransomware Actors	investigate →
`http://sevykkkuzbxjpkb7gtfxnltn73bm6vaxglxh5…`	URL	Ransomware Actors	investigate →
`https://www.ransomlook.io/group/spy`	URL	Ransomware Actors	investigate →
`https://spycorp.pro/`	URL	Ransomware Actors	investigate →
`https://www.ransomlook.io/group/0day`	URL	Ransomware Actors	investigate →
`http://odaygplp3zhyx7zl45egetl6dzc4reduisnoy…`	URL	Ransomware Actors	investigate →
`https://www.ransomlook.io/group/settra`	URL	Ransomware Actors	investigate →
`http://pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlszt…`	URL	Ransomware Actors	investigate →
`http://c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zf…`	URL	Ransomware Actors	investigate →
`http://ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgx…`	URL	Ransomware Actors	investigate →
`http://26z3gms2rshr2zzedxhw5fbucilmgt2inhmxz…`	URL	Ransomware Actors	investigate →
`http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5s…`	URL	Ransomware Actors	investigate →
`https://www.ransomlook.io/group/ulose`	URL	Ransomware Actors	investigate →
`https://www.ransomlook.io/group/icarus`	URL	Ransomware Actors	investigate →

Copy as STIX 2.1

{
    "type": "indicator",
    "spec_version": "2.1",
    "id": "indicator--56d983c3-fd0a-49c7-1d40-0000f5fe1c42",
    "created": "2026-08-07T01:49:06Z",
    "modified": "2026-08-07T01:49:06Z",
    "name": "Domain: DEAD.HTA",
    "pattern": "[domain-name:value = 'DEAD.HTA']",
    "pattern_type": "stix",
    "valid_from": "2026-08-07T01:49:06Z",
    "labels": [
        "ransomware actors"
    ],
    "confidence": 50
}

Linked Cases (0)

Not linked to any case yet.

+ Add to Case Create Alert

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

DEAD.HTA

Threat Score

Sightings

Detected Type

Enrichments

Related IoCs

Domain / URL Intelligence

Seen in Datasets (0)

OSINT Pivots

Related Indicators (20)

Copy as STIX 2.1 Copy

Linked Cases (0)

🤖 AI Copilot

⚡ AI Skills

🔍 Lookup & Enrich

📚 Docs & Reports

💡 Recommendations

⚙ Automation

📜 Playbook

🔗 Related Tools

Copy as STIX 2.1