🌐 mail.ru

DOMAIN · host mail.ru · threat 0.50 (HIGH) · Sanctions

First seen 2026-08-06 13:09:12 · last seen 2026-08-06 19:47:16

🔄 Pivot:📁 Sanctions

Threat score

0.50

MEDIUM

Sightings

8 sources

Subdomains (local)

from indicators

Related IPs

A/AAAA records

DNS records (local)

6 types

Reporting sources

0 enrichments

PIVOT🌐 Domain Profile 🔍 Advanced Search 🕵 OSINT Pivot 🔗 Link Analysis 🕑 Timeline 📤 Export STIX/MISP

📡 Reporting-source breakdown

Sanctions

Ransomware Actors

Threat Reports

8 total source links on this indicator.

🏷 Tag breakdown (domain family)

medium-severity

auto-tagged

📈 DNS record-type counts

TXT

AAAA

SOA

📅 First-seen timeline (family)

2026-08

🏷 WHOIS / Registration (local cache)

No cached WHOIS for mail.ru. Resolve & cache.

🏷 Tags

medium-severity auto-tagged

Category	Sanctions
Severity	MEDIUM

📡 DNS Records

Stored (local dns_records) — 15

Type	Value	TTL	Checked
A	`89.221.239.1`	33	2026-08-06
A	`90.156.232.4`	33	2026-08-06
A	`185.180.201.1`	33	2026-08-06
AAAA	`2a14:25c0:9100:b000::1`	46	2026-08-06
AAAA	`2a00:b4c0:9100:b000::1`	46	2026-08-06
AAAA	`2a00:1148:9100:b000::1`	46	2026-08-06
MX	`mxs.mail.ru`	330	2026-08-06
NS	`ns1.mail.ru`	600	2026-08-06
NS	`ns2.mail.ru`	600	2026-08-06
SOA	`ns1.mail.ru`	600	2026-08-06
TXT	`v=spf1 redirect=_spf.mail.ru`	93	2026-08-06
TXT	`_globalsign-domain-verification=x4Mv_wznaGVeJceyWvEwGr5yWx4t6Omvxx4h0ICVAA`	93	2026-08-06
TXT	`HARICA-zOgPcgJHt0kof3WT4rF`	93	2026-08-06
TXT	`HARICA-0D8ZO64AiWoNsbcOYD7`	93	2026-08-06
TXT	`_globalsign-domain-verification=Si3zyfQkRVz-8n5vDXd_qWZ4EmgkzHHeRVFuRGz4IP`	93	2026-08-06

Live (DNS-over-HTTPS · optional augmentation)

Type	Value	TTL
A	`185.180.201.1`	1
A	`90.156.232.4`	1
A	`89.221.239.1`	1
AAAA	`2a00:b4c0:9100:b000::1`	19
AAAA	`2a14:25c0:9100:b000::1`	19
AAAA	`2a00:1148:9100:b000::1`	19
MX	`10 mxs.mail.ru.`	314
NS	`ns2.mail.ru.`	249
NS	`ns1.mail.ru.`	249
TXT	`HARICA-zOgPcgJHt0kof3WT4rF`	106
TXT	`HARICA-0D8ZO64AiWoNsbcOYD7`	106
TXT	`v=spf1 redirect=_spf.mail.ru`	106
TXT	`_globalsign-domain-verification=Si3zyfQkRVz-8n5vDXd_qWZ4EmgkzHHeRVFuRGz4IP`	106
TXT	`_globalsign-domain-verification=x4Mv_wznaGVeJceyWvEwGr5yWx4t6Omvxx4h0ICVAA`	106

🖥 Related IPs (6)

Resolved from local A/AAAA records (augmented with live DoH when reachable). Each pivots to its IP dossier.

89.221.239.1 → 90.156.232.4 → 185.180.201.1 → 2a14:25c0:9100:b000::1 → 2a00:b4c0:9100:b000::1 → 2a00:1148:9100:b000::1 →

🌐 Subdomains — local intel (0)

No subdomains of mail.ru in local intel. Check crt.sh ↗

📡 Reporting Sources (8)

`OFAC SDN List (CSV)`	Sanctions
`OFAC Consolidated (CSV)`	Sanctions
`ORKL Threat Reports API`	Threat Reports
`OFAC SDN (crypto addresses)`	Sanctions
`MISP Galaxy Ransomware`	Ransomware Actors
`OFAC SDN (Treasury)`	Sanctions
`OFAC Consolidated`	Sanctions
`OFAC SDN`	Sanctions

🌐 Same-ASN domains (0)

No ASN linkage in local intel.

🔍 OSINT pivots — external lookups

urlscan.io →VirusTotal →crt.sh (CT) →SecurityTrails →whois (who.is) →DNSDumpster →Shodan →Censys →GreyNoise →URLhaus →ThreatMiner →Web Archive →

🔗 Internal pivots & actions

Advanced Search →OSINT Pivot (30+) →Correlation graph →Link analysis →Passive DNS →DNS Audit →Timeline →Takedown draft →Export STIX/MISP →Add to case →

📁 Case Management

Attach to case

Role

+ New case from this

Every panel resolves local-first: threat, category, first-seen & sightings from indicators; DNS from dns_records; WHOIS from whois_cache; subdomains via bounded suffix match on indicators; related IPs from A/AAAA records; tags, reporting sources and the link graph from the local relations. Live OTX pulses and DNS-over-HTTPS are optional augmentation and their absence never blanks the dossier.

← Domain / URL Index

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

💡 Recommendations

⚙ Automation

DNS audit batch

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Passive DNS OSINT Takedown

URL / Domain Profile