ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain endpointmapperprocess.com.

Database Entry


IOC ID:1778198
IOC: endpointmapperprocess.com
IOC Type :domain
Threat Type :payload_delivery
Malware: BumbleBee
Malware alias:COLDTRAIN, SHELLSTING, Shindig
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS62005 BV-EU-AS
Country:- EE
First seen:2026-03-29 14:01:16 UTC
Last seen:never
UUID:e826b497-2b08-11f1-9af6-42010aa4000a
Reporter Lenny_3BO
Reward 5 credits from ThreatFox
Tags:BlueVPS decoy_404 Iceland_WHOIS Namecheap
Reference: https://www.virustotal.com/gui/domain/endpointmapperprocess.com

Avatar
Lenny_3BO
Operator domain on 91.236.230.220 (BlueVPS AS62005). Namecheap, Iceland WHOIS. Fake ERORR 404 decoy page. Name mimics Windows RPC endpoint mapper. 4/76 VT. Registered 2024-12-26. Previously co-hosted with payables-wellsfargo.com. Linked to iOS Safari WebKit exploit campaign.