12301230.co
Classification: Malicious
12301230.co is a malicious hostname. Linked to Redline Stealer, Ransomhub malware. 15 sightings, last seen 2025-04-04. Resolves to 35.225.36.88 and 11 more.
Current activity
- Offline — no longer resolving. Last online 2025-07-10 03:08:37.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: REDLINE STEALER (S1240) RANSOMHUB (S1212)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Ransomhub | Maltiverse Threat Observatory | 2024-11-01 14:54:54 | 2025-04-04 00:40:06 | S1212 RansomHub | |
| Generic Malware | Maltiverse Threat Observatory | 2024-11-01 15:03:19 | 2024-11-01 15:14:11 | ||
| RedLine Stealer | ThreatFox Abuse.ch | 2023-09-16 08:56:31 | 2023-09-18 08:18:19 | malicious-activity | S1240 RedLine Stealer |
IP addresses resolved by this hostname
- 35.225.36.88 (2024-10-29 17:05:01)
- 34.70.133.246 (2024-10-29 17:05:01)
- 107.178.223.183 (2024-11-07 08:17:38)
- 104.155.138.21 (2024-11-07 08:17:38)
- 50.17.207.246 (2024-09-27 01:02:23)
- 23.22.122.205 (2024-09-27 01:02:23)
- 2600:1900:4000:189e:8000:2:12b:503a (2025-07-01 04:00:11)
- 34.159.223.43 (2025-07-01 04:00:11)
- 2600:1900:40d1:346:8000:2:12b:503a (2025-07-01 04:00:11)
- 2600:1900:4001:96e:8000:0:12b:503a (2025-07-03 12:00:06)
- 34.41.139.193 (2025-07-09 08:00:08)
- 2600:1900:4001:96e:8000:1:12b:503a (2025-07-09 08:00:08)
Whois information
- AS name
- AS396982 Google LLC
- Domain
- 12301230.co
- TLD
- co
- DNSSEC
- ['unsigned']
- Nameservers
- ns1.hwrn.net, ns2.hwrn.net
- Registrant
- Dynadot Inc
- Address
- REDACTED FOR PRIVACY
- City
- REDACTED FOR PRIVACY
- State
- California
- Country
- US — United States 🇺🇸
- Contact email
- [email protected]
- Domain created
- 2024-09-28 09:29:45
- Domain expires
- 2025-09-28 09:29:45
- First indexed
- 2023-09-16 09:17:03
- Last updated
- 2026-09-28 09:12:53