blackshelter.org
Classification: Malicious
blackshelter.org is a malicious hostname. Linked to Socgholish malware. 62 sightings from ThreatFox Abuse.ch and Threat Observatory, last seen 2026-05-05.
Current activity
- Online — resolving/reachable. Last checked 2026-10-17 16:39:09.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: SOCGHOLISH (S1124)
Where it has been seen
Observed by Maltiverse Threat Observatory sensors in CO and HN, across education, financial services and retail networks.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Malicious behavior | Maltiverse Threat Observatory | 2026-05-05 00:01:24 | 2026-05-05 00:01:24 | country_code:co country_code:hn industry:education-and-nonprofits industry:financial-services industry:retail-and-hospitality | |
| Top Popularity Site | Cisco Umbrella | 2025-01-05 20:25:56 | 2025-02-02 19:40:07 | benign | |
| FAKEUPDATES | ThreatFox Abuse.ch | 2024-12-04 10:00:20 | 2024-12-06 09:20:22 | malicious-activity | S1124 SocGholish |
Tags
socgholish fakeupdateIP addresses resolved by this hostname
- 176.119.156.45 (2024-12-04 10:17:05)
- 176.53.147.97 (2025-01-16 13:00:14)
- 185.149.146.171 (2025-02-20 21:26:01)
- 159.89.230.90 (2026-10-17 16:39:09)
Whois information
- AS name
- AS48347 MT FINANCE LLC
- Domain
- blackshelter.org
- TLD
- org
- DNSSEC
- ['unsigned']
- Nameservers
- a.dnspod.com, c.dnspod.com
- Registrant
- Registrar of Domain Names REG.RU LLC
- City
- Moscow
- Country
- RU — Russian Federation 🇷🇺
- Contact email
- [email protected]
- Domain created
- 2024-12-01 17:08:39
- Domain expires
- 2025-12-01 17:08:39
- First indexed
- 2024-12-04 10:17:03
- Last updated
- 2026-10-17 16:39:10