fast-api.thelist2win.org
Classification: Malicious
fast-api.thelist2win.org is a malicious hostname. Linked to Socgholish malware. Reported by ThreatFox Abuse.ch (FAKEUPDATES), last seen 2026-10-08.
Current activity
- Online — resolving/reachable. Last checked 2026-10-17 16:40:10.
- Command & Control server — Used by cybercriminals to control victim computers.
MITRE ATT&CK associations
Malware families: SOCGHOLISH (S1124)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| FAKEUPDATES | ThreatFox Abuse.ch | 2026-10-08 17:08:58 | 2026-10-08 17:25:09 | botnet compromised malicious-activity | S1124 SocGholish |
Tags
socgholish fakeupdate gholoaderIP addresses resolved by this hostname
- 89.117.172.78 (2026-10-17 16:40:10)
Whois information
- Domain
- thelist2win.org
- TLD
- org
- DNSSEC
- ['unsigned']
- Nameservers
- ns1.dreamhost.com, ns2.dreamhost.com, ns3.dreamhost.com
- Registrant
- DreamHost, LLC
- Contact email
- [email protected]
- Domain created
- 2023-12-26 16:12:32
- Domain expires
- 2026-12-26 16:12:32
- First indexed
- 2026-10-08 17:25:09
- Last updated
- 2026-10-17 16:40:10