getmadium.net
Classification: Malicious
getmadium.net is a malicious hostname. Linked to Dcrat malware. Reported by Triage and Threat Observatory (DarkCrystalRAT), last seen 2026-08-03. Seen in US.
Current activity
- Online — resolving/reachable. Last checked 2026-10-18 04:40:34.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: DCRAT (S9017)
Where it has been seen
Observed by Maltiverse Threat Observatory sensors in US, across education networks.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| DarkCrystalRAT | Maltiverse Threat Observatory | 2026-08-03 19:10:08 | 2026-08-03 19:10:08 | anomalous-activity country_code:us industry:education-and-nonprofits malware | S9017 DCRAT |
| Dcrat | Triage | 2026-08-03 18:33:18 | 2026-08-03 18:33:18 | malicious-activity | S9017 DCRAT |
Tags
dcrat discovery execution infostealer persistence ransomware ratIP addresses resolved by this hostname
- 104.21.14.16 (2026-10-03 12:38:29)
- 172.67.133.192 (2026-10-03 12:38:29)
- 2606:4700:3035::6815:e10 (2026-10-08 12:35:18)
- 2606:4700:3036::ac43:85c0 (2026-10-08 12:35:18)
- 172.67.148.142 (2026-10-12 06:22:58)
- 104.21.29.67 (2026-10-12 06:22:58)
- 2606:4700:130:436c:6f75:6466:6c61:7265 (2026-10-16 20:37:53)
- 172.64.80.1 (2026-10-18 04:40:34)
- 2606:4700:3037::ac43:948e (2026-10-18 04:40:34)
- 2606:4700:3030::6815:1d43 (2026-10-18 04:40:34)
Whois information
- Domain
- getmadium.net
- TLD
- net
- DNSSEC
- ['unsigned']
- Nameservers
- EVERTON.NS.CLOUDFLARE.COM, KEHLANI.NS.CLOUDFLARE.COM, ARIELLA.NS.CLOUDFLARE.COM, RIDGE.NS.CLOUDFLARE.COM
- Registrant
- GoDaddy.com, LLC
- Contact email
- [email protected]
- Domain created
- 2026-05-03 19:50:54
- Domain expires
- 2027-05-03 19:50:54
- First indexed
- 2026-08-03 18:58:20
- Last updated
- 2026-10-18 04:40:34