mail.blog

Classification: Malicious

mail.blog is a malicious hostname. Linked to Remsec, Cobalt Strike malware. Reported by 1 threat source, last seen 2023-08-22.

Current activity

  • Online — resolving/reachable. Last checked 2026-09-21 00:39:14.

MITRE ATT&CK associations

Malware families: REMSEC (S0125) COBALT STRIKE (S0154)

Intrusion sets: DARKHOTEL (G0012) BRONZE BUTLER (G0060) TURLA (G0010) LEVIATHAN (G0065) MUDDYWATER (G0069)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Nitro Maltiverse 2023-08-21 04:13:35 2023-08-22 20:40:46 malicious-activity
Darkhotel Maltiverse 2023-08-21 04:13:37 2023-08-22 20:40:14 malicious-activity G0012 Darkhotel
Ice Fog Maltiverse 2023-08-21 04:13:39 2023-08-22 20:39:41 malicious-activity
Projectsauron Maltiverse 2023-08-21 04:13:41 2023-08-22 20:39:09 malicious-activity S0125 Remsec
Cobalt Strike Maltiverse 2023-08-21 04:13:43 2023-08-22 20:38:35 malicious-activity S0154 Cobalt Strike
Tick Maltiverse 2023-08-21 04:13:46 2023-08-22 20:38:02 malicious-activity G0060 BRONZE BUTLER
Turla Maltiverse 2023-08-21 04:13:48 2023-08-22 20:37:30 malicious-activity G0010 Turla
Careto Maltiverse 2023-08-21 04:13:50 2023-08-22 20:36:56 malicious-activity
Leviathan Maltiverse 2023-08-21 04:13:53 2023-08-22 20:36:22 malicious-activity G0065 Leviathan
Muddywater Maltiverse 2023-08-21 04:13:55 2023-08-22 20:35:49 malicious-activity G0069 MuddyWater
Fastcash Maltiverse 2023-08-21 04:13:58 2023-08-22 20:35:15 malicious-activity
Predatory Sparrow Maltiverse 2023-08-21 04:14:00 2023-08-22 20:34:40 malicious-activity

Tags

apt

IP addresses resolved by this hostname

Whois information

Domain
mail.blog
TLD
blog
First indexed
2023-08-22 20:34:40
Last updated
2026-09-21 00:39:14