poppresbyschool.com
Classification: Suspicious
poppresbyschool.com is a suspicious hostname. Linked to Qakbot malware. Reported by 2 threat sources, last seen 2022-12-19.
Current activity
- Online — resolving/reachable. Last checked 2025-11-24 00:41:45.
- Command & Control server — Used by cybercriminals to control victim computers.
MITRE ATT&CK associations
Malware families: QAKBOT (S0650)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| QakBot | ThreatFox Abuse.ch | 2022-10-21 10:19:59 | 2022-12-19 22:19:58 | malicious-activity | S0650 QakBot |
| Malware Download | URLhaus Abuse.ch | 2022-10-20 21:15:39 | 2022-12-19 22:15:57 | malicious-activity |
Tags
bb11 iso qakbot qbot quakbot tr tr23 zip oakboat pinkslipbot malware_download bb04 nh833IP addresses resolved by this hostname
- 208.91.199.18 (2022-11-20 12:25:11)
- 2a02:4780:b:1678:0:32e5:b368:2 (2025-11-24 00:41:45)
- 156.67.75.177 (2025-11-24 00:41:45)
Whois information
- AS name
- AS394695 PDR
- Domain
- poppresbyschool.com
- TLD
- com
- DNSSEC
- ['unsigned']
- Nameservers
- NS1.DNS-PARKING.COM, NS2.DNS-PARKING.COM
- Registrant
- HOSTINGER operations, UAB
- Contact email
- [email protected]
- Domain created
- 2022-07-06 19:35:46
- Domain expires
- 2026-07-06 19:35:46
- First indexed
- 2022-10-20 21:15:39
- Last updated
- 2025-11-24 00:41:49