rref.su
Classification: Malicious
rref.su is a malicious hostname. Linked to Emotet malware. Reported by URLhaus Abuse.ch and ThreatFox Abuse.ch (Malware Download), last seen 2023-03-14.
Current activity
- Online — resolving/reachable. Last checked 2026-11-06 20:36:42.
- Command & Control server — Used by cybercriminals to control victim computers.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: EMOTET (S0367)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Malware Download | URLhaus Abuse.ch | 2023-03-14 10:18:40 | 2023-03-14 10:18:40 | malicious-activity malware | |
| Emotet | ThreatFox Abuse.ch | 2023-03-09 11:17:39 | 2023-03-09 11:17:39 | botnet malicious-activity | S0367 Emotet |
Tags
malware_download geodo heodoIP addresses resolved by this hostname
- 89.253.223.216 (2015-05-27 00:00:00)
- 89.253.228.190 (2023-03-20 02:59:00)
- 90.156.201.36 (2013-04-12 00:00:00)
- 2606:4700:3033::ac43:be06 (2026-11-01 08:38:03)
- 2606:4700:3032::6815:497b (2026-11-01 08:38:03)
- 172.64.80.1 (2026-11-06 20:36:42)
- 2606:4700:130:436c:6f75:6466:6c61:7265 (2026-11-06 20:36:42)
Whois information
- AS name
- AS41535 Rusonyx, Ltd.
- Domain
- rref.su
- TLD
- su
- Nameservers
- justin.ns.cloudflare.com., kallie.ns.cloudflare.com.
- Registrant
- RUCENTER-SU
- Domain created
- 2023-11-09 13:06:48
- Domain expires
- 2026-11-09 13:06:48
- First indexed
- 2023-03-09 11:17:39
- Last updated
- 2026-11-06 20:36:42