vx-underground.org

Classification: Malicious

vx-underground.org is a malicious hostname. Linked to Asyncrat, Qilin malware. 23 sightings from Triage and Threat Observatory, last seen 2026-09-24.

Current activity

  • Offline — no longer resolving. Last online 2026-10-09 20:11:06.
  • Malware distribution — This indicator is distributing malware.

MITRE ATT&CK associations

Malware families: ASYNCRAT (S1087) QILIN (S1242) CHAOS (S0220)

Where it has been seen

Observed by Maltiverse Threat Observatory sensors in AR, BR and US, across financial services, technology and transportation networks.

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Maltiverse Threat Observatory 2026-09-24 14:10:13 2026-09-24 14:10:13 anomalous-activity country_code:ar country_code:br country_code:us industry:financial-services industry:technology-and-telecommunications industry:transportation-and-logistics malware
Xenorat Triage 2026-09-24 13:45:39 2026-09-24 13:45:39 malicious-activity
Chaos Triage 2026-08-04 19:04:01 2026-08-04 19:04:01 malicious-activity S0220 Chaos
Collects_stealer Triage 2026-07-25 23:06:30 2026-07-25 23:06:30 malicious-activity
Agenda Triage 2026-05-30 03:17:21 2026-05-30 03:17:21 malicious-activity S1242 Qilin
Dharma Triage 2026-05-21 12:56:24 2026-05-21 12:56:24 malicious-activity
Asyncrat Triage 2026-05-14 04:58:01 2026-05-14 04:58:01 malicious-activity S1087 AsyncRAT
Malicious URL Triage 2026-02-11 17:59:45 2026-03-24 08:26:50 malicious-activity
Redline Triage 2026-03-01 10:08:11 2026-03-22 14:44:25 malicious-activity
Lockbit Triage 2026-02-18 19:56:09 2026-02-18 19:56:09 compromised malicious-activity

Tags

adware defense_evasion discovery persistence ransomware spyware blackmatter lockbit redline 123 infostealer stealer installer privilege_escalation noid execution trojan asyncrat default rat dharma credential_access impact agenda collects_stealer chaos evasion xenorat

IP addresses resolved by this hostname

Whois information

Domain
vx-underground.org
TLD
org
DNSSEC
['unsigned']
Nameservers
lloyd.ns.cloudflare.com, paige.ns.cloudflare.com
Registrant
Cloudflare, Inc.
Contact email
[email protected], [email protected]
Domain created
2019-05-19 19:37:30
Domain expires
2033-05-19 19:37:30
First indexed
2026-02-11 19:00:36
Last updated
2026-10-09 20:11:06