wfsdragon.ru
Classification: Malicious
wfsdragon.ru is a malicious hostname. Linked to Redline Stealer malware. 13 sightings from 3 threat sources (Privateloader, Socelars), last seen 2025-06-21.
Current activity
- Online — resolving/reachable. Last checked 2026-10-17 20:39:10.
MITRE ATT&CK associations
Malware families: REDLINE STEALER (S1240)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Socelars | Maltiverse Threat Observatory | 2025-05-26 23:00:19 | 2025-06-21 14:20:08 | ||
| Privateloader | Maltiverse Threat Observatory | 2025-03-10 00:02:31 | 2025-05-24 00:02:46 | ||
| RedLine Stealer | ThreatFox Abuse.ch | 2022-08-25 13:18:56 | 2022-08-25 13:18:56 | malicious-activity | S1240 RedLine Stealer |
| Malware site | Hybrid-Analysis | 2022-01-10 06:15:12 | 2022-01-13 11:00:26 | ||
| Gen:Variant.Strictor | Hybrid-Analysis | 2021-12-24 09:05:20 | 2021-12-24 09:05:20 | ||
| Trojan.Fabookie | Hybrid-Analysis | 2021-11-23 15:16:22 | 2021-11-23 15:16:22 | ||
| Gen:Variant.Fragtor | Hybrid-Analysis | 2021-11-01 08:00:05 | 2021-11-01 08:00:05 | ||
| Gen:Variant.MSILHeracles | Hybrid-Analysis | 2021-09-27 23:00:30 | 2021-09-27 23:00:30 | ||
| Mal_HPGen | Hybrid-Analysis | 2021-08-15 05:15:15 | 2021-08-15 05:15:15 | ||
| Gen:Variant.Cerbu | Hybrid-Analysis | 2021-07-24 10:00:21 | 2021-07-24 10:00:21 |
IP addresses resolved by this hostname
- 172.67.133.215 (2021-07-24 10:00:21)
- 104.21.5.208 (2021-07-24 10:00:21)
- 104.247.81.99 (2026-10-17 20:39:10)
Whois information
- Domain
- wfsdragon.ru
- TLD
- ru
- Nameservers
- ns1.parkingcrew.net., ns2.parkingcrew.net.
- Registrant
- OPENPROV-RU
- Domain created
- 2025-01-28 14:13:27
- Domain expires
- 2027-01-28 14:13:27
- First indexed
- 2021-07-24 10:00:21
- Last updated
- 2026-10-17 20:39:10