witra.ru

Classification: Malicious

witra.ru is a malicious hostname. Linked to Smoke Loader malware. Reported by ThreatFox Abuse.ch (SmokeLoader), last seen 2021-12-06.

Current activity

Online — resolving/reachable. Last checked 2026-10-17 16:37:28.

MITRE ATT&CK associations

Malware families: SMOKE LOADER (S0226)

Blacklist sightings

Description	Source	First seen	Last seen	Labels	MITRE ATT&CK
Top Popularity Site	Cisco Umbrella	2024-07-28 11:18:05	2025-05-11 19:22:42	benign
SmokeLoader	ThreatFox Abuse.ch	2021-12-04 06:53:54	2021-12-06 00:07:18	malicious-activity	S0226 Smoke Loader

Tags

dofoil sharik smoke smoke loader

IP addresses resolved by this hostname

91.189.114.12 (2021-12-05 00:05:11)
2a00:f940:4::152 (2025-04-21 11:17:03)
194.58.112.165 (2025-04-21 11:17:03)
95.163.244.134 (2026-10-17 16:37:28)

Whois information

AS name: AS42399 Hosting Center LLC
Domain: witra.ru
TLD: ru
Nameservers: ns1.shop.reg.ru., ns2.shop.reg.ru., ns1.reg.ru., ns2.reg.ru.
Registrant: REGRU-RU
Domain created: 2022-12-13 15:01:37
Domain expires: 2026-12-13 15:01:37
First indexed: 2021-12-05 00:05:11
Last updated: 2026-10-17 16:37:28