Resolves to 172.66.147.243, 104.20.23.154.
- NXDOMAIN
- false
- A records
- 172.66.147.243, 104.20.23.154
Verdict
LIKELY BENIGNHigh confidence
3Supporting signals
3Independent sources
1Recent observations
5 / 100Threat score
Why the engine decided this
Deterministic engine · activity none- OTX_KNOWN_FALSE_POSITIVE AlienVault OTX marks the indicator as a known false positive or whitelisted.
- POPULAR_DOMAIN Domain is among the most popular domains (Tranco top 10,000).
Key indicators
- Domain
- example.com
- Resolves to
- 172.66.147.243, 104.20.23.154
- Registered
- 1995-08-14
- Domain age
- 11372 days
- Tranco rank
- #169
- First seen
- Not reported by any source
- Last seen
- 2026-10-02 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| Tranco | example.com is ranked #169 among popular domains. | — | — | Benign |
 AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
 VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| DNS | Resolves to 172.66.147.243, 104.20.23.154. | — | 0 days recent | Context |
 RDAP | example.com registered 1995-08-14. | — | — | Context |
 urlscan.io | 20 public urlscan.io scan(s), the latest today, with no malicious verdict. | — | 0 days recent | Context |
| Internet Archive | The Internet Archive has captures of example.com since 2002-01-20. | — | — | Neutral |
Coverage · checked, no record: ThreatFox, URLhaus, OpenPhish · failed: none
Analyst summary
Consistent with engineThis domain is likely benign (high confidence). example.com is ranked #169 among popular domains.
Why the evidence points to likely benign
- [Tranco] example.com is ranked #169 among popular domains.
- [AlienVault OTX] Marked as a known false positive or whitelisted.
- [VirusTotal] No vendor flags it (0 of 91).
Evidence reflects public intelligence at investigation time; it may change.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context only- StealthWorker/GoBrut (The adversary demonstrates advanced telemetry suppression within specialized sThreat actor · AlienVault OTX · Direct
- Artificial IntelligenceThreat actor · AlienVault OTX · Direct
ATT&CK techniques reported
T1003 OS Credential DumpingT1057 Process DiscoveryT1071 Application Layer ProtocolT1105 Ingress Tool TransferT1480 Execution GuardrailsT1071.001 Web ProtocolsT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1218 System Binary Proxy ExecutionT1059 Command and Scripting InterpreterT1566 PhishingT1114 Email CollectionT1189 Drive-by Compromise
Reported targets: Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In, Media, LGBTQ+ Activists, Technology, Telecommunications, Hospitality, Energy, NGO, China, United States of America, Spain, Japan, Canada, Bahrain, Israel, India, United Kingdom of Great Britain and Northern Ireland, Taiwan
Reports mentioning it
- 2026-09-29 LinkedIN • Google Cloud IP Scheme | Server Hello with Downgrade Request
- 2026-09-29 Microsoft Phishing Collection
- 2026-09-27 Catrobat Oura PD Health Spyware: right under the acceptable use policy but after the unbecoming of a public pro.
- 2026-09-27 Catrobat Oura PD Health Spyware: right under the acceptable use policy but after the unbecoming of a public pro.
- 2026-09-27 Catrobat Oura PD Health Spyware: right under the acceptable use policy but after the unbecoming of a public pro.
All evidence
10 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| Tranco | example.com is ranked #169 among popular domains. | — | — | Benign |
| AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
| VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| DNS | Resolves to 172.66.147.243, 104.20.23.154. | — | 0 days recent | Context |
| RDAP | example.com registered 1995-08-14. | — | — | Context |
| urlscan.io | 20 public urlscan.io scan(s), the latest today, with no malicious verdict. | — | 0 days recent | Context |
| Internet Archive | The Internet Archive has captures of example.com since 2002-01-20. | — | — | Neutral |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| OpenPhish | No record. | — | — | No record |
Engine rules applied
- OTX_KNOWN_FALSE_POSITIVEAlienVault OTX marks the indicator as a known false positive or whitelisted.
- POPULAR_DOMAINDomain is among the most popular domains (Tranco top 10,000).
Analyst summary
Consistent with engineThis domain is likely benign (high confidence). example.com is ranked #169 among popular domains.
Why the evidence points to likely benign
- [Tranco] example.com is ranked #169 among popular domains.
- [AlienVault OTX] Marked as a known false positive or whitelisted.
- [VirusTotal] No vendor flags it (0 of 91).
Evidence reflects public intelligence at investigation time; it may change.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- Domain
- example.com
- Resolves to
- 172.66.147.243, 104.20.23.154
- Registered
- 1995-08-14
- Domain age
- 11372 days
- Tranco rank
- #169
- First seen
- Not reported by any source
- Last seen
- 2026-10-02 (0 days before)
Latest public scan
urlscan.io
- Page title
- Example Domain
- Final URL
- https://example.com/
- urlscan verdict
- No malicious verdict (2 checked)
- Public scans
- 20, since 2026-10-02
IOCSCAPE never visits the page; this is a scan another urlscan.io user ran and made public.
Related indicators
- 172.66.147.243Resolved address
- 104.20.23.154Resolved address
By source
RDAPexample.com registered 1995-08-14.
- Domain
- example.com
- Expires
- 2027-08-13
- Registered
- 1995-08-14
The Internet Archive has captures of example.com since 2002-01-20.
- Domain
- example.com
- First capture
- 2002-01-20
urlscan.io20 public urlscan.io scan(s), the latest today, with no malicious verdict.
- Scans
- 20
- Title
- Example Domain
- Status
- 200
- Final URL
- https://example.com/
- Server IP
- 104.20.23.154
- First scan
- 2026-10-02
- Malicious scans
- 0
- Verdicts checked
- 2
example.com is ranked #169 among popular domains.
- Rank
- 169
- Domain
- example.com
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
The evidence does not establish who operates this indicator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context only- StealthWorker/GoBrut (The adversary demonstrates advanced telemetry suppression within specialized sThreat actor · AlienVault OTX · Direct
- Artificial IntelligenceThreat actor · AlienVault OTX · Direct
ATT&CK techniques reported
T1003 OS Credential DumpingT1057 Process DiscoveryT1071 Application Layer ProtocolT1105 Ingress Tool TransferT1480 Execution GuardrailsT1071.001 Web ProtocolsT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1218 System Binary Proxy ExecutionT1059 Command and Scripting InterpreterT1566 PhishingT1114 Email CollectionT1189 Drive-by Compromise
Reported targets: Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In, Media, LGBTQ+ Activists, Technology, Telecommunications, Hospitality, Energy, NGO, China, United States of America, Spain, Japan, Canada, Bahrain, Israel, India, United Kingdom of Great Britain and Northern Ireland, Taiwan
Reports mentioning it
- 2026-09-29 LinkedIN • Google Cloud IP Scheme | Server Hello with Downgrade Request
- 2026-09-29 Microsoft Phishing Collection
- 2026-09-27 Catrobat Oura PD Health Spyware: right under the acceptable use policy but after the unbecoming of a public pro.
- 2026-09-27 Catrobat Oura PD Health Spyware: right under the acceptable use policy but after the unbecoming of a public pro.
- 2026-09-27 Catrobat Oura PD Health Spyware: right under the acceptable use policy but after the unbecoming of a public pro.
Evidence timeline
- 2026-10-02DNS: Resolves to 172.66.147.243, 104.20.23.154
- 2026-10-02VirusTotal: No vendor flags it (0 of 91)
- 2026-10-02urlscan: 20 public urlscan.io scan(s), the latest today, with no malicious verdict
- 2026-10-02Investigated
Recommended next steps
- contextExamine the specific URL or content in the alert, not only the domain.
Pivot to other tools
Opens the indicator in the source's own site (new tab).
Investigate related indicators
- 172.66.147.243Resolved address
- 104.20.23.154Resolved address