- First seen
- Last seen
THREAT SIGNALNot assessed
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe analysis is based on the intelligence signals currently available for this indicator.
- Domain
- 6af3227a926b60443dfa4412.imgix.net
- TLD
- net
- Root domain
- imgix.net
- Subdomain
- 6af3227a926b60443dfa4412
- Resolved geo
- United States
- Resolved IP
- 2a04:4e42::720
- Country
- United States
- DGA risk
- low
- DGA score
- 36.0
- Domain age days
- 5623.0
Connected context
Key findings
OBSERVED EVIDENCEDetection signal
No verdict
Threat context
Classification includes family hex.
Relationship context
7 related indicators are shown across 2 relationship group(s).
Analysis signals
OBSERVEDRelationship context7 visible
Threat classificationhex
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
4shown
17%
high
powershell
2268 bytes
communicates
Filename
a5dca4d9_rad50b16.tmp.ps1.bin
Family
invokerbot
Type
trojan
File type
powershell
MIME
text/plain
42%
high
text
353140 bytes
communicates
Filename
ad43ccc2_quotation and sample specifications.vbs.bin
Family
asyncrat
Type
trojan
File type
text
MIME
text/plain
50%
high
text
332940 bytes
communicates
Filename
ed2a4300_gajcbvtj.vbs.bin
Family
asyncrat
Type
trojan
File type
text
MIME
text/plain
45%
critical
vba
321484 bytes
communicates
Filename
297502c0_email address authentication.vbs.bin
Family
asyncrat
Type
trojan
File type
vba
MIME
text/plain
Related URLs
URLs associated with this indicator.
3shown
5%
low
contains
TLD
net
HTTP status
200
Content length
3666428
Content SHA256
e9e5f91db6238de6b51f9e5dda898eb2881d0c19503b18bd4f5580f676cfaab4
First seen
2026-11-13T15:56:59Z
0%
contains
TLD
net
HTTP status
200
Content length
3297660
Content SHA256
cf331031b1cf4342b0d35ed1cb05d2a77b64b847e6c0bda76839f381c5d648dc
First seen
2026-11-11T15:29:55Z
0%
contains
TLD
net
HTTP status
200
Content length
3297660
Content SHA256
cf331031b1cf4342b0d35ed1cb05d2a77b64b847e6c0bda76839f381c5d648dc
First seen
2026-11-11T15:41:13Z
Analysis details
hex
Freshness: Fresh · Last seen today.
- Family
- hex
Overview
- Domain
- 6af3227a926b60443dfa4412.imgix.net
- TLD
- net
- Root domain
- imgix.net
- Subdomain
- 6af3227a926b60443dfa4412
- Resolved geo
- United States
- Resolved IP
- 2a04:4e42::720
- Country
- United States
- DGA risk
- low
- DGA score
- 36.0
- Domain age days
- 5623.0
- Registrar
- ['GANDI SAS', 'Gandi SAS']
- Created
- 2011-06-23T01:52:27Z
- Expiry
- 2028-06-23T01:52:27Z
- First seen
- 2026-05-21T17:37:55Z
- Last seen
- 2026-11-14T00:31:52Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Detection signal
No verdict
Threat context
Classification includes family hex.
Relationship context
7 related indicators are shown across 2 relationship group(s).
Observation timeline
8 timestamped observations are arranged from 2011-06-23 to 2026-11-13. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map. 1 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The analysis is based on the intelligence signals currently available for this indicator.
2 relationship group(s) provide pivot and infrastructure context.
Classification context: family hex.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Domain profile
summarySelected domain intelligence summary.
- Root domain
- imgix.net
- Subdomain
- 6af3227a926b60443dfa4412
- Resolved IP
- 2a04:4e42::720
- Resolved geo
- United States
- Country
- United States
- DGA risk
- low
- DGA score
- 36.0
- Domain age days
- 5623.0
- Registrar
- ['GANDI SAS', 'Gandi SAS']
- Created
- 2011-06-23T01:52:27Z
- Expiry
- 2028-06-23T01:52:27Z
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS intelligence5+
0 IPs0 domains
- 5+ passive DNS records
- 1 DNS records
- 0 unique IPs
- 0 related domains
View details · 3 shown
- Type
- A
- Type
- AAAA
- Type
- CNAME
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- *.imgix.com
- Issuer
- GlobalSign Atlas R46 DV TLS CA 2026 Q3