VIRUSSIGN
Suspicious CriticalDOMAIN
Quota 48
First seen
Last seen
CONFIDENCE76%VirusSign analysis
FAMILYnxdomainc2
RELATED INDICATORS15Connections in this report
ANALYSISSuspiciousFresh

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Domain
dwninfo.ru
TLD
ru
Root domain
dwninfo.ru
Resolved geo
Secaucus, New Jersey, United States
Resolved IP
173.231.189.15
Country
United States
DGA risk
low
DGA score
39.0
Domain age days
-1.0
Registrar
101DOMAIN-RU

Connected context

Key findings

OBSERVED EVIDENCE
Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (11%).

Confidence signal

VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.

Analysis signals

OBSERVED
Engine detections11%
VirusSign confidence76%
Relationship context15 visible
Threat classificationnxdomain

Explore further connections

Connect an API key with relationship access to explore further connections. Additional queries use credits.

Connect API keyAPI trial

Structured report export

Connect an eligible API key to export the report.

Connect API keyAPI trial
EXPORT & SHARE

Put this intelligence to work

Export this report or share its findings with your team.

Export & share

Website JSON and CSV exports include this report’s data. The website STIX export includes up to 50 indicators and their reported verdicts.

Use intelligence in your workflow

The website shows selected findings. Evaluate API access for your tools and security workflows.

API trial
Help improve this report Report false positive Report incorrect data

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.