- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- Domain
- extensionsnewtab.com
- TLD
- com
- Root domain
- extensionsnewtab.com
- Resolved geo
- *privacy*, *privacy*, US
- Country
- US
- DGA risk
- low
- DGA score
- 23.0
- Domain age days
- 3247.0
- Registrar
- Amazon Registrar, Inc.
- Created
- 2017-12-20T16:05:29Z
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Threat context
Classification includes type malware.
Analysis signals
OBSERVEDEngine detections5%
Relationship context9 visible
Threat classificationmalware
Intelligence freshnessAging
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
15%
high
zip
7391768 bytes
communicates
Filename
EmailLogin-1003020.app.zip
Type
adware
File type
zip
MIME
application/zip
Size
7391768
0%
zip
7392701 bytes
communicates
Filename
emaillogin-358531.zip
File type
zip
MIME
application/zip
Size
7392701
SHA1
09096713d6ce23a3938103061f21247d8941ff07
0%
zip
7342733 bytes
communicates
Filename
EmailLogin.zip
File type
zip
MIME
application/zip
Size
7342733
SHA1
5190888346c2f9e16803298383e7b2daa4cb28d7
0%
zip
7484034 bytes
communicates
Filename
WeatherRadar-1679047.app.zip
File type
zip
MIME
application/zip
Size
7484034
SHA1
a97624eba3a468481df3057e272628d7928b7ea0
0%
zip
7600733 bytes
communicates
Filename
PackagesTracker-696702.app.zip
File type
zip
MIME
application/zip
Size
7600733
SHA1
5a580637f25f06c372652810518322aa68240028
Related domains
Domains associated with this indicator.
4shown
.com
contains
Root
extensionsnewtab.com
TLD
com
Subdomain
www2
First seen
2018-11-28T10:01:56Z
Last seen
2026-05-11T03:12:19Z
.com
contains
Root
extensionsnewtab.com
TLD
com
Subdomain
www1
First seen
2025-11-18T08:29:13Z
Last seen
2026-05-11T03:12:19Z
5%
low
.com
contains
Root
extensionsnewtab.com
TLD
com
Subdomain
www
First seen
2025-09-09T17:52:46Z
Last seen
2026-10-01T00:42:44Z
5%
low
.com
contains
Root
extensionsnewtab.com
TLD
com
First seen
2023-10-14T10:54:13Z
Last seen
2026-10-01T00:42:44Z
Analysis details
Severity: lowmalware
Freshness: Aging · Last seen 40 days ago.
- Detection rate
- 5%
- Threat type
- malware
- detection
- 5 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- Domain
- extensionsnewtab.com
- TLD
- com
- Root domain
- extensionsnewtab.com
- Resolved geo
- *privacy*, *privacy*, US
- Country
- US
- DGA risk
- low
- DGA score
- 23.0
- Domain age days
- 3247.0
- Registrar
- Amazon Registrar, Inc.
- Created
- 2017-12-20T16:05:29Z
- Expiry
- 2026-12-20T16:05:29Z
- First seen
- 2023-10-14T10:54:13Z
- Last seen
- 2026-10-01T00:42:44Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Threat context
Classification includes type malware.
Relationship context
9 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
10 timestamped observations are arranged from 2017-12-20 to 2025-11-18. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map. 1 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
2 relationship group(s) provide pivot and infrastructure context.
Classification context: type malware.
Last seen 40 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Domain profile
summarySelected domain intelligence summary.
- Root domain
- extensionsnewtab.com
- Resolved geo
- *privacy*, *privacy*, US
- Country
- US
- DGA risk
- low
- DGA score
- 23.0
- Domain age days
- 3247.0
- Registrar
- Amazon Registrar, Inc.
- Created
- 2017-12-20T16:05:29Z
- Expiry
- 2026-12-20T16:05:29Z
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS intelligence5
0 IPs0 domains
- 4 passive DNS records
- 1 DNS records
- 0 unique IPs
- 0 related domains
View details · 1 shown
- Type
- NS
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- *.extensionsnewtab.com
- Issuer
- Amazon RSA 2048 M04