- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- Domain
- firma.org
- TLD
- org
- Root domain
- firma.org
- Resolved IP
- 104.21.31.202
- DGA risk
- low
- DGA score
- 7.0
- Domain age days
- 2456.0
- Registrar
- Dynadot Inc
- Created
- 2020-02-19T14:30:21Z
- Expiry
- 2027-02-19T14:30:21Z
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Relationship context
10 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections5%
Relationship context10 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
88%
high
peexe
121904 bytes
communicates
Filename
smnss.exe
Family
mydoom
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
79%
critical
peexe
943616 bytes
communicates
Filename
d955e4409f523b292552e3e8b433589f.virus
Family
buzus
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
92%
high
peexe
121376 bytes
communicates
Filename
.
Family
mydoom
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
91%
high
peexe
22016 bytes
communicates
Filename
Notice.txt …
Family
netsky
Type
worm
File type
peexe
MIME
application/vnd.microsoft.portable-executable
88%
critical
pedll
26624 bytes
communicates
Filename
0a9ffa57d65083c92e0d3d69b00f2f0d
Family
netsky
Type
worm
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Related domains
Domains associated with this indicator.
5shown
.org
contains
Root
firma.org
TLD
org
Subdomain
venus
First seen
2018-08-06T19:25:41Z
Last seen
2026-04-30T04:23:08Z
.org
contains
Root
firma.org
TLD
org
Subdomain
strasbourg
First seen
2026-02-03T19:50:39Z
Last seen
2026-04-30T04:23:08Z
.org
contains
Root
firma.org
TLD
org
Subdomain
roubaix
First seen
2026-02-03T19:50:39Z
Last seen
2026-04-30T04:23:08Z
.org
contains
Root
firma.org
TLD
org
Subdomain
montreal
First seen
2026-02-03T19:50:39Z
Last seen
2026-04-30T04:23:08Z
.org
contains
Root
firma.org
TLD
org
Subdomain
merkur
First seen
2018-07-27T16:31:50Z
Last seen
2026-04-30T04:23:08Z
Analysis details
Severity: low
Freshness: Fresh · Last seen today.
- Detection rate
- 5%
- detection
- 5 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- Domain
- firma.org
- TLD
- org
- Root domain
- firma.org
- Resolved IP
- 104.21.31.202
- DGA risk
- low
- DGA score
- 7.0
- Domain age days
- 2456.0
- Registrar
- Dynadot Inc
- Created
- 2020-02-19T14:30:21Z
- Expiry
- 2027-02-19T14:30:21Z
- First seen
- 2023-09-30T01:40:42Z
- Last seen
- 2026-11-11T01:14:18Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Relationship context
10 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
11 timestamped observations are arranged from 2004-03-20 to 2026-02-03. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
2 relationship group(s) provide pivot and infrastructure context.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Domain profile
summarySelected domain intelligence summary.
- Root domain
- firma.org
- Resolved IP
- 104.21.31.202
- DGA risk
- low
- DGA score
- 7.0
- Domain age days
- 2456.0
- Registrar
- Dynadot Inc
- Created
- 2020-02-19T14:30:21Z
- Expiry
- 2027-02-19T14:30:21Z
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS intelligence5+
0 IPs0 domains
- 5+ passive DNS records
- 1 DNS records
- 0 unique IPs
- 0 related domains
View details · 3 shown
- Type
- A
- Type
- AAAA
- Type
- NS
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- firma.org
- Issuer
- WE1