- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- Domain
- kafeprog7.com
- TLD
- com
- Root domain
- kafeprog7.com
- Resolved geo
- United States
- Resolved IP
- 222.167.226.87
- Country
- United States
- DGA risk
- low
- DGA score
- 44.0
- Domain age days
- 181.0
- Registrar
- MAT BAO CORPORATION
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 12. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 38%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections38%
VirusSign confidence100%
Relationship context12 visible
Threat classificationphishing
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
20%
high
powershell
631252 bytes
communicates
Filename
start.ps1
Family
powershell
Type
trojan
File type
powershell
MIME
text/plain
15%
high
powershell
619751 bytes
communicates
Filename
start.ps1
Family
powershell
Type
trojan
File type
powershell
MIME
text/plain
32%
high
powershell
581668 bytes
communicates
Filename
start.ps1
Family
powershell
Type
trojan
File type
powershell
MIME
text/plain
10%
high
powershell
639665 bytes
communicates
Filename
start.ps1
Family
powershell
Type
trojan
File type
powershell
MIME
text/plain
35%
high
powershell
602063 bytes
communicates
Filename
start.ps1
Family
powershell
Type
trojan
File type
powershell
MIME
text/plain
Related domains
Domains associated with this indicator.
2shown
26%
high
.com
contains
Root
kafeprog7.com
TLD
com
Subdomain
www
First seen
2026-07-16T15:41:36Z
Last seen
2026-08-30T23:29:27Z
38%
high
.com
contains
Root
kafeprog7.com
TLD
com
First seen
2026-05-18T21:45:47Z
Last seen
2026-11-13T12:09:49Z
Related URLs
URLs associated with this indicator.
5shown
36%
high
contains
TLD
com
HTTP status
405
Content length
31
Content SHA256
83c09ba9a8daedb136f90b17a294caa90ad471a016e430df6e229acb5a81e100
First seen
2026-11-13T04:46:52Z
33%
high
contains
TLD
com
HTTP status
405
Content length
31
Content SHA256
83c09ba9a8daedb136f90b17a294caa90ad471a016e430df6e229acb5a81e100
First seen
2026-11-09T20:40:09Z
33%
high
contains
TLD
com
HTTP status
405
Content length
31
Content SHA256
83c09ba9a8daedb136f90b17a294caa90ad471a016e430df6e229acb5a81e100
First seen
2026-11-09T07:58:35Z
36%
high
contains
TLD
com
First seen
2026-11-08T06:31:31Z
Last seen
2026-11-09T03:16:59Z
36%
high
contains
TLD
com
HTTP status
405
Content length
31
Content SHA256
83c09ba9a8daedb136f90b17a294caa90ad471a016e430df6e229acb5a81e100
First seen
2026-11-08T20:22:16Z
Analysis details
Severity: highphishing
Freshness: Fresh · Last seen today.
- Detection rate
- 38%
- Threat type
- phishing
- Confidence
- 100%
- detection
- 38 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- Domain
- kafeprog7.com
- TLD
- com
- Root domain
- kafeprog7.com
- Resolved geo
- United States
- Resolved IP
- 222.167.226.87
- Country
- United States
- DGA risk
- low
- DGA score
- 44.0
- Domain age days
- 181.0
- Registrar
- MAT BAO CORPORATION
- Created
- 2026-05-15T19:39:43Z
- Expiry
- 2027-05-15T19:39:43Z
- First seen
- 2026-05-18T21:45:47Z
- Last seen
- 2026-11-13T12:09:49Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 12. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 38%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type phishing.
Relationship context
12 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
13 timestamped observations are arranged from 2026-05-15 to 2026-11-13. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type phishing.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Domain profile
summarySelected domain intelligence summary.
- Root domain
- kafeprog7.com
- Resolved IP
- 222.167.226.87
- Resolved geo
- United States
- Country
- United States
- DGA risk
- low
- DGA score
- 44.0
- Domain age days
- 181.0
- Registrar
- MAT BAO CORPORATION
- Created
- 2026-05-15T19:39:43Z
- Expiry
- 2027-05-15T19:39:43Z
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS intelligence4
0 IPs0 domains
- 3 passive DNS records
- 1 DNS records
- 0 unique IPs
- 0 related domains
View details · 2 shown
- Type
- A
- Type
- NS
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- kafeprog7.com
- Issuer
- YE2