216.73.217.22

Indicator (IOC)

stix Revoked AlienVault · Published 20/12/2025 20:10 · Modified 20/12/2025 20:11

Essential information

Value / Name
spffusa.org
Confidence
100/100
Revoked
Yes
Valid from
17/05/2022 13:02
Valid until
13/03/2023 12:02
Pattern type
stix
Published
20/12/2025 20:10
Modified
20/12/2025 20:11
Author / Source
AlienVault

Description

No description.

Pattern

[domain-name:value = 'spffusa.org']

Labels / Tags

Labels: apt cobalt strike darkhotel email japan lnk lnk file malicious document restylink spear phishing

Marking (TLP)

TLP:CLEAR

Related entities

Reports and intrusion sets linked to this IOC.

Intrusion sets (2)

  • CozyDuke IRON RITUALIRON HEMLOCK
    The MITRE Corporation Confidence 100

    [APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:39 · Modified 04/05/2026 16:33
  • Darkhotel DUBNIUMZigzag Hail
    The MITRE Corporation Confidence 100

    [Darkhotel](https://attack.mitre.org/groups/G0012) is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:39 · Modified 27/03/2026 01:13