Essential information

Value / Name

https://799.cors5.vip/1018.php?domain=%s\u0026path=%s

Confidence

100/100

Revoked

Yes

Valid from

29/01/2026 13:49

Valid until

27/02/2026 19:32

Pattern type

stix

Published

29/01/2026 17:48

Modified

27/02/2026 19:33

Author / Source

AlienVault

Description

No description.

Pattern

[url:value = 'https://799.cors5.vip/1018.php?domain=%s\\u0026path=%s']

Labels / Tags

Labels: asia badiis gotohttp iis persistence powershell regional targeting seo fraud thailand vietnam web shells

Marking (TLP)

TLP:CLEAR