check-host[.]netDomain
Reported by 3 independent sources · first reported by Sekoia.io · last reported
Last reported 11 days ago
What the reports say
4 reports, newest first · the exact sentence from each-
French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply“The DDoS posts follow the group’s usual format, citing check-host[.]net reports as proof.”
-
July 2026 Security Issues in Korean & Global Financial Sector“They used external services such as check-host[.]Net to test the availability of Attack Target websites and flaunted the success of their attacks by publishing screenshots.”
-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“Identified services used in this campaign include Telegram, Telegraph, Teletype, Lesma.eu, check-host[.]net, Rentry.co, Write.as, and Mastodon.”
-
FSB’s matryoshka #2/3: Gamaredon's Gammaload Malware“hxxps://check-host[.]net/ip-info?host=snterval.selltosell.ru”
Indicators reported together
named in the same reports- lesma[.]euin 2 reports
- write[.]asin 1 report
- tebi[.]ioin 1 report
- de-fra.i3storage[.]comin 1 report
- s3.tebi[.]ioin 1 report
- hxxps://justsstop[.]ru/in 1 report
- justsstop[.]ruin 1 report
- hxxps://165.22.170[.]129/in 1 report
- 165.22.170[.]129in 1 report
- norosta[.]ruin 1 report
- selltosell[.]ruin 1 report
- hxxps://rentry[.]co/hwzrmfkxin 1 report
- serveirc[.]comin 1 report
- webhop[.]mein 1 report
- serveftp[.]comin 1 report
- myvnc[.]comin 1 report
- hxxps://api.telegra[.]ph/getPage/Hello-01-23-161in 1 report
- hxxps://write[.]as/api/posts/1nei1af6dnw8qin 1 report
- hxxps://mastodon[.]social/api/v1/statuses/115942411657067215in 1 report
- hxxps://bold.zsjtn41091.workers[.]devin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.