firstmail[.]ltdDomain
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 6 days ago
What the reports say
7 reports, newest first · the exact sentence from each-
Infostealers Weekly Report: 2026-10-12 – 2026-10-19“firstmail[.]ltd”
-
Infostealers Weekly Report: 2026-09-28 – 2026-10-05“firstmail[.]ltd”
-
Infostealers Weekly Report: 2026-09-21 – 2026-09-28“firstmail[.]ltd”
-
Infostealers Weekly Report: 2026-09-14 – 2026-09-21“firstmail[.]ltd”
-
Infostealers Weekly Report: 2026-09-07 – 2026-09-14“firstmail[.]ltd”
-
Infostealers Weekly Report: 2026-08-17 – 2026-08-24“firstmail[.]ltd”
-
A Threat Actor Abuses Another Free Trial“… their campaign, including disposable email services (quieresmail.com), connections to a Russian-registered temporary email network (firstmail[.]ltd), use of a SAFING_VPN tunnel, and a possible connection to other opportunistic attacks against Microsoft SharePoint and other softwar…”
Indicators reported together
named in the same reports- yahoo[.]frin 6 reports
- icicibank[.]comin 6 reports
- bobibanking[.]comin 6 reports
- icai[.]orgin 6 reports
- netpnb[.]comin 6 reports
- unionbankonline.co[.]inin 6 reports
- rockwellautomation[.]comin 6 reports
- app[.]comin 6 reports
- tv.twitch.android[.]appin 6 reports
- videomeetings[.]comin 6 reports
- contextlogic[.]comin 6 reports
- mega.privacy.android[.]appin 6 reports
- hotmail[.]frin 6 reports
Copy these 13 indicators · defanged
Thanks — we review every report.