ctrlINT What the industry said about every indicator, with the quote

mx.zxopfds[.]comDomain

Reported by 2 independent sources · first reported by Rapid7 · last reported

Last reported 18 days ago

What the reports say

2 reports, newest first · the exact sentence from each

  1. “AVERAT periodically polls a C2 server ("mx.zxopfds[.]com") over TCP port 25 every 600 to 699 seconds.”

    The Hacker NewsNewsC2
    Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

  2. “mx.zxopfds[.]com”

    Rapid7Vendor
    SMTP is the key: BPFDoor and AVERAT hitting the network edge

Indicators reported together

named in the same reports
Copy these 15 indicators · defanged

Thanks — we review every report.

Report a wrong value
What is wrong with mx.zxopfds[.]com here?
No account needed. We do not store your IP address.