opa.tlsd[.]shopDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware“In this environment, Netbird was configured to communicate with hxxps{://]opa.tlsd[.]shop, whereby once this was established, Atera was downloaded through the standard Atera support link.”
Indicators reported together
named in the same reports- doauthentication[.]doin 1 report
- relay.dltsolutions[.]topin 1 report
- relay.eurofin[.]digitalin 1 report
- c84739655ce1af0a…bc21802209e2in 1 report
- eb083365dc70d029…474dafab48d8in 1 report
- c4fcae3847946173…44fa7fda180din 1 report
- vtps[.]usin 1 report
Copy these 7 indicators · defanged
Also named with it: CVE-2025-5777, CVE-2023-4966, CVE-2026-4368
Thanks — we review every report.