DNS Analysis Maps TA416-Linked Infrastructure and 15 Reported Malicious Domains
Summary
A WhoisXML API analysis of Proofpoint-reported TA416 activity examined 91 network indicators, identifying 122 client IPs, 45,197 email-connected domains and 15 domains reported weaponized for phishing or malware distribution.
Key points
- Proofpoint reported that TA416 had resumed espionage campaigns targeting European governments about a month before the report.
- The researchers narrowed 96 network indicators to 91 unique items: 11 subdomains, 73 domains and seven email addresses.
- DNS data showed 122 client IP addresses across four ASNs querying five indicator domains 290 times from March 4 to 23, 2026.
- Historical email-record pivots identified 45,197 email-connected domains; the researchers said 15 had been weaponized for phishing or malware distribution.
- DNS lookups found 61 indicator domains resolving to 69 IP addresses; the authors reported that 60 of those IPs were confirmed malicious.
- The researchers reported 15,317 historical domain-to-IP resolutions across the analyzed domain indicators, with 49 continuing to resolve in 2026.
- The article cautions that some entities flagged as malicious may prove harmless and recommends further investigation.
Article Details
- Attack Vectors
- Phishing using domains identified as weaponized, including chjq168[.]com and e-brane[.]com.
- Malware distribution through domains including 100viagra[.]com, cisco-us[.]com, and downloadfreak[.]top.
- Campaign-associated DNS infrastructure included bulk-registered look-alike domains and subdomains hosted under web.core.windows.net.
- Defensive Notes
- Investigate the identified phishing and malware-distribution domains and the specific suspicious or confirmed-malware-host subdomains.
- The article cautions that some entities labeled suspicious or malicious may prove harmless after further investigation; corroborate indicators before taking action, especially when they use legitimate hosting infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 100viagra[.]com | Identified as a weaponized email-connected domain used for malware distribution. |
| DOMAIN | chjq168[.]com | Identified as a weaponized email-connected domain associated with phishing. |
| DOMAIN | cisco-us[.]com | Identified as a weaponized email-connected domain used for malware distribution. |
| DOMAIN | downloadfreak[.]top | Identified as a weaponized email-connected domain used for malware distribution. |
| DOMAIN | e-brane[.]com | Identified as a weaponized email-connected domain associated with phishing. |
| HOSTNAME | attd[.]z23[.]web[.]core[.]windows[.]net | Subdomain flagged for malware distribution; the article notes its apex domain is legitimate. |
| HOSTNAME | filestoretome[.]z23[.]web[.]core[.]windows[.]net | Subdomain hosted in a zone identified as a confirmed malware host. |
| HOSTNAME | gooledives[.]z48[.]web[.]core[.]windows[.]net | Described as suspicious and possibly impersonating Google; the article also reports high operational activity. |
| HOSTNAME | mydownfile[.]z11[.]web[.]core[.]windows[.]net | Identified as a confirmed malware host. |
| HOSTNAME | mydownload[.]z29[.]web[.]core[.]windows[.]net | Identified as a confirmed malware host. |
MITRE ATT&CK
T1036 · MasqueradingLook-alike domains and the suspicious gooledives[.]z48[.]web[.]core[.]windows[.]net subdomain were described as potentially imitating legitimate entities.T1566 · PhishingThe article identifies chjq168[.]com and e-brane[.]com as domains associated with phishing.T1583.001 · DomainsThe article reports that campaign-associated domains were bulk-registered with groups of look-alike domains.