DomainTools Details 1,100+ Suspected Domains Used for Data Collection and Malware Delivery

Jun 1, 2026 · Original article ↗

Summary

DomainTools reports that a suspected campaign used more than 1,100 spoofed domains to collect user data and selectively deliver malware, including ValleyRAT and Gh0stRAT, primarily to Chinese-speaking users.

Key points

The second cluster comprises more than 1,100 suspected actor domains registered between April 2024 and January 2025, spoofing popular apps and services.
Obfuscated JavaScript and analytics services collected browser, device, IP, location, and browsing data; some sites may also record browser sessions.
Fake merchant and payment dashboards may be promoted through phishing. A download triggered from one dashboard delivered a dropper that ran ValleyRAT and fetched additional modules from Amazon S3.
The two domain clusters were observed delivering identical Gh0stRAT and ValleyRAT binaries; other sites used conditional, JavaScript-driven delivery.
The operators used separate hosting and delivery infrastructure, including CloudFront, which can obscure malware origins.
The report includes associated domains, tracker identifiers, file hashes, download URLs, and suspected C2 IP addresses as indicators.

Article Details

Attack Vectors: Spoofed application-download websites use obfuscated JavaScript to collect browser and user data and may selectively show malware-delivery links based on user conditions.
Fake merchant, payment, cryptocurrency, email, and office-service login pages are suspected to be distributed through phishing; the pages capture credentials.
A fake merchant-dashboard warning image initiates a malicious dropper download when clicked; executing the dropper installs ValleyRAT and downloads additional modules.
SEO tactics are used to raise spoofed sites in search results and direct traffic to malicious sites.
Defensive Notes: Monitor and block the listed spoofed download and delivery domains, malicious URLs, and C2 IP addresses.
Treat downloads from spoofed application sites and fake login dashboards as suspicious; investigate downloaded files using the hashes listed below.
Review web telemetry for obfuscated JavaScript, unexpected user-data collection, and possible browser-session recording by js-sdk-recorder.min.js.
The report notes that malware delivery may be conditional on geolocation, language settings, or browser type, and that 0-byte files may act as placeholders.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`googleochrome[.]com`	Spoofed Chrome download site hosting Gh0stRAT and ValleyRAT binaries.
DOMAIN	`hndnsv1[.]com`	Nameserver domain reported as common among domains associated with the suspected actor.
DOMAIN	`hndnsv2[.]com`	Nameserver domain reported as common among domains associated with the suspected actor.
DOMAIN	`letscavpn[.]com`	Spoofed Lets VPN download site identified as part of the malicious domain cluster.
DOMAIN	`letsekvpn[.]com`	Spoofed Lets VPN download site identified as part of the malicious domain cluster.
DOMAIN	`otpaycn[.]com`	Malicious fake merchant-dashboard login and malware-delivery site.
IPV4	`154[.]82[.]67[.]135`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`154[.]82[.]85[.]14`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`154[.]82[.]85[.]79`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`154[.]82[.]92[.]231`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`154[.]91[.]64[.]50`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`154[.]91[.]64[.]75`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`154[.]91[.]90[.]102`	C2 IP contacted by the payload on TCP ports 4433 and 10443.
IPV4	`156[.]248[.]77[.]177`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`156[.]251[.]18[.]26`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`156[.]251[.]24[.]167`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`156[.]251[.]25[.]187`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]115[.]132`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]115[.]153`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]115[.]203`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]115[.]38`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]123[.]166`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]198[.]133`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]221[.]10`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]42[.]223`	IP identified during triage as having a recent history of malicious files communicating with it.
IPV4	`206[.]238[.]70[.]202`	IP identified during triage as having a recent history of malicious files communicating with it.
SHA256	`0003417d1ba6370aab194d2bab97e709bbf1d8efbf60d02a1c96117a2e7a7e3d`	SHA-256 of libcef.dll downloaded as part of the ValleyRAT infection.
SHA256	`09efbe0c3e69c0f9a578bbbf0d475bd418497717921713779d1aa89dd2be35d6`	SHA-256 of Chrome.zip downloaded from the spoofed Chrome site.
SHA256	`522863520bcc368631a2db5016a1af68f60ecb074ddf19c9e7bff9834bb05248`	SHA-256 of the payload contained in Chrome.msi; execution connects to the reported C2 IP.
SHA256	`5cd549ca7b5a046afa1f9ddb679dbf04e8879307d2dd813c7d44d00525ab8638`	SHA-256 of ValleyRAT dropped by anacard.exe.
SHA256	`5f39c5fc10130916e3b67e617979eb22febccc274a88af7a43e21cc5311d3f20`	SHA-256 of anacard.exe, which drops ValleyRAT.
SHA256	`6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e`	SHA-256 of vcruntime140_1.dll downloaded as part of the ValleyRAT infection.
SHA256	`7aa74fc5d5f1c356229fa83cd4330f8bfd1b640e09b897602382557fbeefd5ea`	SHA-256 of the initial malicious download, anacard.zip.
SHA256	`7d14ba4da535892e469ca66c1f749bab553c2f9af04eb978d5200431a2f01435`	SHA-256 of xzc.exe downloaded as part of the ValleyRAT infection.
SHA256	`99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd`	SHA-256 of MSVCP140.dll downloaded as part of the ValleyRAT infection.
SHA256	`9b5957e7d9bf0863fc7247df9ea02deac6f1b1a22fc7b9d4dfd89f41f27a400e`	SHA-256 of data.ini downloaded as part of the ValleyRAT infection.
SHA256	`a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8`	SHA-256 of VCRUNTIME140.dll downloaded as part of the ValleyRAT infection.
SHA256	`e39e44cb79c5b1918d8139cfbb6d2ada044dbe4b413e86504f10e902072743fd`	SHA-256 of Chrome.msi, extracted from the malicious Chrome.zip.
SHA256	`f63894af1b84fca6d2cb2732e0cf31d1523d6949edd4738c63663957d46dadae`	SHA-256 of view.res downloaded as part of the ValleyRAT infection.
URL	`hxxps[:]//d2g2a3g6fn6aza[.]cloudfront[.]net/android/letsvpn-latest[.]apk`	Specific CloudFront-hosted Android package download URL identified as malware-delivery infrastructure.
URL	`hxxps[:]//down[.]aydareklam[.]com/anacard[.]zip`	Malicious dropper archive download URL.
URL	`hxxps[:]//down[.]googluchrome[.]com`	Malicious download host loaded by the spoofed googleochrome[.]com site.
URL	`hxxps[:]//omnisentience[.]s3[.]ap-east-1[.]amazonaws[.]com/data[.]ini`	Specific Amazon S3 URL used to download a file associated with the ValleyRAT infection.
URL	`hxxps[:]//omnisentience[.]s3[.]ap-east-1[.]amazonaws[.]com/libcef[.]dll`	Specific Amazon S3 URL used to download a module associated with the ValleyRAT infection.
URL	`hxxps[:]//omnisentience[.]s3[.]ap-east-1[.]amazonaws[.]com/MSVCP140[.]dll`	Specific Amazon S3 URL used to download a module associated with the ValleyRAT infection.
URL	`hxxps[:]//omnisentience[.]s3[.]ap-east-1[.]amazonaws[.]com/vcruntime140_1[.]dll`	Specific Amazon S3 URL used to download a module associated with the ValleyRAT infection.
URL	`hxxps[:]//omnisentience[.]s3[.]ap-east-1[.]amazonaws[.]com/VCRUNTIME140[.]dll`	Specific Amazon S3 URL used to download a module associated with the ValleyRAT infection.
URL	`hxxps[:]//omnisentience[.]s3[.]ap-east-1[.]amazonaws[.]com/view[.]res`	Specific Amazon S3 URL used to download a file associated with the ValleyRAT infection.
URL	`hxxps[:]//omnisentience[.]s3[.]ap-east-1[.]amazonaws[.]com/xzc[.]exe`	Specific Amazon S3 URL used to download a module associated with the ValleyRAT infection.