Tool
First Watch Malicious Domains Data Feed
- First Reported
- May 13, 2026
- Latest Reported
- Jun 19, 2026
Reported Context (3)
- In addition, we discovered that two domain IoCs—zimbra-beta[.]info and office365-update[.]com—were recorded on the First Watch Malicious Domains Data Feed. DNS Investigation Examines Shadow-Earth-053 Infrastructure
- Next, we determined that eight of the domain IoCs appeared on the First Watch Malicious Domains Data Feed 67—465 days prior to being dubbed as such on 14 April 2026. DNS Analysis Maps 90 Domains Linked to Pushpaganda Scareware Campaign
- Next up, we scoured the First Watch Malicious Domains Data Feed and discovered that 73 domain IoCs for two of the three APT groups—APT42 and APT34—were deemed likely to have been registered with malicious intent. DNS and WHOIS Analysis Maps Infrastructure Linked to Eight Iran-Affiliated APT Groups
Malware (2)
Threat Actors (25)
MITRE ATT&CK (8)
Vendors (4)
Products (5)
Tools (10)
Industries (9)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.