Known malicious kithighother
UTA0565 — hosting addresses of the spoofed sites
family: uta0565-chrome-0day-2026-09
Short link:scanmalware.com/h/202
Addresses that served UTA0565's spoofed domains around 2–3 September 2026. 96.9.125[.]52 is published by Volexity (the fake China Digital Times site). The other four are DNS resolutions of Volexity-published domains observed in certificate-transparency monitoring: 216.203.20[.]177 (americanprgoress[.]top), 69.67.173[.]211 (borneobulletins[.]top), 195.85.115[.]163 (outsourcingwise[.]net) and 69.48.228[.]19 (personclouds[.]com and halaltak[.]net).
Anchors
SMQL queryrun
ip:96.9.125.52 OR ip:216.203.20.177 OR ip:69.67.173.211 OR ip:195.85.115.163 OR ip:69.48.228.19Provenance
Added: 2026-09-23 15:19
Exact addresses only; the surrounding ranges belong to hosting providers with unrelated customers. Hosting addresses get reassigned, so treat a match well after September 2026 as a lead, not an attribution. A domain that resolved to 69.48.228[.]19 two weeks before the campaign is deliberately not included, because an earlier tenant cannot be ruled out.
Sightings (0)
No sightings recorded yet.