The Center for Internet Security (CIS) just named the top 10 malware of Q3 2025 and identified 31 domains as IoCs for five of them. After weeding out legitimate domains from their list with the help of the WhoisXML API MCP Server, we were left with 26 domains for our study. Take a look at the breakdown below.

Note that three of the top 10 malware of Q2 2025—SocGholish, Agent Tesla, and ZPHP—remained part of this quarter’s list. While SocGholish and Agent Tesla kept their top 1 and 3 rankings, respectively, ZPHP dropped from Q2’s top 2 to this quarter’s top 5.

Our in-depth analysis of five of the top malware for Q3 led to these discoveries:

• Two domains identified as IoCs deemed likely to turn malicious 150—598 days prior to being dubbed as such
• One domain tagged as an IoC was bulk-registered with others and could be a typosquatter
• 5,266 email-connected domains, 56 were found malicious
• 11 IP addresses, seven were found malicious
• 104 IP-connected domains
• 606 string-connected domains, one was found malicious

A sample of the additional artifacts obtained from our analysis is available for download from our website.

Digging Up More Information on the IoCs

We began our in-depth investigation by checking if any of the 26 domains tagged as IoCs appeared on First Watch Malicious Domains Data Feed. We discovered that two of them were deemed likely to turn malicious as soon as they were registered, between 150 and 598 days before they were dubbed as IoCs on 14 November 2025. Here are more details.

We also searched for the 26 domains identified as IoCs on Typosquatting Data Feed and discovered that one of them—trendings[.]top—was bulk-registered with two look-alikes—trendingg[.]shop and trendingon[.]store—on 1 February 2024.

Next, we queried the 26 domains identified as IoCs on WHOIS API and filled out missing information aided by Domain Info API. We found out that:

• They were created between 12 September 2012 (Gh0st’s f3322[.]org) and 17 October 2025 (Lumma Stealer’s lzh[.]fr). Specifically, 18 domains were created in 2025; two each in 2016 and 2024; and one each in 2012, 2020, 2022, and 2023.

  

• While one domain did not have registrar data in its current WHOIS record, the remaining 25 were distributed among 13 registrars. Six domains were administered by PDR; five by MarkMonitor; three by Tucows Domains; two by DreamHost; and one each by Cloudflare, eName Technology, the Global Domain Group, GoDaddy, Hosting Concepts, NamesHere, OnlineNIC, Spaceship, and Web Commerce Communications.

  

• While three domains did not have registrant country data on record, the remaining 23 were registered in six countries. A total of 16 domains were registered in the U.S.; two each in China and Saint Kitts and Nevis; and one each in Canada, France, and Iceland.

  

We also obtained additional information on the 26 domains tagged as IoCs from DNS Chronicle API. The results showed that 25 of them posted a total of 2,564 historical domain-to-IP resolutions over time. The SocGholish domain ebuilderssource[.]com recorded the oldest resolution on 5 February 2017. Take a look at more details below.

Prospecting for New Artifacts

We began our search for new artifacts by querying the 26 domains identified as IoCs on WHOIS History API. The results revealed that 16 of them had email addresses in their historical WHOIS records. We collated 45 unique email addresses in all. Further scrutiny showed that 17 of them were public email addresses.

Next, we queried the 17 public email addresses on Reverse WHOIS API. While none of them appeared in current WHOIS records, 16 showed up on historical records. That led to the discovery of 5,266 email-connected domains after duplicates and those already tagged as IoCs were filtered out.

A Threat Intelligence API query for the 5,266 email-connected domains revealed that 56 of them have already been weaponized for nefarious activities. Here are five examples.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.