The Center for Internet Security (CIS) named the top 10 malware of Q4 2025 on 29 January 2026. They also identified network IoCs for seven of the top 10 malware—SocGholish, CoinMiner, Agent Tesla, Calendaromatic, ZPHP, VenomRAT, and ACR Stealer. Take a look at more details about the top 10 malware below.

Note that we excluded domains originally identified as IoCs that were owned by legitimate entities from our list for further analysis aided by the WhoisXML API MCP Server. That said, we analyzed 46 IoCs from among those originally identified by the CIS. We excluded 15 domains in all, leaving us with 32 domains and 14 subdomains for our in-depth investigation.

Our deep dive into the 46 IoCs for seven of the top 10 malware of Q4 2025 led to these discoveries:

• 145 unique client IP addresses communicated with eight domains classified as IoCs
• Seven domains named as IoCs were deemed likely to have been registered with malicious intent from the get-go
• 359 email-connected domains, 25 of which were confirmed malicious
• 29 IP addresses, 19 of which were confirmed malicious
• 283 IP-connected domains, one of which was confirmed malicious
• 692 string-connected domains, one of which was confirmed malicious

A sample of the additional artifacts obtained from our analysis is available for download from our website.

Validating the Subdomain IoCs

We gathered more information on the 14 subdomains identified as IoCs using Jake AI.

We learned that 11 of them were unresponsive during the subdomain checks even if some could be part of the infrastructure of legitimate companies. Two subdomains had private registration details but while one was under a well-established domain, the other was recently registered. What was most interesting, however, was that the last subdomain we analyzed, akilay[.]kingx[.]info, was confirmed malicious.

New DNS-Related Insights for the Domain IoCs Uncovered

We then moved on toward gathering more information about the 32 domains identified as IoCs.

Sample network traffic data from the IASC revealed that 145 unique client IP addresses under seven distinct ASNs communicated with eight of the domains tagged as IoCs via 501 DNS queries between 1 and 30 January 2026.

The results of our First Watch Malicious Domains Data Feed queries also revealed that seven domains classified as IoCs were deemed likely to turn malicious 20—517 days before they were reported as such on 29 January 2026.

Next, we queried the 32 domains named as IoCs on WHOIS API and discovered that:

• They were created between 10 March 2008 (selcukpeker[.]com related to ZPHP) and 9 January 2026 (obsidianmidnight[.]top connected to ZPHP).

  

• While one domain did not have a registrar on record, the remaining 31 were administered by 15 different registrars.



• While two domains did not have registrant countries on record, the remaining 30 were registered in nine different countries.

  

After that, we queried the 32 domains categorized as IoCs on DNS Chronicle API and learned that 31 had a total of 3,550 historical domain-to-IP resolutions over time. We listed the domain that recorded the first resolution for each malware below.

New Artifacts Related to the 7 of the Top 10 Malware Discovered

We began our hunt for new connected artifacts by querying the 32 domains identified as IoCs on WHOIS History API and discovered that 18 had 43 unique email addresses in their historical WHOIS records. Further scrutiny showed that 16 of them were public email addresses.

Historical Reverse WHOIS API queries for the 16 public email addresses led to the discovery of 359 unique email-connected domains after those already tagged as IoCs were filtered out.

When queried on Threat Intelligence API, we learned that 25 email-connected domains have already been weaponized for various attacks. Here are five examples.

A closer look at the malicious email-connected domains revealed several similarities. For instance, 14 were classified as malicious on the same date (11 June 2025) in relation to malware distribution, suggesting their likely usage in the same campaign.

Next, we queried the 32 domains named as IoCs on DNS Lookup API and found out that 24 resolved to 29 unique IP addresses.

The results of our Threat Intelligence API queries for the IP addresses showed that 19 have already figured in various malicious campaigns

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.