A Close Look under the DNS Hood of CoolClient
WhoisXML API expanded HoneyMyte CoolClient campaign IoCs into 60+ additional infrastructure artifacts. Download the threat research materials now.
Continue reading Download reportTop 10 Malware of Q4 2025: A DNS Deep Dive
On 29 January 2026, the Center for Internet Security (CIS) published1 its list of the top 10 malware observed in Q4 2025, identifying network indicators of compromise (IoCs) for seven families: SocGholish, CoinMiner, Agent Tesla, Calendaromatic, ZPHP, VenomRAT, and ACR Stealer. After removing legitimate domains and refining the dataset with the WhoisXML API MCP Server2, we analyzed 46 IoCs, comprising 32 domains and 14 subdomains.
Our deep dive into the 46 IoCs for seven of the top 10 malware of Q4 2025 led to these discoveries:
- 145 unique client IP addresses communicated with eight domains classified as IoCs
- Seven domains named as IoCs were deemed likely to have been registered with malicious intent from the get-go
- 359 email-connected domains, 25 of which were confirmed malicious
- 29 IP addresses, 19 of which were confirmed malicious
- 283 IP-connected domains, one of which was confirmed malicious
- 692 string-connected domains, one of which was confirmed malicious
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.cisecurity.org/insights/blog/top-10-malware-q4-2025
- [2] https://main.whoisxmlapi.com/ai/mcp-server