Forensia: Free Threat Intelligence Lookup

FORENSIA

Indicator investigation

warming up…

Resolving indicator evidenceacquiring

Loading verdict, provenance, relationships and sightings.

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Verdict

MENTIONED — 1 report, unverified

What is this: Domain observed in Intel Report Ingest.
Should you care: Weak signal — mentioned in 1 report, not corroborated across feeds.
What to do: No action — weak signal.

OBSERVEDLIMITED EVIDENCE COVERAGEDeterministic · stored evidence only

Domain investigation

No direct malicious attribution in the available evidence

Live registration, certificate, or DNS context is available, but no direct malicious attribution appears in this snapshot. That describes current coverage; it is not a guarantee that the domain is safe.

Observed role

Observed domain

Role derived only from stored classifications and tags.

Registration

Not established

RDAP registration data unavailable.

Certificate history

Not established

Certificate Transparency lookup did not complete.

Current DNS

Does not resolve

No A record was returned; the name does not exist. Checked 2026-09-05.

Corpus evidence

1 connectors · 1 citations

Generic co-tags were excluded to avoid false relationships.

Observation window

2026-08-31 → 2026-08-31

First and last appearance in the local corpus, not global activity dates.

What the evidence supports

Findings stay bounded to named sources and observable infrastructure.

1 finding

The domain does not currently resolve

MODERATE

No DNS record exists for this name as of 2026-09-05.

Authoritative DNS response (A record)

Non-resolution is consistent with a taken-down, expired, parked, or sinkholed domain, and with a name held in reserve. It is neither proof of remediation nor proof of malice, and it can be reversed at any time.

What remains unknown

RDAP registration date and registrar are unavailable, so domain age is unknown.
Certificate Transparency did not complete, so issuance history is unknown.
The domain does not resolve today, so current hosting cannot be pivoted; where it pointed historically is not established by this check.
No explicitly tagged family or campaign peer is available; generic co-tags were not treated as relationships.
Domains can be transferred, parked, sinkholed, or repointed after the recorded observation.

What this is

Domain indicator: google.saveoauthtoken.mutate

Mentioned in Check Point Research research ingest

Threat detail

Exploitation status and malware-family attribution from stored fields.

exploitation: unknown

related indicators · 14 connectors · 1

Graph preview

Neighborhood topology. Open the graph for interactive pivots.

Open full investigation canvas →

Building relationship previewacquiring

Loading connected indicators, reports and entities.

Continue investigation

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open in graph
Full investigation canvas with neighbor expansion.