tel201-2kao0-2kame.nfy.fyi
tel201-2kao0-2kame.nfy.fyi is a domain
that one published source reports
in connection with Konni activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Frost (@fr0s7_).
The report is dated 2026-10-15.
domain Konni RESEARCHER POST
Source
-
The researcher tags the first post #DPRK #KONNI #C2 and gives a C2 URL ending in the same /YE97Bw999zB87t1U8i.php path as the KBW lure's backdoor of 29 September, then a second on 15 October, then in a reply links the paste he titles KONNI C2, which lists fifteen URLs on that path across seven hosts: four subdomains of InfinityFree's xo.je, two of its kesug.com (fe29jf323.kesug.com is the September backdoor's C2), and one of nfy.fyi. Free-hosting subdomains are filed as hosted sites, the address being the operator's choice of name on a platform that gives one to anyone. Read on 26 October 2026; the first post shows one reply, which is @skocherhan's image-only reply in the same chain and carries no value. The paste was set to expire in November 2026.
pastes.io/JM2VHZhY — Frost (@fr0s7_)
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.