Skip to main content

ThreatFox IOCs for 2025-03-24

Medium
Published: Mon Mar 24 2025 (03/24/2025, 00:00:00 UTC)
Source: ThreatFox
Vendor/Project: type
Product: osint

Description

ThreatFox IOCs for 2025-03-24

AI-Powered Analysis

AILast updated: 06/19/2025, 16:16:40 UTC

Technical Analysis

The provided information pertains to a security threat categorized as malware, specifically related to ThreatFox Indicators of Compromise (IOCs) dated 2025-03-24. ThreatFox is a platform that aggregates and shares threat intelligence, including IOCs, which are artifacts observed on a network or in operating systems that indicate a potential intrusion. The threat is tagged as 'type:osint' and 'tlp:white', indicating that it is open-source intelligence and publicly shareable without restriction. The technical details show a threat level of 2 on an unspecified scale, with moderate distribution (3) and minimal analysis (1), suggesting that this is a relatively low-profile or emerging threat with limited detailed analysis available. There are no specific affected versions or products listed beyond a generic 'osint' product type, and no known exploits in the wild have been reported. The absence of patch links and CWE identifiers further indicates that this threat is not tied to a specific vulnerability or software flaw but rather relates to malware indicators collected for situational awareness. The lack of indicators in the data suggests that this is a meta-level IOC report rather than a direct malware sample or exploit. Overall, this threat appears to be a medium-severity malware-related intelligence update, primarily useful for security teams to update detection capabilities rather than an active, high-impact attack vector at this time.

Potential Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits in the wild and the lack of specific affected software or systems. However, as the threat relates to malware IOCs, it could potentially aid attackers in evading detection or facilitate early-stage reconnaissance if these IOCs are leveraged in targeted campaigns. Organizations relying heavily on open-source intelligence and threat intelligence feeds may find value in integrating these IOCs to enhance their detection and response capabilities. The medium severity rating suggests that while immediate operational disruption or data compromise is unlikely, there is a moderate risk that these IOCs could be part of a broader attack campaign if combined with other threat components. European entities in critical infrastructure, finance, or government sectors should remain vigilant, as malware threats often evolve rapidly and can be repurposed for targeted attacks. The lack of detailed technical indicators limits the ability to assess direct impact vectors, but the presence of malware-related IOCs in threat intelligence feeds underscores the importance of maintaining robust monitoring and incident response processes.

Mitigation Recommendations

Given the nature of this threat as a set of malware-related IOCs without specific exploit details, mitigation should focus on enhancing detection and response capabilities rather than patching vulnerabilities. European organizations should: 1) Integrate the latest ThreatFox IOCs into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to improve identification of potential malicious activity. 2) Conduct regular threat hunting exercises using these IOCs to proactively identify any signs of compromise. 3) Maintain up-to-date malware signatures and heuristic detection rules in antivirus and anti-malware solutions. 4) Ensure that network segmentation and least privilege principles are enforced to limit malware propagation. 5) Educate security teams on the evolving threat landscape and encourage sharing of threat intelligence within trusted communities to enhance collective defense. 6) Monitor open-source intelligence channels for updates or additional context that may clarify the threat’s scope or reveal active exploitation. These steps go beyond generic advice by emphasizing proactive threat hunting and intelligence integration tailored to the nature of the provided IOCs.

Need more detailed analysis?Get Pro

Technical Details

Threat Level
2
Analysis
1
Distribution
3
Uuid
d6a5f1fb-544e-4dc6-8923-fd02bc60e3f1
Original Timestamp
1742860987

Indicators of Compromise

Domain

ValueDescriptionCopy
domainyoupteck.com
ClearFake payload delivery domain (confidence level: 75%)
domainanti.linkpc.net
Mirai botnet C2 domain (confidence level: 100%)
domainastralforging.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainmweteorm.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainqnaturecud.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainelegangtedg.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainconqstructcor.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaintownwand.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainpanelplxace.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainusefulutivli.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainurbaninsi.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainsuptplystati.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainhannndlehav.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaintfooltaver.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainmodernmhake.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainguardiainpets.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainprotectaze.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainupgradezunio.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainfirepowerf.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainriflesandm.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainguncontrold.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainmarksmanmy.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainsniperins.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaindefensein.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaindiscoverou.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainc1.cannimade.xyz
Cobalt Strike botnet C2 domain (confidence level: 75%)
domaincdn.ooponoob.xyz
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainautodiscover.a.ora-0-web.com
Bashlite botnet C2 domain (confidence level: 100%)
domaincpanel.e.multi-canale.com
Bashlite botnet C2 domain (confidence level: 100%)
domainwebdisk.adesso-online.com
Bashlite botnet C2 domain (confidence level: 100%)
domaindickstops.mahua.one
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainwww.crimsoncovelabs.xyz
Cobalt Strike botnet C2 domain (confidence level: 100%)
domaina-0002.a2-msedge.net
Cobalt Strike botnet C2 domain (confidence level: 100%)
domainnode-sc.owemo.com
Cobalt Strike botnet C2 domain (confidence level: 100%)
domaingrswjp.com
Hook botnet C2 domain (confidence level: 100%)
domaina05qdzfe6qa1.xyz
Alien botnet C2 domain (confidence level: 50%)
domainabindizzobremin.tk
Alien botnet C2 domain (confidence level: 50%)
domainburalarneler.com
Alien botnet C2 domain (confidence level: 50%)
domainkilimcinursia3.com
Alien botnet C2 domain (confidence level: 50%)
domainprocleaninger.top
Amadey botnet C2 domain (confidence level: 50%)
domainnaphax.duckdns.org
AsyncRAT botnet C2 domain (confidence level: 50%)
domainxptmue1si.localto.net
AsyncRAT botnet C2 domain (confidence level: 50%)
domainmincir07.top
CryptBot botnet C2 domain (confidence level: 50%)
domainmindoi05.top
CryptBot botnet C2 domain (confidence level: 50%)
domaincountries-discovery.gl.at.ply.gg
DCRat botnet C2 domain (confidence level: 50%)
domaingetting-regulation.gl.at.ply.gg
DCRat botnet C2 domain (confidence level: 50%)
domaindeesesejh45.hopto.org
NetWire RC botnet C2 domain (confidence level: 50%)
domainh0metowgh0svi3ws.servequake.com
Orcus RAT botnet C2 domain (confidence level: 50%)
domainbayotam991-51100.portmap.host
Quasar RAT botnet C2 domain (confidence level: 50%)
domainmorelogs.thruhere.net
Quasar RAT botnet C2 domain (confidence level: 50%)
domainpepegajus-33332.portmap.host
Quasar RAT botnet C2 domain (confidence level: 50%)
domainhokagehuyaki.space
Vidar payload delivery domain (confidence level: 50%)
domaindwdwdad2-57443.portmap.host
XenoRAT botnet C2 domain (confidence level: 50%)
domain43414newportdr.com
Formbook botnet C2 domain (confidence level: 50%)
domain78kanshu.net
Formbook botnet C2 domain (confidence level: 50%)
domainaloharecords.com
Formbook botnet C2 domain (confidence level: 50%)
domainamazonprim8.art
Formbook botnet C2 domain (confidence level: 50%)
domainamq-studio.com
Formbook botnet C2 domain (confidence level: 50%)
domainaplustd.com
Formbook botnet C2 domain (confidence level: 50%)
domainartofsapna.com
Formbook botnet C2 domain (confidence level: 50%)
domainbcheaptvwd.com
Formbook botnet C2 domain (confidence level: 50%)
domainbeauskitchen.com
Formbook botnet C2 domain (confidence level: 50%)
domainbreakfastcandy.net
Formbook botnet C2 domain (confidence level: 50%)
domaincaffeinatedmamasblog.com
Formbook botnet C2 domain (confidence level: 50%)
domaincandleish.com
Formbook botnet C2 domain (confidence level: 50%)
domaincomminterbusiness.com
Formbook botnet C2 domain (confidence level: 50%)
domaincrispcleanbodyrituals.com
Formbook botnet C2 domain (confidence level: 50%)
domaindentonparalegals.com
Formbook botnet C2 domain (confidence level: 50%)
domaindevitasaude.com
Formbook botnet C2 domain (confidence level: 50%)
domaindownlooader.com
Formbook botnet C2 domain (confidence level: 50%)
domaindreammakeloja.com
Formbook botnet C2 domain (confidence level: 50%)
domainerraticer.com
Formbook botnet C2 domain (confidence level: 50%)
domainevokingcalm.com
Formbook botnet C2 domain (confidence level: 50%)
domainfjweiwang.com
Formbook botnet C2 domain (confidence level: 50%)
domainfree-outlet.com
Formbook botnet C2 domain (confidence level: 50%)
domainfriendsofhersheypa.com
Formbook botnet C2 domain (confidence level: 50%)
domaingreaterdiabetes.info
Formbook botnet C2 domain (confidence level: 50%)
domainhelptechservices.com
Formbook botnet C2 domain (confidence level: 50%)
domainhjscinc.com
Formbook botnet C2 domain (confidence level: 50%)
domainidealgaysex.com
Formbook botnet C2 domain (confidence level: 50%)
domainjustincook.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainlatinaexpres.com
Formbook botnet C2 domain (confidence level: 50%)
domainmail-businessprinting.com
Formbook botnet C2 domain (confidence level: 50%)
domainmake-trends.com
Formbook botnet C2 domain (confidence level: 50%)
domainmckarthylabscoe.com
Formbook botnet C2 domain (confidence level: 50%)
domainmcwildwest.net
Formbook botnet C2 domain (confidence level: 50%)
domainmercyvh.com
Formbook botnet C2 domain (confidence level: 50%)
domainmodernhomeskitchen.com
Formbook botnet C2 domain (confidence level: 50%)
domainmonnetier-mornex.com
Formbook botnet C2 domain (confidence level: 50%)
domainmosterth.com
Formbook botnet C2 domain (confidence level: 50%)
domainmousybusiness.com
Formbook botnet C2 domain (confidence level: 50%)
domainnationalreturnday.com
Formbook botnet C2 domain (confidence level: 50%)
domainneotactic.net
Formbook botnet C2 domain (confidence level: 50%)
domainnocreditcarswestpalm.com
Formbook botnet C2 domain (confidence level: 50%)
domainorchid-iris.com
Formbook botnet C2 domain (confidence level: 50%)
domainowner.codes
Formbook botnet C2 domain (confidence level: 50%)
domainpackorganically.com
Formbook botnet C2 domain (confidence level: 50%)
domainpenislandbrews.com
Formbook botnet C2 domain (confidence level: 50%)
domainprandartsagency.com
Formbook botnet C2 domain (confidence level: 50%)
domainriquimbilis.com
Formbook botnet C2 domain (confidence level: 50%)
domainroechling-roding.run
Formbook botnet C2 domain (confidence level: 50%)
domainruffstuffstore.com
Formbook botnet C2 domain (confidence level: 50%)
domainsajjaddeveloper.com
Formbook botnet C2 domain (confidence level: 50%)
domainsewythingy.com
Formbook botnet C2 domain (confidence level: 50%)
domainshopjrock.com
Formbook botnet C2 domain (confidence level: 50%)
domainstockandbarrell.com
Formbook botnet C2 domain (confidence level: 50%)
domainsweetsasu.com
Formbook botnet C2 domain (confidence level: 50%)
domaintatsunoichie.com
Formbook botnet C2 domain (confidence level: 50%)
domaintdmmk.site
Formbook botnet C2 domain (confidence level: 50%)
domaintesla-commercio.com
Formbook botnet C2 domain (confidence level: 50%)
domaintiedcaps.rest
Formbook botnet C2 domain (confidence level: 50%)
domaintncnn.com
Formbook botnet C2 domain (confidence level: 50%)
domaintrephone.art
Formbook botnet C2 domain (confidence level: 50%)
domainwhentime12.com
Formbook botnet C2 domain (confidence level: 50%)
domainxn--gdask-y7a.com
Formbook botnet C2 domain (confidence level: 50%)
domainxzaztlrl.icu
Formbook botnet C2 domain (confidence level: 50%)
domainlanguage-lose.gl.at.ply.gg
XWorm botnet C2 domain (confidence level: 50%)
domainmakes-tonight.gl.at.ply.gg
XWorm botnet C2 domain (confidence level: 50%)
domainsell-doctor.gl.at.ply.gg
XWorm botnet C2 domain (confidence level: 50%)
domainsmegmamuncher.duckdns.org
XWorm botnet C2 domain (confidence level: 50%)
domainescapoly.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaintravielup.top
Lumma Stealer botnet C2 domain (confidence level: 100%)
domaincpcontacts.a.ora-0-web.com
Bashlite botnet C2 domain (confidence level: 100%)
domainwebmail.multi-canale.com
Bashlite botnet C2 domain (confidence level: 100%)
domain27dd67e8.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain27dd67e8.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain27dd67e8.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain27dd67e8.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain2d89e015.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain2d89e015.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain2d89e015.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain2d89e015.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain4ad74aab.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain4ad74aab.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain4ad74aab.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain4ad74aab.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain4e577395.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain4e577395.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain4e577395.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain4e577395.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain54f484f2.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain54f484f2.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain54f484f2.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain54f484f2.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain6e93d646.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain6e93d646.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain6e93d646.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain6e93d646.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain791688a4.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain791688a4.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain791688a4.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain791688a4.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain80ce6519.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain80ce6519.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain80ce6519.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain80ce6519.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9203ebc7.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9203ebc7.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9203ebc7.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9203ebc7.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9243e231.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9243e231.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9243e231.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9243e231.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain942a8b18.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain942a8b18.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain942a8b18.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain942a8b18.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9e8fae09.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9e8fae09.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9e8fae09.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domain9e8fae09.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domainb170e747.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domainb170e747.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domainb170e747.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domainb170e747.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domainbc0324ae.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domainbc0324ae.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domainbc0324ae.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domainbc0324ae.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domainbfd8690b.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domainbfd8690b.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domainbfd8690b.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domainbfd8690b.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind27ef8b8.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind27ef8b8.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind27ef8b8.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind27ef8b8.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind3b79f13.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind3b79f13.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind3b79f13.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind3b79f13.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind79046bd.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind79046bd.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind79046bd.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domaind79046bd.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domaindb49f51f.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domaindb49f51f.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domaindb49f51f.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domaindb49f51f.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domainfa2b8b86.biz.ua
DarkWatchman botnet C2 domain (confidence level: 100%)
domainfa2b8b86.cfd
DarkWatchman botnet C2 domain (confidence level: 100%)
domainfa2b8b86.sbs
DarkWatchman botnet C2 domain (confidence level: 100%)
domainfa2b8b86.xyz
DarkWatchman botnet C2 domain (confidence level: 100%)
domainidonetire.duckdns.org
Remcos botnet C2 domain (confidence level: 100%)
domaincometaxk.run
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainautodiscover.webprocediweb.com
Bashlite botnet C2 domain (confidence level: 100%)
domaincpanel.webprocediweb.com
Bashlite botnet C2 domain (confidence level: 100%)
domaindukasbecomeagreatpersonwhowantotbecomegreatnessfor.ydns.eu
Remcos botnet C2 domain (confidence level: 100%)
domainapi-pyciglnrcf.cn-beijing.fcapp.run
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainpdmfg.com
FAKEUPDATES payload delivery domain (confidence level: 100%)
domainwindows-cam.casacam.net
AsyncRAT botnet C2 domain (confidence level: 100%)
domainfamilyfriend.dynu.net
AsyncRAT botnet C2 domain (confidence level: 100%)
domainwww.26166.vip
Formbook botnet C2 domain (confidence level: 50%)
domainwww.583846.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.affiliate-marketing-82505.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.age-spot-treatment-89993.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.anahita-nl2.rest
Formbook botnet C2 domain (confidence level: 50%)
domainwww.anchorage-diels.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.ansomwareagile.shop
Formbook botnet C2 domain (confidence level: 50%)
domainwww.ao-m-nishinomiya.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.appalachianfx.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.appalachiangunrange.club
Formbook botnet C2 domain (confidence level: 50%)
domainwww.appkanal-web.biz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.aralending.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.atmo.online
Formbook botnet C2 domain (confidence level: 50%)
domainwww.bgocni.info
Formbook botnet C2 domain (confidence level: 50%)
domainwww.bigiproperty.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.brandsincart.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.brazil920.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.cas100.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.casino-x-official-of6096.shop
Formbook botnet C2 domain (confidence level: 50%)
domainwww.cfa-cuu.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.cleanerkitchen-shop.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.cleaning-services-99433.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.cremation-services-63446.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.danielortega.dev
Formbook botnet C2 domain (confidence level: 50%)
domainwww.danmerinc.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.deariededradekker.cloud
Formbook botnet C2 domain (confidence level: 50%)
domainwww.delishany.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.dibayadk.shop
Formbook botnet C2 domain (confidence level: 50%)
domainwww.dichvubangchuan.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.dichvuviplike.pro
Formbook botnet C2 domain (confidence level: 50%)
domainwww.dutchesspistolpermit.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.egplek.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.emerm.autos
Formbook botnet C2 domain (confidence level: 50%)
domainwww.eratosantorini.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.essenciamoderna.store
Formbook botnet C2 domain (confidence level: 50%)
domainwww.essisoasesorias.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.ethgirls.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.fitdad.fitness
Formbook botnet C2 domain (confidence level: 50%)
domainwww.forbrighterlife.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.furniture-76263.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.gamefislot.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.gamepixel.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.gempharmatechllc.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.grooming-gigi.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.halsmart.info
Formbook botnet C2 domain (confidence level: 50%)
domainwww.hatiyhgsnterahs.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.hellogringa.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.helniu.top
Formbook botnet C2 domain (confidence level: 50%)
domainwww.hiv-treatment-21144.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.home-renovation-68987.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.innerworkshops.love
Formbook botnet C2 domain (confidence level: 50%)
domainwww.interstateimaging.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.invest-eight.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.iran09.shop
Formbook botnet C2 domain (confidence level: 50%)
domainwww.it-jobs-11489.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.jedzeniomat.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.jiangbozhibo.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.k978-k2bsp-mr.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.kayabrands.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.kforkidz.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.kissmanga.pro
Formbook botnet C2 domain (confidence level: 50%)
domainwww.klub8.vip
Formbook botnet C2 domain (confidence level: 50%)
domainwww.lailraw.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.lakewoodcharity.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.lilyamore.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.llink.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.loan-stalemate.info
Formbook botnet C2 domain (confidence level: 50%)
domainwww.lolydelapan.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.loud-media.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.lowdownlocal.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.lyfgyjxt.world
Formbook botnet C2 domain (confidence level: 50%)
domainwww.manhe3.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.mechaf.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.media-cruise.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.mommabearmoney.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.monitoring-devices-79097.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.mothersofmatriarchy.club
Formbook botnet C2 domain (confidence level: 50%)
domainwww.moutonneuropenihal.cloud
Formbook botnet C2 domain (confidence level: 50%)
domainwww.mybabysisterscloset.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.mysteryblack.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.ninetofivemama.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.nissicloud.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.niulorge.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.nursing-services-sa.click
Formbook botnet C2 domain (confidence level: 50%)
domainwww.office-space-26524.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.oggetto.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.online-advertising-64131.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.online-advertising-96907.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.online-dating-10276.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.paradisepsychotherapy.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.pawchamamapet.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.pelikansubelesindeindirim.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.pilotsugardaddys.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.prestigehometransformations.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.protypepuggedpumpers.cloud
Formbook botnet C2 domain (confidence level: 50%)
domainwww.reapen.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.relaynext.services
Formbook botnet C2 domain (confidence level: 50%)
domainwww.rocket178click.click
Formbook botnet C2 domain (confidence level: 50%)
domainwww.rolexoff-watch.vip
Formbook botnet C2 domain (confidence level: 50%)
domainwww.russtybeats.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.sanctitude-cuspidated.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.securityacadamy.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.sellmyhouseolympia.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.senashop.online
Formbook botnet C2 domain (confidence level: 50%)
domainwww.sloppyasians.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.smartphonesusapan.today
Formbook botnet C2 domain (confidence level: 50%)
domainwww.smile88.pro
Formbook botnet C2 domain (confidence level: 50%)
domainwww.solar-generator-52678.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.solar-systems-panels-44596.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.stratcte.shop
Formbook botnet C2 domain (confidence level: 50%)
domainwww.strictlyotaku.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.su-seikatu.info
Formbook botnet C2 domain (confidence level: 50%)
domainwww.texasrefinances.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.thelittleredcraftshack.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.tiktokmart.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.tilania.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.tp11okebet303.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.travelbackpackss.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.unempioymentpua.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.used-cars-58225.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.vdmo070.top
Formbook botnet C2 domain (confidence level: 50%)
domainwww.vegbydesign.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.vspectra.site
Formbook botnet C2 domain (confidence level: 50%)
domainwww.wcaconline.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.wevertexinc.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.window-replacement-60891.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.work-abroad-30072.bond
Formbook botnet C2 domain (confidence level: 50%)
domainwww.yiugf.shop
Formbook botnet C2 domain (confidence level: 50%)
domainwww.zorahthyart.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainbilighbohooll.ru
Hancitor botnet C2 domain (confidence level: 50%)
domaineummentur.ru
Hancitor botnet C2 domain (confidence level: 50%)
domainlielftworiss.com
Hancitor botnet C2 domain (confidence level: 50%)
domain172-105-27-15.ip.linodeusercontent.com
Unknown malware botnet C2 domain (confidence level: 100%)
domainbot.dstats.org
Mirai botnet C2 domain (confidence level: 50%)
domainfiles.cloudconnect-auth0.top
Hook botnet C2 domain (confidence level: 100%)
domainapproach-trembl.gl.at.ply.gg
NjRAT botnet C2 domain (confidence level: 50%)
domainseptember-idol.gl.at.ply.gg
NjRAT botnet C2 domain (confidence level: 50%)
domainafhoahegue.ru
Phorpiex botnet C2 domain (confidence level: 50%)
domainafhoahegue.su
Phorpiex botnet C2 domain (confidence level: 50%)
domainefhoahegue.ru
Phorpiex botnet C2 domain (confidence level: 50%)
domainefhoahegue.su
Phorpiex botnet C2 domain (confidence level: 50%)
domainrfhoahegue.ru
Phorpiex botnet C2 domain (confidence level: 50%)
domainrfhoahegue.su
Phorpiex botnet C2 domain (confidence level: 50%)
domaintfhoahegue.ru
Phorpiex botnet C2 domain (confidence level: 50%)
domaintfhoahegue.su
Phorpiex botnet C2 domain (confidence level: 50%)
domainxfhoahegue.ru
Phorpiex botnet C2 domain (confidence level: 50%)
domainxfhoahegue.su
Phorpiex botnet C2 domain (confidence level: 50%)
domainbz-fnd3.ydns.eu
Quasar RAT botnet C2 domain (confidence level: 50%)
domainip93.ip-178-32-113.eu
Havoc botnet C2 domain (confidence level: 100%)
domainkinggggg123212-33699.portmap.host
XWorm botnet C2 domain (confidence level: 50%)
domainmonhostip.ddns.net
XWorm botnet C2 domain (confidence level: 50%)
domaintest131-50314.portmap.host
XWorm botnet C2 domain (confidence level: 50%)
domainokta.microsoft-onedrive.upgrade1.zip
Havoc botnet C2 domain (confidence level: 100%)
domainres.microsoft-onedrive.upgrade1.zip
Havoc botnet C2 domain (confidence level: 100%)
domainok.microsoft-onedrive.upgrade1.zip
Havoc botnet C2 domain (confidence level: 100%)
domaingui.microsoft-onedrive.upgrade1.zip
Havoc botnet C2 domain (confidence level: 100%)
domainshortzy.ink
Unknown malware botnet C2 domain (confidence level: 100%)
domainmaxnet.top
Unknown malware botnet C2 domain (confidence level: 100%)
domainma-babes.gl.at.ply.gg
NjRAT botnet C2 domain (confidence level: 75%)
domainns01.cl0udflark.link
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainns02.micr0hard.click
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainns03.starhubb.link
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainns1.chedn.shop
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainns2.chedn.shop
Cobalt Strike botnet C2 domain (confidence level: 75%)
domainwccdefense.com
FAKEUPDATES payload delivery domain (confidence level: 100%)
domainlogin.klogixsecurity.org
Havoc botnet C2 domain (confidence level: 100%)
domainsjekk-min-id.info
Bashlite botnet C2 domain (confidence level: 100%)
domaincr32765.tw1.ru
DCRat botnet C2 domain (confidence level: 100%)
domain20789cm.darkproducts.ru
DCRat botnet C2 domain (confidence level: 100%)
domaina1106670.xsph.ru
DCRat botnet C2 domain (confidence level: 100%)
domainartillerygr.shop
Lumma Stealer botnet C2 domain (confidence level: 100%)
domainwww.5sguy.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.agroproducts.online
Formbook botnet C2 domain (confidence level: 50%)
domainwww.ahmadhidayah.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.atomoffice.asia
Formbook botnet C2 domain (confidence level: 50%)
domainwww.bentrecfs.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.beyondsauerkraut.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.bolezi21.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.bosphorusorthopedics.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.bussinktransport.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.content-trip.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.coraltechnologygroup.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.designantageuk.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.emerald-creative.co.uk
Formbook botnet C2 domain (confidence level: 50%)
domainwww.equityinengineering.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.eurokidscreative.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.exm-dronesecurity.online
Formbook botnet C2 domain (confidence level: 50%)
domainwww.fiathfirst.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.finskills.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.firstamm.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.floridapremierestates.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.foodloversdirect.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.frenchtogether.info
Formbook botnet C2 domain (confidence level: 50%)
domainwww.guoyijidian.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.ilhadeitaparicatem.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.intelligentinvestingtoday.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.jjm68.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.jlxrzz.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.jutuiess.site
Formbook botnet C2 domain (confidence level: 50%)
domainwww.juventudvq.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.kamiapp.today
Formbook botnet C2 domain (confidence level: 50%)
domainwww.losangeleslandscapedesigner.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.mamentos.info
Formbook botnet C2 domain (confidence level: 50%)
domainwww.meditationmateau.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.meridianconversation.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.meunegocioonlineoficial.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.minnesotaunited.club
Formbook botnet C2 domain (confidence level: 50%)
domainwww.mojhawaii.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.monologuestudios.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.myworldtwentyfourseven.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.northacai.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.nothingbeatsagreatstory.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.pleasingpleasure.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.qianwanshang.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.querooo.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.relliant-rehab.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.shoppret.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.sitokatachinhhang.club
Formbook botnet C2 domain (confidence level: 50%)
domainwww.sohbetegelin.net
Formbook botnet C2 domain (confidence level: 50%)
domainwww.sorelshopitalia.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.stranded.xyz
Formbook botnet C2 domain (confidence level: 50%)
domainwww.surfboard-quarterly.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.synchroport.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.takeactionphysio.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.taradiary.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.thefriendsofmaryc.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.thereseraulin.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.thespiritualabolitionist.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.thetruediversity.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.towstate.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.usjiikay.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.wedividebyzero.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.wilmington.guide
Formbook botnet C2 domain (confidence level: 50%)
domainwww.wisheskennel.com
Formbook botnet C2 domain (confidence level: 50%)
domainwww.xdlbiyj.icu
Formbook botnet C2 domain (confidence level: 50%)
domainwww.xinmotlanchet.online
Formbook botnet C2 domain (confidence level: 50%)
domainbosstan027.beget.tech
Anubis botnet C2 domain (confidence level: 50%)
domainhawus.net
Anubis botnet C2 domain (confidence level: 50%)
domaintryagain.beget.tech
Anubis botnet C2 domain (confidence level: 50%)

Url

ValueDescriptionCopy
urlhttps://astralforging.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://mweteorm.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://qnaturecud.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://elegangtedg.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://conqstructcor.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://townwand.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://panelplxace.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://usefulutivli.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://urbaninsi.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://suptplystati.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://hannndlehav.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://tfooltaver.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://modernmhake.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://guardiainpets.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://protectaze.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://upgradezunio.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://firepowerf.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://riflesandm.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://guncontrold.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://marksmanmy.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://sniperins.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://defensein.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://discoverou.shop/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://scenarisacri.top/api
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://gogetxto.life/posn
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://pupmeholk.bet/paoska
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://guntac.bet/bhwsyos
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://exploreth.shop/gyzsp
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://areawannte.bet/agxsjx
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://farmingtzricks.top
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://experimentalideas.today
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://techpxioneers.run
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://176.65.134.153:9912/20abda5e27a457d5bae88f8/smgx4whh.hodau
Rhadamanthys botnet C2 (confidence level: 100%)
urlhttp://a1101496.xsph.ru/9af4cbe8.php
DCRat botnet C2 (confidence level: 100%)
urlhttp://beesco.net/second/chief3/fre.php
Loki Password Stealer (PWS) botnet C2 (confidence level: 100%)
urlhttp://182.124.18.157:33940/mozi.m
Mozi payload delivery URL (confidence level: 50%)
urlhttp://45.164.177.134:11762/mozi.m
Mozi payload delivery URL (confidence level: 50%)
urlhttp://a05qdzfe6qa1.xyz
Alien botnet C2 (confidence level: 50%)
urlhttp://abindizzobremin.tk
Alien botnet C2 (confidence level: 50%)
urlhttp://buralarneler.com
Alien botnet C2 (confidence level: 50%)
urlhttp://kilimcinursia3.com
Alien botnet C2 (confidence level: 50%)
urlhttp://befqlo52.top/index.php
CryptBot botnet C2 (confidence level: 50%)
urlhttp://befyum42.top/index.php
CryptBot botnet C2 (confidence level: 50%)
urlhttp://mincir07.top/download.php?file=lv.exe
CryptBot botnet C2 (confidence level: 50%)
urlhttp://mindoi05.top/download.php?file=lv.exe
CryptBot botnet C2 (confidence level: 50%)
urlhttp://morkoe04.top/index.php
CryptBot botnet C2 (confidence level: 50%)
urlhttp://mortos05.top/index.ph
CryptBot botnet C2 (confidence level: 50%)
urlhttp://akaliresources.com/png_dceuuf230.bin
Unknown Loader payload delivery URL (confidence level: 50%)
urlhttp://akaliresources.com/test_feayb239.bin
Unknown Loader payload delivery URL (confidence level: 50%)
urlhttp://kiencuonghotel.vn/3month_rwhwwlga208.bin
Unknown Loader payload delivery URL (confidence level: 50%)
urlhttp://od.lk/s/nzhfmjexnty2nzlf/png_dceuuf230.bin
Unknown Loader payload delivery URL (confidence level: 50%)
urlhttps://mindforcehypnosis.com/fas/decemberomo_fkoic77.bin
Unknown Loader payload delivery URL (confidence level: 50%)
urlhttps://od.lk/s/nzhfmjexnty2nzzf/test_feayb239.bin
Unknown Loader payload delivery URL (confidence level: 50%)
urlhttps://babosiki.buzz
Hydra botnet C2 (confidence level: 50%)
urlhttps://trustpoopin.xyz
Hydra botnet C2 (confidence level: 50%)
urlhttps://trygotii.xyz
Hydra botnet C2 (confidence level: 50%)
urlhttps://trytogoi.xyz
Hydra botnet C2 (confidence level: 50%)
urlhttp://www.43414newportdr.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.78kanshu.net/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.aloharecords.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.amazonprim8.art/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.amq-studio.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.aplustd.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.artofsapna.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.bcheaptvwd.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.beauskitchen.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.breakfastcandy.net/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.caffeinatedmamasblog.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.candleish.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.comminterbusiness.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.crispcleanbodyrituals.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.csgo-c4ses.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.dentonparalegals.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.devitasaude.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.downlooader.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.dreammakeloja.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.erraticer.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.evokingcalm.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.fjweiwang.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.free-outlet.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.friendsofhersheypa.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.greaterdiabetes.info/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.helptechservices.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.hjscinc.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.idealgaysex.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.justincook.xyz/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.latinaexpres.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mail-businessprinting.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.make-trends.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mckarthylabscoe.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mcwildwest.net/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mercyvh.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.modernhomeskitchen.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.monnetier-mornex.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mosterth.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mousybusiness.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.nationalreturnday.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.neotactic.net/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.nocreditcarswestpalm.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.octoberx2.online/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.orchid-iris.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.owner.codes/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.packorganically.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.penislandbrews.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.prandartsagency.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.riquimbilis.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.roechling-roding.run/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.ruffstuffstore.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sajjaddeveloper.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sewythingy.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.shopjrock.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.stockandbarrell.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sweetsasu.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.tatsunoichie.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.tdmmk.site/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.tesla-commercio.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.tiedcaps.rest/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.tncnn.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.trephone.art/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.whentime12.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.xn--gdask-y7a.com/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.xzaztlrl.icu/bw82/
Formbook botnet C2 (confidence level: 50%)
urlhttps://galarona.bet/gkans
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://x.p.formaxprime.co.uk/
Vidar botnet C2 (confidence level: 100%)
urlhttps://arpobe.hemispheredrown.tech/ww_ee_hh_3439649453166363dc95741517459564.js
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://groundrats.org/thhggedyan6yguchwex98r1ylpaoq9zvv2t6wfy5sox
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttp://217.197.107.91/login.php
Lumma Stealer botnet C2 (confidence level: 100%)
urlhttp://5.252.155.168/builds/uploads2/update.png
Unknown malware botnet C2 (confidence level: 100%)
urlhttp://5.252.155.168/builds/uploads2/update2.png
Unknown malware botnet C2 (confidence level: 100%)
urlhttp://176.65.142.161/f698bbaeef359c28.php
Stealc botnet C2 (confidence level: 100%)
urlhttp://45.164.177.172:11759/mozi.m
Mozi payload delivery URL (confidence level: 50%)
urlhttp://87.121.84.145/bins/x86
Unknown malware payload delivery URL (confidence level: 75%)
urlhttp://113.121.69.251:38859/mozi.m
Mozi payload delivery URL (confidence level: 100%)
urlhttps://pdmfg.com/1q2w.js
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://pdmfg.com/js.php
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://artillerygr.shop/api
Lumma Stealer botnet C2 (confidence level: 50%)
urlhttp://www.securedmicrosoft365.com/
Unknown malware payload delivery URL (confidence level: 50%)
urlhttps://bilaxy-exchange-login.com/
Unknown malware payload delivery URL (confidence level: 50%)
urlhttps://activeheat.co.vu/dek/inc/f08405615b33f6.php
Agent Tesla botnet C2 (confidence level: 50%)
urlhttps://api.telegram.org/bot5811225301:aagg071-pnhbjlr9uzsrye9tc6lrnsam1mk/
Agent Tesla botnet C2 (confidence level: 50%)
urlhttp://mortos05.top/index.php
CryptBot botnet C2 (confidence level: 50%)
urlhttp://www.26166.vip/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.583846.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.affiliate-marketing-82505.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.age-spot-treatment-89993.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.anahita-nl2.rest/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.anchorage-diels.net/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.ansomwareagile.shop/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.ao-m-nishinomiya.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.appalachianfx.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.appalachiangunrange.club/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.appkanal-web.biz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.aralending.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.atmo.online/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.bgocni.info/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.bigiproperty.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.brandsincart.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.brazil920.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.cas100.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.casino-x-official-of6096.shop/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.cfa-cuu.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.cleanerkitchen-shop.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.cleaning-services-99433.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.cremation-services-63446.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.danielortega.dev/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.danmerinc.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.deariededradekker.cloud/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.delishany.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.dibayadk.shop/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.dichvubangchuan.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.dichvuviplike.pro/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.dutchesspistolpermit.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.egplek.net/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.emerm.autos/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.eratosantorini.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.essenciamoderna.store/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.essisoasesorias.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.ethgirls.xyz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.fitdad.fitness/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.forbrighterlife.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.furniture-76263.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.gamefislot.xyz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.gamepixel.xyz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.gempharmatechllc.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.grooming-gigi.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.halsmart.info/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.hatiyhgsnterahs.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.hellogringa.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.helniu.top/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.hiv-treatment-21144.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.home-renovation-68987.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.innerworkshops.love/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.interstateimaging.net/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.invest-eight.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.iran09.shop/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.it-jobs-11489.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.jedzeniomat.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.jiangbozhibo.net/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.k978-k2bsp-mr.net/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.kayabrands.net/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.kforkidz.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.kissmanga.pro/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.klub8.vip/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.lailraw.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.lakewoodcharity.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.lilyamore.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.llink.net/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.loan-stalemate.info/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.lolydelapan.xyz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.loud-media.net/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.lowdownlocal.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.lyfgyjxt.world/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.magentos6.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.manhe3.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mechaf.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.media-cruise.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mommabearmoney.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.monitoring-devices-79097.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mothersofmatriarchy.club/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.moutonneuropenihal.cloud/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mybabysisterscloset.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mysteryblack.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.ninetofivemama.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.nissicloud.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.niulorge.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.nursing-services-sa.click/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.office-space-26524.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.oggetto.xyz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.online-advertising-64131.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.online-advertising-96907.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.online-dating-10276.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.paradisepsychotherapy.net/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.pawchamamapet.net/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.pelikansubelesindeindirim.xyz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.pilotsugardaddys.net/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.prestigehometransformations.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.protypepuggedpumpers.cloud/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.reapen.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.relaynext.services/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.rocket178click.click/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.rolexoff-watch.vip/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.russtybeats.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sanctitude-cuspidated.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.securityacadamy.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sellmyhouseolympia.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.senashop.online/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sloppyasians.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.smartphonesusapan.today/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.smile88.pro/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.solar-generator-52678.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.solar-systems-panels-44596.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.stratcte.shop/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.strictlyotaku.net/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.su-seikatu.info/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.texasrefinances.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.thelittleredcraftshack.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.tiktokmart.net/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.tilania.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.tp11okebet303.xyz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.travelbackpackss.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.unempioymentpua.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.used-cars-58225.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.vdmo070.top/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.vegbydesign.net/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.vspectra.site/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.wcaconline.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.wevertexinc.com/et2d/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.window-replacement-60891.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.work-abroad-30072.bond/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.yiugf.shop/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.zorahthyart.xyz/bopi/
Formbook botnet C2 (confidence level: 50%)
urlhttp://bilighbohooll.ru/8/forum.php
Hancitor botnet C2 (confidence level: 50%)
urlhttp://eummentur.ru/8/forum.php
Hancitor botnet C2 (confidence level: 50%)
urlhttp://lielftworiss.com/8/forum.php
Hancitor botnet C2 (confidence level: 50%)
urlhttp://afhoahegue.ru/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://afhoahegue.su/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://efhoahegue.ru/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://efhoahegue.su/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://rfhoahegue.ru/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://rfhoahegue.su/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://tfhoahegue.ru/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://tfhoahegue.su/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://xfhoahegue.ru/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://xfhoahegue.su/s/
Phorpiex botnet C2 (confidence level: 50%)
urlhttp://91.196.33.33/api/ytasodysodisowqsytesodgsotasotusnjusn2qs
SmartLoader botnet C2 (confidence level: 75%)
urlhttps://wccdefense.com/3e5t.js
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttps://wccdefense.com/js.php
FAKEUPDATES payload delivery URL (confidence level: 100%)
urlhttp://www.5sguy.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.agroproducts.online/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.ahmadhidayah.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.atomoffice.asia/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.bentrecfs.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.beyondsauerkraut.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.bolezi21.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.bosphorusorthopedics.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.bussinktransport.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.content-trip.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.coraltechnologygroup.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.designantageuk.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.emerald-creative.co.uk/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.equityinengineering.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.eurokidscreative.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.exm-dronesecurity.online/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.fiathfirst.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.finskills.net/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.firstamm.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.floridapremierestates.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.foodloversdirect.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.frenchtogether.info/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.guoyijidian.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.ilhadeitaparicatem.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.intelligentinvestingtoday.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.jjm68.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.jlxrzz.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.jutuiess.site/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.juventudvq.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.kamiapp.today/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.losangeleslandscapedesigner.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mamentos.info/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.meditationmateau.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.meridianconversation.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.meunegocioonlineoficial.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.minnesotaunited.club/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.mojhawaii.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.monologuestudios.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.myworldtwentyfourseven.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.northacai.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.nothingbeatsagreatstory.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.pleasingpleasure.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.qianwanshang.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.querooo.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.relliant-rehab.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.shoppret.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sitokatachinhhang.club/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sohbetegelin.net/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.sorelshopitalia.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.stranded.xyz/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.surfboard-quarterly.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.synchroport.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.takeactionphysio.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.taradiary.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.thefriendsofmaryc.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.thereseraulin.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.thespiritualabolitionist.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.thetruediversity.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.towstate.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.usjiikay.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.wedividebyzero.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.wilmington.guide/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.wisheskennel.com/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.xdlbiyj.icu/utau/
Formbook botnet C2 (confidence level: 50%)
urlhttp://www.xinmotlanchet.online/utau/
Formbook botnet C2 (confidence level: 50%)

File

ValueDescriptionCopy
file103.77.246.176
Mirai botnet C2 server (confidence level: 100%)
file103.77.246.176
Mirai botnet C2 server (confidence level: 100%)
file103.77.246.176
Mirai botnet C2 server (confidence level: 100%)
file172.98.23.97
Cobalt Strike botnet C2 server (confidence level: 100%)
file190.205.233.105
Quasar RAT botnet C2 server (confidence level: 100%)
file18.198.77.177
Quasar RAT botnet C2 server (confidence level: 100%)
file154.204.45.147
Venom RAT botnet C2 server (confidence level: 100%)
file181.167.82.139
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file46.247.108.127
Nimplant botnet C2 server (confidence level: 100%)
file185.184.123.84
Cobalt Strike botnet C2 server (confidence level: 75%)
file47.243.99.248
Cobalt Strike botnet C2 server (confidence level: 75%)
file8.134.163.255
Cobalt Strike botnet C2 server (confidence level: 75%)
file103.27.109.46
Cobalt Strike botnet C2 server (confidence level: 100%)
file45.152.149.7
AsyncRAT botnet C2 server (confidence level: 100%)
file152.42.219.50
Havoc botnet C2 server (confidence level: 100%)
file3.68.102.213
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file65.0.11.173
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file31.31.207.21
Brute Ratel C4 botnet C2 server (confidence level: 100%)
file51.81.46.71
Quasar RAT botnet C2 server (confidence level: 100%)
file103.142.147.17
Unknown malware botnet C2 server (confidence level: 100%)
file147.182.240.74
Unknown malware botnet C2 server (confidence level: 100%)
file3.133.177.159
Unknown malware botnet C2 server (confidence level: 100%)
file20.250.185.182
Unknown malware botnet C2 server (confidence level: 100%)
file13.48.143.140
Unknown malware botnet C2 server (confidence level: 100%)
file187.45.190.244
Unknown malware botnet C2 server (confidence level: 100%)
file68.219.178.230
Unknown malware botnet C2 server (confidence level: 100%)
file18.192.93.86
NjRAT botnet C2 server (confidence level: 75%)
file18.156.13.209
NjRAT botnet C2 server (confidence level: 75%)
file18.157.68.73
NjRAT botnet C2 server (confidence level: 75%)
file176.65.134.153
Rhadamanthys botnet C2 server (confidence level: 100%)
file45.119.211.12
AsyncRAT botnet C2 server (confidence level: 100%)
file195.211.191.155
RedLine Stealer botnet C2 server (confidence level: 100%)
file185.153.198.36
RedLine Stealer botnet C2 server (confidence level: 100%)
file64.95.11.214
Quasar RAT botnet C2 server (confidence level: 100%)
file104.194.152.74
Cobalt Strike botnet C2 server (confidence level: 50%)
file101.133.156.69
Cobalt Strike botnet C2 server (confidence level: 50%)
file43.163.116.82
Cobalt Strike botnet C2 server (confidence level: 50%)
file167.71.27.117
Sliver botnet C2 server (confidence level: 50%)
file206.206.76.78
Sliver botnet C2 server (confidence level: 50%)
file62.60.226.168
Sliver botnet C2 server (confidence level: 50%)
file2.57.241.11
Sliver botnet C2 server (confidence level: 50%)
file119.167.234.93
Xtreme RAT botnet C2 server (confidence level: 50%)
file114.67.64.67
Xtreme RAT botnet C2 server (confidence level: 50%)
file87.26.121.157
Ghost RAT botnet C2 server (confidence level: 50%)
file117.209.9.66
Mozi botnet C2 server (confidence level: 50%)
file216.170.123.10
AsyncRAT botnet C2 server (confidence level: 50%)
file151.236.9.205
DCRat botnet C2 server (confidence level: 50%)
file38.49.43.182
DCRat botnet C2 server (confidence level: 50%)
file192.3.64.144
Remcos botnet C2 server (confidence level: 50%)
file192.3.64.144
Remcos botnet C2 server (confidence level: 50%)
file192.3.64.144
Remcos botnet C2 server (confidence level: 50%)
file78.166.251.201
SpyNote botnet C2 server (confidence level: 50%)
file45.88.91.108
XWorm botnet C2 server (confidence level: 50%)
file176.65.142.252
Bashlite botnet C2 server (confidence level: 75%)
file196.251.85.31
Cobalt Strike botnet C2 server (confidence level: 100%)
file8.129.233.201
Cobalt Strike botnet C2 server (confidence level: 100%)
file103.82.53.18
Cobalt Strike botnet C2 server (confidence level: 100%)
file52.68.47.107
Cobalt Strike botnet C2 server (confidence level: 100%)
file196.251.86.41
Remcos botnet C2 server (confidence level: 100%)
file196.251.70.240
AsyncRAT botnet C2 server (confidence level: 100%)
file196.251.69.138
AsyncRAT botnet C2 server (confidence level: 100%)
file64.23.207.221
Unknown malware botnet C2 server (confidence level: 100%)
file27.124.4.224
Hook botnet C2 server (confidence level: 100%)
file27.124.4.223
Hook botnet C2 server (confidence level: 100%)
file27.124.4.217
Hook botnet C2 server (confidence level: 100%)
file94.156.177.171
Quasar RAT botnet C2 server (confidence level: 100%)
file104.194.152.74
Havoc botnet C2 server (confidence level: 100%)
file87.251.78.226
Orcus RAT botnet C2 server (confidence level: 100%)
file217.18.210.142
DCRat botnet C2 server (confidence level: 100%)
file35.78.186.43
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file93.198.178.208
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file77.92.145.20
Unknown malware botnet C2 server (confidence level: 100%)
file110.40.132.172
Cobalt Strike botnet C2 server (confidence level: 100%)
file118.31.107.122
Cobalt Strike botnet C2 server (confidence level: 100%)
file169.1.137.250
QakBot botnet C2 server (confidence level: 75%)
file94.130.144.246
DeimosC2 botnet C2 server (confidence level: 75%)
file65.49.235.251
Meterpreter botnet C2 server (confidence level: 75%)
file188.40.187.134
DarkWatchman botnet C2 server (confidence level: 75%)
file117.50.184.22
Cobalt Strike botnet C2 server (confidence level: 100%)
file2.58.56.217
Cobalt Strike botnet C2 server (confidence level: 100%)
file51.195.91.59
Cobalt Strike botnet C2 server (confidence level: 100%)
file47.109.82.220
Cobalt Strike botnet C2 server (confidence level: 100%)
file59.110.4.100
Cobalt Strike botnet C2 server (confidence level: 100%)
file204.77.9.25
AsyncRAT botnet C2 server (confidence level: 100%)
file23.95.106.22
AsyncRAT botnet C2 server (confidence level: 100%)
file47.115.225.92
DCRat botnet C2 server (confidence level: 100%)
file3.10.176.75
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file52.221.213.139
Chaos botnet C2 server (confidence level: 100%)
file94.103.188.118
Bashlite botnet C2 server (confidence level: 100%)
file213.152.43.231
Bashlite botnet C2 server (confidence level: 100%)
file216.250.248.203
Remcos botnet C2 server (confidence level: 100%)
file185.184.123.58
FAKEUPDATES payload delivery server (confidence level: 100%)
file213.209.129.92
Mirai botnet C2 server (confidence level: 100%)
file192.227.168.165
Remcos botnet C2 server (confidence level: 75%)
file14.128.50.20
Cobalt Strike botnet C2 server (confidence level: 75%)
file14.128.50.24
Cobalt Strike botnet C2 server (confidence level: 75%)
file43.140.215.17
Cobalt Strike botnet C2 server (confidence level: 75%)
file47.86.28.28
ValleyRAT botnet C2 server (confidence level: 100%)
file196.251.93.44
Remcos botnet C2 server (confidence level: 75%)
file101.42.18.6
Cobalt Strike botnet C2 server (confidence level: 50%)
file123.57.146.124
Cobalt Strike botnet C2 server (confidence level: 50%)
file185.239.209.227
Cobalt Strike botnet C2 server (confidence level: 50%)
file82.68.2.174
NetSupportManager RAT botnet C2 server (confidence level: 50%)
file50.233.74.170
NetSupportManager RAT botnet C2 server (confidence level: 50%)
file35.215.196.4
Unknown malware botnet C2 server (confidence level: 50%)
file178.128.245.28
Unknown malware botnet C2 server (confidence level: 50%)
file178.128.48.87
Sliver botnet C2 server (confidence level: 50%)
file47.97.253.190
Xtreme RAT botnet C2 server (confidence level: 50%)
file81.149.70.25
Ghost RAT botnet C2 server (confidence level: 50%)
file18.224.18.64
Unknown malware botnet C2 server (confidence level: 50%)
file117.204.167.168
Mozi botnet C2 server (confidence level: 50%)
file196.251.69.138
AsyncRAT botnet C2 server (confidence level: 100%)
file172.233.136.253
Unknown malware botnet C2 server (confidence level: 100%)
file176.65.141.187
Hook botnet C2 server (confidence level: 100%)
file47.99.65.37
Quasar RAT botnet C2 server (confidence level: 100%)
file77.99.80.4
Orcus RAT botnet C2 server (confidence level: 100%)
file159.100.14.39
MooBot botnet C2 server (confidence level: 100%)
file35.202.174.159
Unknown malware botnet C2 server (confidence level: 100%)
file51.20.31.88
Unknown malware botnet C2 server (confidence level: 100%)
file44.219.23.11
Unknown malware botnet C2 server (confidence level: 100%)
file185.247.224.176
Unknown malware botnet C2 server (confidence level: 100%)
file206.233.249.157
Unknown malware botnet C2 server (confidence level: 100%)
file51.38.129.35
Unknown malware botnet C2 server (confidence level: 100%)
file208.52.170.201
Unknown malware botnet C2 server (confidence level: 100%)
file172.111.244.147
Remcos botnet C2 server (confidence level: 100%)
file208.64.33.139
Remcos botnet C2 server (confidence level: 100%)
file185.236.231.168
Remcos botnet C2 server (confidence level: 100%)
file178.157.61.161
pupy botnet C2 server (confidence level: 100%)
file176.65.134.111
AsyncRAT botnet C2 server (confidence level: 100%)
file147.185.221.16
NjRAT botnet C2 server (confidence level: 75%)
file147.185.221.16
NjRAT botnet C2 server (confidence level: 75%)
file107.172.208.162
Cobalt Strike botnet C2 server (confidence level: 75%)
file194.26.192.127
XWorm botnet C2 server (confidence level: 75%)
file185.222.57.71
RedLine Stealer botnet C2 server (confidence level: 100%)
file62.60.238.115
WarmCookie botnet C2 server (confidence level: 100%)
file84.200.154.113
Cobalt Strike botnet C2 server (confidence level: 100%)
file167.88.186.143
Cobalt Strike botnet C2 server (confidence level: 100%)
file196.251.86.31
Remcos botnet C2 server (confidence level: 100%)
file157.254.223.99
AsyncRAT botnet C2 server (confidence level: 100%)
file207.154.205.158
Unknown malware botnet C2 server (confidence level: 100%)
file38.54.31.112
Havoc botnet C2 server (confidence level: 100%)
file15.237.149.167
NetSupportManager RAT botnet C2 server (confidence level: 100%)
file51.20.69.36
PoshC2 botnet C2 server (confidence level: 100%)
file47.236.159.13
MimiKatz botnet C2 server (confidence level: 100%)
file186.106.194.221
QakBot botnet C2 server (confidence level: 75%)
file85.101.92.137
QakBot botnet C2 server (confidence level: 75%)
file38.181.22.44
ValleyRAT botnet C2 server (confidence level: 100%)
file45.192.168.9
ValleyRAT botnet C2 server (confidence level: 100%)

Hash

ValueDescriptionCopy
hash1337
Mirai botnet C2 server (confidence level: 100%)
hash3912
Mirai botnet C2 server (confidence level: 100%)
hash56412
Mirai botnet C2 server (confidence level: 100%)
hash12345
Cobalt Strike botnet C2 server (confidence level: 100%)
hash443
Quasar RAT botnet C2 server (confidence level: 100%)
hash12951
Quasar RAT botnet C2 server (confidence level: 100%)
hash8989
Venom RAT botnet C2 server (confidence level: 100%)
hash5603
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash80
Nimplant botnet C2 server (confidence level: 100%)
hash54412
Cobalt Strike botnet C2 server (confidence level: 75%)
hash443
Cobalt Strike botnet C2 server (confidence level: 75%)
hash2096
Cobalt Strike botnet C2 server (confidence level: 75%)
hash443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash443
Havoc botnet C2 server (confidence level: 100%)
hash1201
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash28015
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash443
Brute Ratel C4 botnet C2 server (confidence level: 100%)
hash4782
Quasar RAT botnet C2 server (confidence level: 100%)
hash60000
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash8443
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash63333
Unknown malware botnet C2 server (confidence level: 100%)
hash3334
Unknown malware botnet C2 server (confidence level: 100%)
hash12629
NjRAT botnet C2 server (confidence level: 75%)
hash12629
NjRAT botnet C2 server (confidence level: 75%)
hash12629
NjRAT botnet C2 server (confidence level: 75%)
hash9912
Rhadamanthys botnet C2 server (confidence level: 100%)
hash7077
AsyncRAT botnet C2 server (confidence level: 100%)
hash1912
RedLine Stealer botnet C2 server (confidence level: 100%)
hash1912
RedLine Stealer botnet C2 server (confidence level: 100%)
hash4782
Quasar RAT botnet C2 server (confidence level: 100%)
hash8443
Cobalt Strike botnet C2 server (confidence level: 50%)
hash18888
Cobalt Strike botnet C2 server (confidence level: 50%)
hash2053
Cobalt Strike botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash10001
Xtreme RAT botnet C2 server (confidence level: 50%)
hash10001
Xtreme RAT botnet C2 server (confidence level: 50%)
hash80
Ghost RAT botnet C2 server (confidence level: 50%)
hash45668
Mozi botnet C2 server (confidence level: 50%)
hash5557
AsyncRAT botnet C2 server (confidence level: 50%)
hash2009
DCRat botnet C2 server (confidence level: 50%)
hash8848
DCRat botnet C2 server (confidence level: 50%)
hash1070
Remcos botnet C2 server (confidence level: 50%)
hash14645
Remcos botnet C2 server (confidence level: 50%)
hash14646
Remcos botnet C2 server (confidence level: 50%)
hash3132
SpyNote botnet C2 server (confidence level: 50%)
hash7000
XWorm botnet C2 server (confidence level: 50%)
hash7575
Bashlite botnet C2 server (confidence level: 75%)
hash443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash8888
Cobalt Strike botnet C2 server (confidence level: 100%)
hash61234
Cobalt Strike botnet C2 server (confidence level: 100%)
hash443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash2404
Remcos botnet C2 server (confidence level: 100%)
hash6606
AsyncRAT botnet C2 server (confidence level: 100%)
hash2222
AsyncRAT botnet C2 server (confidence level: 100%)
hash443
Unknown malware botnet C2 server (confidence level: 100%)
hash80
Hook botnet C2 server (confidence level: 100%)
hash80
Hook botnet C2 server (confidence level: 100%)
hash80
Hook botnet C2 server (confidence level: 100%)
hash4782
Quasar RAT botnet C2 server (confidence level: 100%)
hash443
Havoc botnet C2 server (confidence level: 100%)
hash8080
Orcus RAT botnet C2 server (confidence level: 100%)
hash1998
DCRat botnet C2 server (confidence level: 100%)
hash6957
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash82
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash9000
Unknown malware botnet C2 server (confidence level: 100%)
hash80
Cobalt Strike botnet C2 server (confidence level: 100%)
hash1234
Cobalt Strike botnet C2 server (confidence level: 100%)
hash443
QakBot botnet C2 server (confidence level: 75%)
hash443
DeimosC2 botnet C2 server (confidence level: 75%)
hash443
Meterpreter botnet C2 server (confidence level: 75%)
hash443
DarkWatchman botnet C2 server (confidence level: 75%)
hash8080
Cobalt Strike botnet C2 server (confidence level: 100%)
hash4444
Cobalt Strike botnet C2 server (confidence level: 100%)
hash443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash8081
Cobalt Strike botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash9969
AsyncRAT botnet C2 server (confidence level: 100%)
hash8848
DCRat botnet C2 server (confidence level: 100%)
hash13858
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash8080
Chaos botnet C2 server (confidence level: 100%)
hash23
Bashlite botnet C2 server (confidence level: 100%)
hash80
Bashlite botnet C2 server (confidence level: 100%)
hash1988
Remcos botnet C2 server (confidence level: 100%)
hash443
FAKEUPDATES payload delivery server (confidence level: 100%)
hash32891
Mirai botnet C2 server (confidence level: 100%)
hash14645
Remcos botnet C2 server (confidence level: 75%)
hash8080
Cobalt Strike botnet C2 server (confidence level: 75%)
hash8080
Cobalt Strike botnet C2 server (confidence level: 75%)
hash443
Cobalt Strike botnet C2 server (confidence level: 75%)
hash10861
ValleyRAT botnet C2 server (confidence level: 100%)
hash47666
Remcos botnet C2 server (confidence level: 75%)
hash9898
Cobalt Strike botnet C2 server (confidence level: 50%)
hash12345
Cobalt Strike botnet C2 server (confidence level: 50%)
hash443
Cobalt Strike botnet C2 server (confidence level: 50%)
hash31022
NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash6001
NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash3333
Unknown malware botnet C2 server (confidence level: 50%)
hash33338
Unknown malware botnet C2 server (confidence level: 50%)
hash31337
Sliver botnet C2 server (confidence level: 50%)
hash10001
Xtreme RAT botnet C2 server (confidence level: 50%)
hash443
Ghost RAT botnet C2 server (confidence level: 50%)
hash9151
Unknown malware botnet C2 server (confidence level: 50%)
hash49443
Mozi botnet C2 server (confidence level: 50%)
hash222
AsyncRAT botnet C2 server (confidence level: 100%)
hash7443
Unknown malware botnet C2 server (confidence level: 100%)
hash80
Hook botnet C2 server (confidence level: 100%)
hash80
Quasar RAT botnet C2 server (confidence level: 100%)
hash10135
Orcus RAT botnet C2 server (confidence level: 100%)
hash80
MooBot botnet C2 server (confidence level: 100%)
hash443
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash3306
Unknown malware botnet C2 server (confidence level: 100%)
hash3333
Unknown malware botnet C2 server (confidence level: 100%)
hash8080
Unknown malware botnet C2 server (confidence level: 100%)
hash46167
Remcos botnet C2 server (confidence level: 100%)
hash8080
Remcos botnet C2 server (confidence level: 100%)
hash80
Remcos botnet C2 server (confidence level: 100%)
hash443
pupy botnet C2 server (confidence level: 100%)
hash8808
AsyncRAT botnet C2 server (confidence level: 100%)
hash60127
NjRAT botnet C2 server (confidence level: 75%)
hash61465
NjRAT botnet C2 server (confidence level: 75%)
hash53
Cobalt Strike botnet C2 server (confidence level: 75%)
hash5939
XWorm botnet C2 server (confidence level: 75%)
hash55615
RedLine Stealer botnet C2 server (confidence level: 100%)
hash443
WarmCookie botnet C2 server (confidence level: 100%)
hash443
Cobalt Strike botnet C2 server (confidence level: 100%)
hash80
Cobalt Strike botnet C2 server (confidence level: 100%)
hash35889
Remcos botnet C2 server (confidence level: 100%)
hash7000
AsyncRAT botnet C2 server (confidence level: 100%)
hash7443
Unknown malware botnet C2 server (confidence level: 100%)
hash40056
Havoc botnet C2 server (confidence level: 100%)
hash21997
NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash443
PoshC2 botnet C2 server (confidence level: 100%)
hash80
MimiKatz botnet C2 server (confidence level: 100%)
hash443
QakBot botnet C2 server (confidence level: 75%)
hash443
QakBot botnet C2 server (confidence level: 75%)
hash9090
ValleyRAT botnet C2 server (confidence level: 100%)
hash7777
ValleyRAT botnet C2 server (confidence level: 100%)

Threat ID: 682c7db7e8347ec82d2be417

Added to database: 5/20/2025, 1:03:51 PM

Last enriched: 6/19/2025, 4:16:40 PM

Last updated: 8/13/2025, 6:46:33 PM

Views: 20

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

External Links

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats