TF-1861608 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Lynx. Confidence: 100. First seen: 2026-07-28 15:29:58 UTC. Reporter: TheRavenFile. Tags: lynx, Ransomware.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference ThreatFox IOCs
• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Lynx. Confidence: 100. First seen: 2026-07-28 15:29:58 UTC. Reporter: TheRavenFile. Tags: lynx, Ransomware.

• Botnet C&C domain list · Issue #2549 · StevenBlack/hosts - GitHub
  web:github.com

  I try to find a combined botnet command-and-control ( c&c or c2) domain list to protect the IoT devices, but seems not available yet in the environment. Would this be considered ?

  2026-07-31 19:00 UTC
• Botnet Infection Findings - Bitsight Knowledge Base
  web:help.bitsighttech.com

  ⇤ Compromised Systems Findings The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navi...

  2026-07-31 19:00 UTC
• Botnet Command and Control and the Geolocation of Botnets
  web:layerlogix.com

  Central to their operation is the Command and Control (C&C) infrastructure, which enables botmasters to issue instructions to infected machines. Understanding the mechanisms of C&C and the geolocation of botnets is crucial for developing effective countermeasures.

  2026-07-31 19:00 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  How can you recognize botnet command and control when dealing with C&C servers or a botnet control server? Recognizing botnet command and control often comes down to spotting odd traffic patterns tied to C&C servers.

  2026-07-31 19:00 UTC
• EDX Security Hub • Botnets Guide
  web:www.edxsecurityhub.org

  What is a Botnet ? A botnet (robot network) is a network of compromised computers, servers, IoT devices, and other internet-connected devices (bots or zombies) controlled remotely by an attacker (botmaster or bot herder). Each bot is infected with malware that allows the botmaster to issue commands via Command & Control (C2 or C&C ) servers. Botnets are used to perform large-scale cyberattacks ...

  2026-07-31 19:00 UTC
• Botnet Command and Control Infrastructure - LinkedIn
  web:www.linkedin.com

  The command and control (C&C) infrastructure is the backbone of a botnet . It is how botmasters (the attackers controlling the botnet ) communicate with compromised devices.

  2026-07-31 19:00 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  2026-07-31 19:00 UTC
• Live botnet threats worldwide | Spamhaus Technology
  web:www.spamhaus.com

  The IP address locations of botnet command and control servers being used to control computers infected with malware.

  2026-07-31 19:00 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  About the Data The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-07-31 19:00 UTC
• NEW: Spamhaus CERT Insight Portal - Spamhaus Project
  web:www.spamhaus.org

  Introduction What is Spamhaus CERT Insight Portal? Enriched data: Botnet C&C activity in your region Using the portal: Even better functionality How can I access the portal? In 2025, botnet command & controller (C&C) activity detected by Spamhaus increased 56% - a stark reminder that the botnet threat landscape is evolving faster than ever.

  2026-07-31 19:00 UTC

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.