TF-1815721 medium

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Unknown malware. Confidence: 50. First seen: 2026-05-17 18:50:49 UTC. Reporter: anonymous.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Unknown malware. Confidence: 50. First seen: 2026-05-17 18:50:49 UTC. Reporter: anonymous.

• Botnet Malware Analysis, Overview by ANY.RUN
  web:any.run

  Botnet malware can be delivered through various means, including phishing emails, malware -infected websites, and even USB drives. Once a device becomes infected, the botnet malware establishes a connection with a command-and-control (C&C) server, essentially becoming a node in the botnet network.

  2026-05-22 05:14 UTC
• C2 Tracker - Community-Driven Malware and C2 Monitoring Tool
  web:ethicalhacksacademy.com

  C2 Tracker is a free, community-driven Indicator of Compromise (IOC) feed designed to track IP addresses associated with known malware , botnets , and Command-and-Control (C2) infrastructure.

  2026-05-22 05:14 UTC
• Feodo Tracker | Blocklist
  web:feodotracker.abuse.ch

  Botnet C2 IP Blocklist Dridex, Heodo (aka Emotet), TrickBot, QakBot (aka QuakBot / Qbot) and BazarLoader (aka BazarBackdoor) botnet command&control servers (C2s) usually reside on compromised servers and such that have been rented and setup by the threat actor itself for the sole purpose of botnet hosting.

  2026-05-22 05:14 UTC
• Botnet Infection Findings - Bitsight Knowledge Base
  web:help.bitsighttech.com

  ⇤ Compromised Systems Findings The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navi...

  2026-05-22 05:14 UTC
• Malware Hunter
  web:malware-hunter.shodan.io

  Malware Hunter is a specialized Shodan crawler that explores the Internet looking for command & control (C2s) servers for botnets . It does this by pretending to be an infected client that's reporting back to a C2.

  2026-05-22 05:14 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  2026-05-22 05:14 UTC
• Botnet C&C Data Feeds | OEM Technology Solutions - Kaspersky
  web:www.kaspersky.com

  Kaspersky Botnet C&C Data Feeds Kaspersky Botnet C&C Data Feeds are sets of URLs and hashes with actionable content (threat names, timestamps, geolocations, resolved IPs of infected web resources, associated malware hashes, and so on) covering desktop and mobile botnet servers and related malicious objects.

  2026-05-22 05:14 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  Botnet detection involves identifying networks of infected computers controlled by attackers to perform malicious activities. Early detection can prevent substantial damage to systems and networks, requiring techniques to monitor and analyze behavior patterns, traffic anomalies, and communication protocols.

  2026-05-22 05:14 UTC
• Live botnet threats worldwide | Spamhaus Technology
  web:www.spamhaus.com

  Explore the Spamhaus Live Botnet Threat Map. Track global botnet activity in real time and see where malware and infected devices are operating worldwide.

  2026-05-22 05:14 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware -infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 05:14 UTC

Only Available for Registered Users. Sign in to view.