TF-1861619 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Lynx. Confidence: 100. First seen: 2026-07-28 15:29:53 UTC. Reporter: TheRavenFile. Tags: lynx, Ransomware.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference ThreatFox IOCs
• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Lynx. Confidence: 100. First seen: 2026-07-28 15:29:53 UTC. Reporter: TheRavenFile. Tags: lynx, Ransomware.

• Botnet Infection Findings - Bitsight Knowledge Base
  web:help.bitsighttech.com

  ⇤ Compromised Systems Findings The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navi...

  2026-07-31 21:29 UTC
• Botnet Command and Control and the Geolocation of Botnets
  web:layerlogix.com

  Central to their operation is the Command and Control (C&C) infrastructure, which enables botmasters to issue instructions to infected machines. Understanding the mechanisms of C&C and the geolocation of botnets is crucial for developing effective countermeasures.

  2026-07-31 21:29 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  2026-07-31 21:29 UTC
• EDX Security Hub • Botnets Guide
  web:www.edxsecurityhub.org

  What is a Botnet ? A botnet (robot network) is a network of compromised computers, servers, IoT devices, and other internet-connected devices (bots or zombies) controlled remotely by an attacker (botmaster or bot herder). Each bot is infected with malware that allows the botmaster to issue commands via Command & Control (C2 or C&C ) servers. Botnets are used to perform large-scale cyberattacks ...

  2026-07-31 21:29 UTC
• Botnet Command and Control Infrastructure - LinkedIn
  web:www.linkedin.com

  The command and control (C&C) infrastructure is the backbone of a botnet . It is how botmasters (the attackers controlling the botnet ) communicate with compromised devices.

  2026-07-31 21:29 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  2026-07-31 21:29 UTC
• Live botnet threats worldwide | Spamhaus Technology
  web:www.spamhaus.com

  The IP address locations of botnet command and control servers being used to control computers infected with malware.

  2026-07-31 21:29 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  About the Data The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-07-31 21:29 UTC
• Botnet C&C | Botnet Threat Update July to December 2024 | Report
  web:www.spamhaus.org

  Overall botnet command control (C&C) activity decreased marginally by -4% between July and December last year. China dominated the Top 20 charts with increased botnet C&C activity across domain registrars and networks, ranking #1 globally for hosting botnet C&C servers.

  2026-07-31 21:29 UTC
• Controller Feed - Team Cymru
  web:www.team-cymru.com

  Controller Feed Entries Include Near-real-time identification of botnet command and control (C&C) IP addresses (IRC, http, and P2P) built for DDoS, warez, and underground economy to include bot types, passwords, channels, and our insight. Contains all confirmed, active botnet , warez, underground economy and other malware distribution command ...

  2026-07-31 21:29 UTC

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.