s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1811915 low

📛 Threat Title

Unknown malware: URL that is used for botnet Command&control (C&C) https://virusblocker.it.com/11E6C6611E6C66

Category: Unknown malware First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Unknown malware. Confidence: 49. First seen: 2026-05-13 18:34:00 UTC. Reporter: johannes. Tags: FamousSparrow.

Indicators of Compromise (2)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

url https://virusblocker.it.com/11E6C6611E6C66 VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/urls/aHR0cHM6Ly92aXJ1c2Jsb2NrZXIuaXQuY29tLzExRTZDNjYxMUU2QzY2
UrlVoid 3 / 35

IOC database

Type
url
Value
https://virusblocker.it.com/11E6C6611E6C66
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat TF-1811915

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/urls/aHR0cHM6Ly92aXJ1c2Jsb2NrZXIuaXQuY29tLzExRTZDNjYxMUU2QzY2

url https://virusblocker.it.com/11e6c6611e6c66 UrlVoid 3 / 35

IOC database

Type
url
Value
https://virusblocker.it.com/11e6c6611e6c66
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
URL that is used for botnet Command&control (C&C) attributed to Unknown malware

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (3)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Unknown malware. Confidence: 49. First seen: 2026-05-13 18:34:00 UTC. Reporter: johannes. Tags: FamousSparrow.

  • External reference Threatfox IOCs/Threats

Remediations (10)

  • Botnet Malware Analysis, Overview by ANY.RUN
    web:any.run

    Botnet malware can be delivered through various means, including phishing emails, malware -infected websites, and even USB drives. Once a device becomes infected, the botnet malware establishes a connection with a command-and-control (C&C) server, essentially becoming a node in the botnet network.

  • An attempt to communicate with a botnet or command and control server ...
    web:community.sophos.com

    Intercept X is deployed throughout the network for our last client getting these reports of 'An attempt to communicate with a botnet or command and control server has been detected' from the XG firewall.

  • Botnet Infection Findings - Bitsight Knowledge Base
    web:help.bitsighttech.com

    ⇤ Compromised Systems Findings The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navi...

  • Recognizing Botnet Command and Control Made Simple
    web:networkthreatdetection.com

    Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  • What is Botnet Malware: Structures, Botnet Attacks, & More
    web:trainings.internshala.com

    Learn botnet malware and its functions. Discover the types of botnet attacks, their purposes, and the control structures that make a botnet function.

  • URLhaus | Malware URL exchange
    web:urlhaus.abuse.ch

    URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  • 4 Botnet Detection Techniques, Challenges & Best Practices
    web:www.radware.com

    Botnet detection involves identifying networks of infected computers controlled by attackers to perform malicious activities. Early detection can prevent substantial damage to systems and networks, requiring techniques to monitor and analyze behavior patterns, traffic anomalies, and communication protocols.

  • An attempt to communicate with a botnet or command and control ... - Reddit
    web:www.reddit.com

    Had a similar issue about a year ago in a client network. The source Ip in my case was an on-prem DNS server. I enabled logging on the dns server to track which device on the network was actually querying lookups to botnet sites. A host was infected and had a windows task scheduler to kick off twice a day. So look for clues like that in your net.

  • Live botnet threats worldwide | Spamhaus Technology
    web:www.spamhaus.com

    Explore the Spamhaus Live Botnet Threat Map. Track global botnet activity in real time and see where malware and infected devices are operating worldwide.

  • Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
    web:www.spamhaus.org

    The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware -infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.