TF-1811917
low
📛 Threat Title
CountLoader: Domain that is used for botnet Command&control (C&C) bucket-aws-s2.com
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: CountLoader. Confidence: 49. First seen: 2026-05-13 18:34:41 UTC. Reporter: johannes.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
104.21.46.34
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/104.21.46.34
IOC database
- Type
- ipv4
- Value
104.21.46.34- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from domain bucket-aws-s2.com
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/104.21.46.34
ipv4
172.67.223.34
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/172.67.223.34
IOC database
- Type
- ipv4
- Value
172.67.223.34- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from domain bucket-aws-s2.com
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/172.67.223.34
domain
bucket-aws-s2.com
UrlVoid 5 / 35
IOC database
- Type
- domain
- Value
bucket-aws-s2.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to CountLoader
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: CountLoader. Confidence: 49. First seen: 2026-05-13 18:34:41 UTC. Reporter: johannes.
- External reference Threatfox IOCs/Threats
Remediations (10)
-
web:101.school
Command and Control (C&C) servers play a crucial role in the operation of botnets and other forms of malware. They serve as the central hub from which cybercriminals can control infected machines, known as 'bots'.
-
web:docs.fortinet.com
This recipe uses a new FortiGuard feature: the Botnet C&C (command and control) database to protect your network from Botnet C&C attacks. For this recipe, you will create a new DNS Filter Profile called Botnet&Facebook, block access to all known C&C addresses, and block access to the Social Networking FortiGuard category.
-
web:docs.fortinet.com
The Fortinet Cookbook contains examples of how to integrate Fortinet products into your network and use features such as security profiles, wireless networking, and VPN. Using the Cookbook, you can go from idea to execution in simple steps, configuring a secure network for better productivity with reduced risk.
-
web:docs.fortinet.com
From your internal network PC, use a command line tool, such as dig or nslookup, to query this domain and verify that it is blocked by the DNS filter botnet C&C .
-
web:exchange.xforce.ibmcloud.com
IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers
-
web:networkthreatdetection.com
Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.
-
web:sites.cs.ucsb.edu
To this end, one requires techniques that can detect command and control (C&C) traffic, as well as the servers that host C&C services. Given the knowledge of a C&C server's IP address, one can use this in-formation to detect all hosts that attempt to contact such a server, and subsequently disinfect, disable, or block the infected machines.
-
web:www.blackhat.com
This research is primarily focused on the use of penetration testing approach to nd fundamental weaknesses and con guration aws re-siding in Command and Control (C&C) panels used by bot herders to manage botnets . This paper generalizes the ndings that have been noticed during testing and analysis of several C&C panels.
-
web:www.mcafee.com
Sinkholing Sinkholing is a defensive technique in which researchers take control of malicious domains or infrastructure used by malware. Instead of allowing infected systems to communicate with attacker controlled C2 servers, the traffic is redirected to a researcher controlled server. This approach enables researchers to monitor infected hosts, collect telemetry, measure the scale and spread ...
-
web:www.spamhaus.org
The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.