TF-1811925 low

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown malware. Confidence: 49. First seen: 2026-05-13 18:39:12 UTC. Reporter: johannes. Tags: gamaredon.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference Threatfox IOCs/Threats
• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown malware. Confidence: 49. First seen: 2026-05-13 18:39:12 UTC. Reporter: johannes. Tags: gamaredon.

• Malware and Network / Identification of Command and Control Servers
  web:101.school

  Identification of Command and Control Servers Collection of compromised internet-connected devices controlled by a third party. Command and Control (C&C) servers play a crucial role in the operation of botnets and other forms of malware . They serve as the central hub from which cybercriminals can control infected machines, known as 'bots'.

  2026-05-22 00:35 UTC
• Technical Tip: Botnet C&C domain blocking | Community
  web:community.fortinet.com

  DescriptionThis article describes how to block C&C domain traffic.SolutionFortiGuard service continually updates the Botnet C&C domain list ( Domain DB). The botnet C&C domain blocking feature can block the botnet web site access at the DNS name resolving stage. This provides additional p...

  2026-05-22 00:35 UTC
• Firewall reports "botnet/c&c traffic detected" but cannot find malware ...
  web:community.spiceworks.com

  Hello, Our firewall reports "botnet/c&c traffic detected" from 2 workstations going to these 2 servers: 194.85.61.76 and 109.70.26.37. Both IPs are listed as malicious on various security sites. We ran Malwarebytes, Sophos Virus Removal Tool and HitmanPro on the machines but could not find anything. We hoped someone could recommend other tools to eliminate the threats.Thank you in ...

  2026-05-22 00:35 UTC
• Botnet: What It Is and How to Avoid Becoming Part of One | DDoS-Guard
  web:ddos-guard.net

  A botnet's control center is the command-and-control server ( C&C ), where all instructions from the botmaster are sent to infected devices. Depending on the architecture, the botnet can be commanded directly or via intermediaries.

  2026-05-22 00:35 UTC
• Botnet C&C domain blocking | FortiGate / FortiOS 7.6.4 | Fortinet ...
  web:docs.fortinet.com

  From your internal network PC, use a command line tool, such as dig or nslookup, to query this domain and verify that it is blocked by the DNS filter botnet C&C .

  2026-05-22 00:35 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  2026-05-22 00:35 UTC
• Command and Control (C&C) callback detection - Trend Micro
  web:success.trendmicro.com

  Some malware communicate with their C&C server to send and receive information. If a C&C callback is detected by the product, there is a high possibility that the host is infected. This article will tell you what to do in case of C&C callback detection.

  2026-05-22 00:35 UTC
• What is Botnet Malware: Structures, Botnet Attacks, & More
  web:trainings.internshala.com

  What is a Botnet ? The word 'botnet' is an amalgamation of two words, 'robot' and 'network'. A single device that has been infected with malware is referred to as a 'bot'. A botnet meaning can be understood as a group of computer systems, servers, or websites that get infected with malware . Malicious attackers who capture and control a botnet are known as 'botnet herders'. A ...

  2026-05-22 00:35 UTC
• Command and Control (C&C) Attacks - CrowdStrike
  web:www.crowdstrike.com

  What are command and control attacks? C&C (also known as C2) is a method that cybercriminals use to communicate with compromised devices within a target company's network. In a C&C attack, an attacker uses a server to send commands to — and receive data from — computers compromised by malware . This server is also known as a C2 or C&C server.

  2026-05-22 00:35 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware -infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 00:35 UTC

Only Available for Registered Users. Sign in to view.