TF-1815668 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Remus. Confidence: 100. First seen: 2026-05-17 16:06:37 UTC. Reporter: abuse_ch. Tags: RemusStealer.

Indicators of Compromise (2)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Remus. Confidence: 100. First seen: 2026-05-17 16:06:37 UTC. Reporter: abuse_ch. Tags: RemusStealer.

• Identification of Command and Control Servers
  web:101.school

  Payload Analysis: The payload of a botnet's communication can often provide clues about the location of the C&C server. This could include IP addresses, domain names, or other identifiable information. Mitigation Strategies for C&C Servers Once a C&C server has been identified, there are several strategies that can be used to mitigate its impact:

  2026-05-22 05:15 UTC
• Botnet C&C domain blocking | FortiGate / FortiOS 7.6.4 | Fortinet ...
  web:docs.fortinet.com

  From your internal network PC, use a command line tool, such as dig or nslookup, to query this domain and verify that it is blocked by the DNS filter botnet C&C .

  2026-05-22 05:15 UTC
• Recently categorized IP addresses for Botnet Command and Control Server
  web:exchange.xforce.ibmcloud.com

  IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers

  2026-05-22 05:15 UTC
• Detect C2: Best Practices for C&C Traffic Identification
  web:hunt.io

  Learn how to detect C2 traffic using advanced methods like network analysis and DNS monitoring to protect your network from cyber threats. Learn more.

  2026-05-22 05:15 UTC
• PDF Spamhaus Botnet Threat Update
  web:info.spamhaus.com

  About this report Spamhaus tracks both Internet Protocol (IP) addresses and domain names used by threat actors for hosting botnet command & control (C&C) servers. This data enables us to identify associated elements, including the geolocation of the botnet C&Cs , the malware associated with them, the top-level domains used when registering a domain for a botnet C&C , the sponsoring registrars ...

  2026-05-22 05:15 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  How can you recognize botnet command and control when dealing with C&C servers or a botnet control server? Recognizing botnet command and control often comes down to spotting odd traffic patterns tied to C&C servers.

  2026-05-22 05:15 UTC
• Command and Control (C&C) Attacks - CrowdStrike
  web:www.crowdstrike.com

  What are command and control attacks? C&C (also known as C2) is a method that cybercriminals use to communicate with compromised devices within a target company's network. In a C&C attack, an attacker uses a server to send commands to — and receive data from — computers compromised by malware. This server is also known as a C2 or C&C server. The attacker can use the server to perform ...

  2026-05-22 05:15 UTC
• PDF DNS Abuse Prevention, Remediation, and Mitigation Practices for ...
  web:www.m3aawg.org

  They may also make use of a domain generation algorithm to dynamically create lists of potential command-and-control domains to ensure the botmaster can regain control of his botnet if their primary C&C host is suspended or rendered unreachable.

  2026-05-22 05:15 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 05:15 UTC
• Modern C2 Attacks: Detect & Defend Command-and-Control
  web:www.splunk.com

  Learn how command-and-control (C2) attacks work, including emerging stealth techniques, real-world examples, and modern detection using AI and behavioral analysis.

  2026-05-22 05:15 UTC

Only Available for Registered Users. Sign in to view.