TF-1843487 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown Stealer. Confidence: 100. First seen: 2026-07-02 11:44:13 UTC. Reporter: lucibee. Tags: IRAHook.

Indicators of Compromise (2)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown Stealer. Confidence: 100. First seen: 2026-07-02 11:07:34 UTC. Reporter: lucibee. Tags: IRAHook.

• BOTNET THREAT UPDATES - Spamhaus Technology
  web:info.spamhaus.com

  BOTNET THREAT UPDATES Find analysis from Spamhaus Project on the number of botnet command & control (C&C) servers observed and their associated elements.

  2026-08-07 00:34 UTC
• Botnet Threat Update July to December 2025 - Security Boulevard
  web:securityboulevard.com

  Networks hosting botnet C&Cs : Same players, same problems With every Botnet Threat Update we publish, the same networks consistently appear in the Top 20 for hosting botnet command and control (C&C) servers. But why does this keep happening? In this Botnet Spotlight, we look into the root causes behind this persistent issue and what networks must do to break the cycle.

  2026-08-07 00:34 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware and botnet -related cyber threats.

  2026-08-07 00:34 UTC
• How to Defend Against Botnets - GeeksforGeeks
  web:www.geeksforgeeks.org

  At this point, the infected devices are connected and controlled remotely through a central command-and-control (C&C) server. The attacker can command these devices, to perform tasks like sending spam, participating in distributed denial-of-service (DDoS) attacks, or stealing data. How to Prevent Botnet Attacks?

  2026-08-07 00:34 UTC
• ACR Stealer: Two observed intrusion chains amid increased threat ...
  web:www.microsoft.com

  From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.

  2026-08-07 00:34 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  2026-08-07 00:34 UTC
• Best Botnet Defense Tools: Top 8 Solutions in 2026 | Radware
  web:www.radware.com

  Organizations deploy botnet defense tools to identify infected devices, disrupt command-and-control (C&C) communications, and block malicious traffic originating from these networks.

  2026-08-07 00:34 UTC
• Live botnet threats worldwide | Spamhaus Technology
  web:www.spamhaus.com

  Explore the Spamhaus Live Botnet Threat Map. Track global botnet activity in real time and see where malware and infected devices are operating worldwide.

  2026-08-07 00:34 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  About the Data The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-08-07 00:34 UTC
• Botnet C&C | Blogs, news articles and reports | Spamhaus
  web:www.spamhaus.org

  With every Botnet Threat Update we publish, the same networks consistently appear in the Top 20 for hosting botnet command and control (C&C) servers. But why does this keep happening?

  2026-08-07 00:34 UTC

Only Available for Registered Users. Sign in to view.