TF-1861615 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Lynx. Confidence: 100. First seen: 2026-07-28 15:29:55 UTC. Reporter: TheRavenFile. Tags: lynx, Ransomware.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference ThreatFox IOCs
• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Lynx. Confidence: 100. First seen: 2026-07-28 15:29:55 UTC. Reporter: TheRavenFile. Tags: lynx, Ransomware.

• Identification of Command and Control Servers
  web:101.school

  Command and Control (C&C) servers play a crucial role in the operation of botnets and other forms of malware. They serve as the central hub from which cybercriminals can control infected machines, known as 'bots'.

  2026-07-30 03:36 UTC
• Botnet Infection Findings - Bitsight Knowledge Base
  web:help.bitsighttech.com

  ⇤ Compromised Systems Findings The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navi...

  2026-07-30 03:36 UTC
• Botnet Command and Control and the Geolocation of Botnets
  web:layerlogix.com

  Central to their operation is the Command and Control (C&C) infrastructure, which enables botmasters to issue instructions to infected machines. Understanding the mechanisms of C&C and the geolocation of botnets is crucial for developing effective countermeasures.

  2026-07-30 03:36 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  How can you recognize botnet command and control when dealing with C&C servers or a botnet control server? Recognizing botnet command and control often comes down to spotting odd traffic patterns tied to C&C servers.

  2026-07-30 03:36 UTC
• EDX Security Hub • Botnets Guide
  web:www.edxsecurityhub.org

  What is a Botnet ? A botnet (robot network) is a network of compromised computers, servers, IoT devices, and other internet-connected devices (bots or zombies) controlled remotely by an attacker (botmaster or bot herder). Each bot is infected with malware that allows the botmaster to issue commands via Command & Control (C2 or C&C ) servers. Botnets are used to perform large-scale cyberattacks ...

  2026-07-30 03:36 UTC
• Botnet Command and Control Infrastructure - LinkedIn
  web:www.linkedin.com

  The command and control (C&C) infrastructure is the backbone of a botnet . It is how botmasters (the attackers controlling the botnet ) communicate with compromised devices.

  2026-07-30 03:36 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  2026-07-30 03:36 UTC
• Live botnet threats worldwide | Spamhaus Technology
  web:www.spamhaus.com

  The IP address locations of botnet command and control servers being used to control computers infected with malware.

  2026-07-30 03:36 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots).

  2026-07-30 03:36 UTC
• NEW: Spamhaus CERT Insight Portal - Spamhaus Project
  web:www.spamhaus.org

  Botnet C&C report:botnet C&C servers active within your country or region. A botnet C&C server is infrastructure operated by cybercriminals to remotely issue commands to infected machines.

  2026-07-30 03:36 UTC

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.