TF-1815700 medium

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown malware. Confidence: 50. First seen: 2026-05-17 18:47:17 UTC. Reporter: anonymous.

Indicators of Compromise (2)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown malware. Confidence: 50. First seen: 2026-05-17 18:47:17 UTC. Reporter: anonymous.

• Malware and Network / Identification of Command and Control Servers
  web:101.school

  Identification of Command and Control Servers Collection of compromised internet-connected devices controlled by a third party. Command and Control (C&C) servers play a crucial role in the operation of botnets and other forms of malware . They serve as the central hub from which cybercriminals can control infected machines, known as 'bots'.

  2026-05-22 05:14 UTC
• How to Stop Command and Control Attacks at the Source - Cymulate
  web:cymulate.com

  Domain Generation Algorithm - Locky Trojan C&C : The Locky Trojan is a notorious malware strain that has been used in several high-profile attacks. One of its features is a Domain Generation Algorithm (DGA), which generates a list of domain names that the malware uses to communicate with its C&C server.

  2026-05-22 05:14 UTC
• Botnet C&C domain blocking | FortiGate / FortiOS 7.6.4 | Fortinet ...
  web:docs.fortinet.com

  From your internal network PC, use a command line tool, such as dig or nslookup, to query this domain and verify that it is blocked by the DNS filter botnet C&C .

  2026-05-22 05:14 UTC
• C2 Tracker - Community-Driven Malware and C2 Monitoring Tool
  web:ethicalhacksacademy.com

  C2 Tracker is a free, community-driven Indicator of Compromise (IOC) feed designed to track IP addresses associated with known malware , botnets , and Command-and-Control (C2) infrastructure.

  2026-05-22 05:14 UTC
• Botnet Infection Findings - Bitsight Knowledge Base
  web:help.bitsighttech.com

  ⇤ Compromised Systems Findings The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navi...

  2026-05-22 05:14 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  2026-05-22 05:14 UTC
• Command and Control (C&C) callback detection - Trend Micro
  web:success.trendmicro.com

  Some malware communicate with their C&C server to send and receive information. If a C&C callback is detected by the product, there is a high possibility that the host is infected. This article will tell you what to do in case of C&C callback detection.

  2026-05-22 05:14 UTC
• Botnet Command and Control Infrastructure - LinkedIn
  web:www.linkedin.com

  The command and control (C&C) infrastructure is the backbone of a botnet . It is how botmasters (the attackers controlling the botnet ) communicate with compromised devices.

  2026-05-22 05:14 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  Botnet detection involves identifying networks of infected computers controlled by attackers to perform malicious activities. Early detection can prevent substantial damage to systems and networks, requiring techniques to monitor and analyze behavior patterns, traffic anomalies, and communication protocols.

  2026-05-22 05:14 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware -infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 05:14 UTC

Only Available for Registered Users. Sign in to view.