TF-1861617 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Lynx. Confidence: 100. First seen: 2026-07-28 15:29:54 UTC. Reporter: TheRavenFile. Tags: lynx, Ransomware.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference ThreatFox IOCs
• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Lynx. Confidence: 100. First seen: 2026-07-28 15:29:54 UTC. Reporter: TheRavenFile. Tags: lynx, Ransomware.

• Command and Control, Tactic TA0011 - MITRE ATT&CK®
  web:attack.mitre.org

  Command and Control The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection.

  2026-07-31 16:08 UTC
• Botnet Infection Findings - Bitsight Knowledge Base
  web:help.bitsighttech.com

  ⇤ Compromised Systems Findings The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navi...

  2026-07-31 16:08 UTC
• Botnet Command and Control and the Geolocation of Botnets
  web:layerlogix.com

  Central to their operation is the Command and Control (C&C) infrastructure, which enables botmasters to issue instructions to infected machines. Understanding the mechanisms of C&C and the geolocation of botnets is crucial for developing effective countermeasures.

  2026-07-31 16:08 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  2026-07-31 16:08 UTC
• EDX Security Hub • Botnets Guide
  web:www.edxsecurityhub.org

  What is a Botnet ? A botnet (robot network) is a network of compromised computers, servers, IoT devices, and other internet-connected devices (bots or zombies) controlled remotely by an attacker (botmaster or bot herder). Each bot is infected with malware that allows the botmaster to issue commands via Command & Control (C2 or C&C ) servers. Botnets are used to perform large-scale cyberattacks ...

  2026-07-31 16:08 UTC
• Botnet Command and Control Infrastructure - LinkedIn
  web:www.linkedin.com

  The command and control (C&C) infrastructure is the backbone of a botnet . It is how botmasters (the attackers controlling the botnet ) communicate with compromised devices.

  2026-07-31 16:08 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  2026-07-31 16:08 UTC
• Live botnet threats worldwide | Spamhaus Technology
  web:www.spamhaus.com

  The IP address locations of botnet command and control servers being used to control computers infected with malware.

  2026-07-31 16:08 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  About the Data The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-07-31 16:08 UTC
• NEW: Spamhaus CERT Insight Portal - Spamhaus Project
  web:www.spamhaus.org

  Introduction What is Spamhaus CERT Insight Portal? Enriched data: Botnet C&C activity in your region Using the portal: Even better functionality How can I access the portal? In 2025, botnet command & controller (C&C) activity detected by Spamhaus increased 56% - a stark reminder that the botnet threat landscape is evolving faster than ever.

  2026-07-31 16:08 UTC

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.