Skip to content

Public IOC feed / Command and control

Command and control

Servers that malware and operators use to send instructions and receive results.

402 high-confidence indicators from the last 30 days of security reporting. Free, refreshed hourly, no login, CC-BY.

Files

With an API key: /api/public/v1/iocs/feed?category=c2. API reference

Newest indicators

Showing 100 of 402.

  • 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1 sha256, 5 Nov

    Hash of a malicious backdoor delivered to targets Source

  • 112.121.185.218 ipv4, 4 Nov

    IP address identified as hosting attacker infrastructure Source

  • 89.127.233.127 ipv4, 4 Nov

    Listed as an attacker IP that was shut down Source

  • verify.build-standards.org domain, 3 Nov

    Used as a command and validation domain for backdoored packages. Source

  • 652508a9cf40bee883dc0e5e219dfeba71fe7dac591d01c89f74c21f73b4963f sha256, 3 Nov

    Listed as a Rekoobe-based backdoor in the threat report Source

  • a6f3b7f932761fb1fd5e74123f2482e36c65dd13e769af2ce08c65da195bfa7a sha256, 3 Nov

    Listed as a BPFDoor sample in the threat report Source

  • analysis.shixunsuda.com domain, 2 Nov

    Listed as a command and control server for XCPE Source

  • anyevonline.com domain, 2 Nov

    Used for initial bootstrap, registration, and configuration by malware Source

  • collection.shixunsuda.com domain, 2 Nov

    Listed as a command and control server for XCPE Source

  • edisajalsjfdfh.shop domain, 2 Nov

    Listed as part of the command and control infrastructure Source

  • geo-loadbalanced.com domain, 2 Nov

    Listed as part of the command and control infrastructure Source

  • haimnsgsjhansj.shop domain, 2 Nov

    Listed as part of the command and control infrastructure Source

  • hiddeninplainsight.top domain, 2 Nov

    Listed as part of the command and control infrastructure Source

  • ishuoabh3years.online domain, 2 Nov

    Listed as part of the command and control infrastructure Source

  • jaguar-distributor.logreporter.com domain, 2 Nov

    Listed as part of the command and control infrastructure Source

  • jaguar-distributor.syslogcollector.com domain, 2 Nov

    Listed as part of the command and control infrastructure Source

  • 219.134.163.210 ipv4, 2 Nov

    Used as a host for MQTT broker in the campaign Source

  • 219.134.163.211 ipv4, 2 Nov

    Used as a host for MQTT broker in the campaign Source

  • mqtt.anyevonline.com domain, 2 Nov

    Used as the main administrator panel for operators Source

  • rivingtonclarks.com domain, 2 Nov

    Domain used as C2 panel for PapRAT Source

  • www.chestergreenfarming.com domain, 2 Nov

    Domain used as decoded C2 server Source

  • www.rivingtonclarks.com domain, 2 Nov

    Domain used as C2 URL for PapRAT Source

  • arthurshelby.click domain, 10 Oct

    Domain used for C2 registration and subdomain generation by malware Source

  • newroztelecom.digital domain, 2 Nov

    Part of the supporting network infrastructure for C2 operations. Source

  • ns2.arthurshelby.click domain, 2 Nov

    Nameserver associated with attacker-controlled domains. Source

  • ns2.speed-test.click domain, 2 Nov

    Nameserver associated with attacker-controlled domains. Source

  • speed-test.click domain, 2 Nov

    Listed as part of the supporting network infrastructure for C2 operations. Source

  • 195.16.74.137 ipv4, 2 Nov

    Listed as a C2 IP address. Source

  • 195.16.74.138 ipv4, 10 Oct

    IP address associated with attacker-controlled domain Source

  • meetingapp.site domain, 2 Nov

    Associated with command-and-control infrastructure for malware. Source

  • extstb.anyevonline.com domain, 2 Nov

    Used for device information collection and task distribution Source

  • 71f52519aae77fb20448ea065caa55750bcd73cf425aab203277032e260a1981 sha256, 2 Nov

    Listed as a representative SHA256 hash of malicious software Source

  • ff96f093bbac32654db62ebb33276c64cd30eb25a0bc11e66608ca40efb1bbdc sha256, 2 Nov

    Package fetched from operator Github, indicating attacker control Source

  • aideck.net domain, 2 Nov

    Used as a C2 server for Manuscrypt malware Source

  • dafnefonseca.com domain, 2 Nov

    Listed as a C2 endpoint for malware Source

  • greenvideo.nl domain, 2 Nov

    Listed as a C2 endpoint for malware Source

  • infodigitalnew.com domain, 2 Nov

    Listed as a C2 endpoint for malware Source

  • sche-eg.org domain, 2 Nov

    Listed as a C2 endpoint for malware Source

  • 9578c2be6437dcc8517e78a5de1fa975 md5, 2 Nov

    Listed as a malware sample hash Source

  • 41f855b54bf3db621b340b7c59722fb493ba39a5 sha1, 2 Nov

    Listed as a malware sample hash Source

  • ae9f4e39c576555faadee136c6c3b2d358ad90b9 sha1, 2 Nov

    Listed as a malware sample hash Source

  • d2a77c31c3e169bec655068e96cf4e7fc52e77b8 sha1, 2 Nov

    Listed as a malware sample hash Source

  • my.thispc.net domain, 2 Nov

    Domain used for C2 beaconing in the phishing campaign Source

  • com.ucreator.tg domain, 26 Oct

    Part of the uCreator platform framework and command handlers Source

  • hpncallback.gold5play.com domain, 26 Oct

    Listed as a callback domain for C2 and payload delivery Source

  • hpncallback.qianxunlbs.com domain, 26 Oct

    Listed as a callback domain for C2 and payload delivery Source

  • hw.android.videoflow.cn domain, 26 Oct

    Used for version uploads in the attack infrastructure Source

  • qianxuncc.cn domain, 26 Oct

    Associated with C2 infrastructure Source

  • qianxunlbs.com domain, 1 Nov

    Listed as a callback domain for C2 and payload delivery Source

  • ucreater.com domain, 26 Oct

    Linked to the uCreator brand and infrastructure Source

  • videoflow.cn domain, 26 Oct

    Associated with C2 infrastructure Source

  • 511mma.ru domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • bagolone.it domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • eolienzaer.com domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • grandseosite91.shop domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • hahashoe.com domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • iqos-one.com domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • komplek.id domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • moreultras.store domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • offon33fv.club domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • revelintravel.com domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • snvipvn.com domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • sonhero.top domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • tomatox.com.tw domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • www.990match.com domain, 1 Nov

    Listed as part of a C2 infrastructure for XLoader Source

  • openaigpt4v.com domain, 1 Nov

    Identified as a C2 server for malicious activity Source

  • 79.43.178.226 ipv4, 30 Oct

    Used as a C2 server by the attacker Source

  • 45.94.47.224 ipv4, 30 Oct

    Configured as a C2 server in the attacker's setup Source

  • 87.120.219.26 ipv4, 30 Oct

    Identified as a C2 server in the attacker's configuration Source

  • maxwintodaybtc.com domain, 29 Oct

    Specified as a C2 server in the attacker's configuration Source

  • 144.31.244.184 ipv4, 30 Oct

    Listed as part of C2 infrastructure Source

  • 46.151.182.28 ipv4, 30 Oct

    Listed as part of C2 infrastructure Source

  • 78.159.156.74 ipv4, 30 Oct

    Listed as an IP address used in a phishing campaign. Source

  • l1ewsu3yjkqeroy.xyz domain, 29 Oct

    Configured as a C2 sync endpoint for telemetry. Source

  • utaq.cfww.shop domain, 29 Oct

    Domain used for exploit modules and C2 infrastructure. Source

  • 180.178.50.158 ipv4, 29 Oct

    IP address used for C2 infrastructure. Source

  • ccsigen321qc.com domain, 29 Oct

    Configured as a C2 endpoint for command and control traffic. Source

  • vrgrt4t33.com domain, 29 Oct

    Domain used for telemetry transmission in the attack chain. Source

  • total-sitevv.lol domain, 29 Oct

    Domain resolves to an active NIK C2 server hosted by the threat actor. Source

  • 87.120.196.120 ipv4, 29 Oct

    IP address hosts the NIK C2 framework controlled by the threat actor. Source

  • kosoyed.online domain, 29 Oct

    Registered by attackers as a fallback C2 domain Source

  • kosoyed.ru domain, 29 Oct

    Registered by attackers as a fallback C2 domain Source

  • relay.pronconetydesire.online domain, 28 Oct

    Domain used for malicious ScreenConnect instance Source

  • kychelp.live domain, 28 Oct

    Listed in a MITRE ATT&CK rule as part of GhostGrab malware infrastructure Source

  • 189.249.195.244 ipv4, 28 Oct

    Identified as a Mythic-branded C2 interface Source

  • cobblestonecafe.us domain, 27 Oct

    Used as part of a malicious campaign infrastructure. Source

  • harborhouseplumbing.us domain, 27 Oct

    Used as part of a malicious campaign infrastructure. Source

  • novalineyoga.us domain, 27 Oct

    Domain with subdomains pointing to a C2 IP Source

  • reviewscene.com domain, 27 Oct

    Hosted on an IP associated with C2 infrastructure Source

  • dedyn.io domain, 27 Oct

    Used as a dynamic DNS for attacker-controlled infrastructure. Source

  • 64.95.10.223 ipv4, 26 Oct

    Listed as MATCHBOIL C&C IP Source

  • 64.95.13.210 ipv4, 26 Oct

    Listed as MATCHBOIL C&C IP Source

  • F886B615CB9E23EAD2718FF2A61155ACFB04CE9E sha1, 26 Oct

    SHA-1 hash of a MATCHBOIL malware sample Source

  • ccmihr.com domain, 19 Oct

    Domain used as a C2 server responding with tasks for malware Source

  • vrf.apexaccs.org domain, 16 Oct

    Domain used to obtain commands from attacker's C2 server Source

  • 127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274 sha256, 16 Oct

    Listed as a malicious file hash in a threat report Source

  • a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8 sha256, 25 Oct

    SHA256 hash of a macOS Rust executable used in malicious activity Source

  • malwarescan.xyz domain, 25 Oct

    Domain registered and likely operated by the attacker for malicious purposes Source

  • 103.249.201.108 ipv4, 25 Oct

    Listed as a C2 IP address associated with the campaign Source

  • 191.37.28.160 ipv4, 25 Oct

    Listed as additional infrastructure used during the campaign Source

Think one of these is wrong? Email [email protected].

Other categories