Command and Controls

Name: Command and Controls
Creator: Maltiverse
Published: 2022-01-14

This feed allocates all the alive Command & Controls from different RAT's and Botnets. It generates low noise when used with border log sources like firewalls.

Author: agomez
Created: 2022-01-14 06:50:22
Last updated: 2026-02-09 20:14:11
Downloads: 22884515
IPv4 indicators: 2044
Hostname indicators: 149524
URL indicators: 16760

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

bacon-rumors.xyz Hostname

modified 2026-10-17 11:33:09
Unknown Stealer (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory)

mesh.rigeye.com Hostname

modified 2026-10-17 11:29:15
Tactical RMM (Maltiverse Threat Observatory)

https://mesh.rigeye.com:443/ URL

modified 2026-10-17 11:29:15
Tactical RMM (Maltiverse Threat Observatory)

www.yonginmh.co.kr Hostname

modified 2026-10-17 11:28:30
ARL (Maltiverse Threat Observatory)

https://www.yonginmh.co.kr:5003/ URL

modified 2026-10-17 11:28:30
ARL (Maltiverse Threat Observatory)

64.227.35.8 IPv4

modified 2026-10-17 11:25:16
Havoc (ThreatFox Abuse.ch)

modified 2026-10-17 11:25:16
PureRAT (ThreatFox Abuse.ch) · AsyncRAT (ThreatFox Abuse.ch) · Aisuru (ThreatFox Abuse.ch) · Aisuru (Maltiverse Threat Observatory) · Generic Malware (Maltiverse Threat Observatory)

j.88mdc.org Hostname

modified 2026-10-17 11:25:10
Vidar (ThreatFox Abuse.ch)

silverhost.vg Hostname

modified 2026-10-17 11:23:27
Exploit.Kitmalware (Maltiverse Threat Observatory) · Lumma stealer (Maltiverse Threat Observatory)

crimsonroundel.info Hostname

modified 2026-10-17 11:23:26
SmartApeSG (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory) · SmartApeSG (Maltiverse Threat Observatory) · Trojan.js.generic (Maltiverse Threat Observatory)

ritchie.click Hostname

modified 2026-10-17 11:23:18
KongTuke (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory) · Kongtuke (Maltiverse Threat Observatory)

umbergalleon.top Hostname

modified 2026-10-17 11:23:11
SmartApeSG (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory) · SmartApeSG (Maltiverse Threat Observatory) · Trojan.js.generic (Maltiverse Threat Observatory)

hazelcolonnade.net Hostname

fingerprint-verification.info Hostname

modified 2026-10-17 11:23:11
Clearfake (Maltiverse Threat Observatory) · ClickFix (Maltiverse Threat Observatory) · ClearFake (ThreatFox Abuse.ch) · IClickFix (ThreatFox Abuse.ch) · Trojan.js.generic (Maltiverse Threat Observatory)

fraitas.lol Hostname

modified 2026-10-17 11:23:09
KongTuke (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory) · Kongtuke (Maltiverse Threat Observatory)

umbernarthex.org Hostname

modified 2026-10-17 11:23:09
SmartApeSG (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory) · SmartApeSG (Maltiverse Threat Observatory) · Trojan.js.generic (Maltiverse Threat Observatory)

yarrowalcove.net Hostname

modified 2026-10-17 11:22:59
SmartApeSG (ThreatFox Abuse.ch) · SmartApeSG (Maltiverse Threat Observatory) · Generic Malware (Maltiverse Threat Observatory) · Trojan.js.generic (Maltiverse Threat Observatory)

npm-cache.com Hostname

modified 2026-10-17 11:22:55
Trojan.generic (Maltiverse Threat Observatory) · Unknown malware (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory)

root-cherry.com Hostname

modified 2026-10-17 11:22:54
ClearFake (ThreatFox Abuse.ch) · Clearfake (Maltiverse Threat Observatory)

https://tlapps.mx:3333/login URL

modified 2026-10-17 11:21:46
Gophish (Maltiverse Threat Observatory)

tlapps.mx Hostname

modified 2026-10-17 11:21:46
Gophish (Maltiverse Threat Observatory)

09090clami09090930032.duckdns.org Hostname

modified 2026-10-17 11:21:32
XWorm (ThreatFox Abuse.ch) · Xworm (Maltiverse Threat Observatory)

89.187.170.159 IPv4

modified 2026-10-17 11:21:19
VPN proton (Maltiverse Threat Observatory) · Proton (Maltiverse Threat Observatory) · VPN (IPWhois.io) · Generic Malware (Maltiverse Threat Observatory) · VPN ProtonVPN (Maltiverse Threat Observatory)

217.146.80.107 IPv4

modified 2026-10-17 11:19:10
Suspicious Host (AbuseIPDB) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · VPN (IPWhois.io) · IMAP Attacker (AbuseIPDB)

193.124.20.244 IPv4

modified 2026-10-17 11:17:41
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · VPN (IPWhois.io) · DNS Compromise (AbuseIPDB)

193.124.20.249 IPv4

193.124.20.246 IPv4

modified 2026-10-17 11:17:41
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · Known Attacker (AbuseIPDB) · DNS Poisoning (AbuseIPDB) · Proxy (AbuseIPDB)

193.124.20.243 IPv4

modified 2026-10-17 11:17:41
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · Mail Spammer (Blocklist.de) · SSH Attacker (Blocklist.de) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats)

193.124.20.247 IPv4

modified 2026-10-17 11:17:41
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · Proxy (AbuseIPDB) · VPN (IPWhois.io) · IMAP Attacker (AbuseIPDB)

193.124.20.248 IPv4

modified 2026-10-17 11:17:41
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · Proxy (AbuseIPDB) · DNS Compromise (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats)

188.166.68.252 IPv4

modified 2026-10-17 11:17:40
Bruteforce (Maltiverse) · HTTP Scrapper (Maltiverse) · VPN (Maltiverse) · Port Scanner (Maltiverse) · Hacking (Maltiverse)

185.226.196.12 IPv4

modified 2026-10-17 11:17:11
Suspicious Host (AbuseIPDB) · DDoS attack (AbuseIPDB) · IMAP Attacker (Blocklist.de) · Mail Spammer (Blocklist.de) · Proxy (AbuseIPDB)

185.226.197.33 IPv4

modified 2026-10-17 11:17:11
Suspicious Host (AbuseIPDB) · Mail Spammer (Blocklist.de) · DDoS attack (AbuseIPDB) · IoT Attacker (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch)

185.226.197.32 IPv4

modified 2026-10-17 11:17:11
Suspicious Host (AbuseIPDB) · HTTP Spammer (StopForumSpam.com) · Proxy (IPWhois.io) · VPN (IPWhois.io) · DDoS attack (AbuseIPDB)

78.24.180.210 IPv4

modified 2026-10-17 11:17:01
Generic Malware (Maltiverse Threat Observatory) · OWASP ZAP API (Maltiverse Threat Observatory) · VPN geonode (Maltiverse Threat Observatory) · Proxy (IPWhois.io) · HTTP Spammer (StopForumSpam.com)

165.154.129.220 IPv4

modified 2026-10-17 11:15:41
Mail Spammer (Abuseat.org) · HTTP Attacker (Blocklist.de) · Mail Spammer (Blocklist.de) · DDoS attack (AbuseIPDB) · DNS Poisoning (AbuseIPDB)

121.197.0.121 IPv4

modified 2026-10-17 11:12:41
Mail Spammer (Abuseat.org) · HTTP Attacker (Blocklist.de) · Phishing (AbuseIPDB) · DDoS attack (AbuseIPDB) · Suspicious Host (AbuseIPDB)

118.193.58.120 IPv4

modified 2026-10-17 11:12:40
Mail Spammer (Abuseat.org) · FTP Attacker (Blocklist.de) · HTTP Attacker (Blocklist.de) · Phishing (AbuseIPDB) · DDoS attack (AbuseIPDB)

118.193.58.125 IPv4

modified 2026-10-17 11:12:40
ET COMPROMISED Known Compromised or Hostile Host Traffic UDP (Emerging Threats) · ET COMPROMISED Known Compromised or Hostile Host Traffic TCP (Emerging Threats) · Mail Spammer (Abuseat.org) · Malicious host (Darklist) · Suspicious Host (AbuseIPDB)

91.230.168.175 IPv4

modified 2026-10-17 11:11:12
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · SQL Injection (AbuseIPDB) · IoT Attacker (AbuseIPDB) · IMAP Attacker (AbuseIPDB)

91.230.168.178 IPv4

modified 2026-10-17 11:11:12
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · Proxy (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · IMAP Attacker (AbuseIPDB)

91.230.168.176 IPv4

modified 2026-10-17 11:11:12
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · VPN (AbuseIPDB) · SQL Injection (AbuseIPDB) · IoT Attacker (AbuseIPDB)

91.231.89.104 IPv4

modified 2026-10-17 11:11:12
SSH Attacker (Blocklist.de) · DDoS attack (AbuseIPDB) · FTP Attacker (AbuseIPDB) · Known Attacker (AbuseIPDB) · SQL Injection (AbuseIPDB)

85.217.149.66 IPv4

modified 2026-10-17 11:10:42
Cobalt Strike (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Mail Spammer (Blocklist.de) · IMAP Attacker (AbuseIPDB) · DNS Poisoning (AbuseIPDB)

85.217.149.69 IPv4

modified 2026-10-17 11:10:42
Cobalt Strike (ThreatFox Abuse.ch) · Proxy (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · IMAP Attacker (AbuseIPDB) · FTP Attacker (AbuseIPDB)

85.217.149.60 IPv4

modified 2026-10-17 11:10:42
Cobalt Strike (ThreatFox Abuse.ch) · Mail Spammer (Barracuda) · DDoS Attacker (AbuseIPDB) · FTP Attacker (AbuseIPDB) · Proxy (AbuseIPDB)

81.19.219.197 IPv4

modified 2026-10-17 11:10:40
Proxy (IPWhois.io) · Cobalt Strike (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · SQL Injection (AbuseIPDB) · DNS Compromise (AbuseIPDB)

69.5.169.76 IPv4

modified 2026-10-17 11:10:13
Proxy (IPWhois.io) · Cobalt Strike (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · SIP Attacker (AbuseIPDB) · VPN (IPWhois.io)

69.5.169.70 IPv4

modified 2026-10-17 11:10:13
Proxy (IPWhois.io) · Cobalt Strike (ThreatFox Abuse.ch) · VPN (IPWhois.io) · SIP Attacker (AbuseIPDB) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats)

69.5.169.71 IPv4

modified 2026-10-17 11:10:13
Proxy (IPWhois.io) · Cobalt Strike (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · VPN (IPWhois.io) · Phishing (AbuseIPDB)

https://rmmserver1.scsgrandrapids.com:443/ URL

modified 2026-10-17 11:10:13
Tactical RMM (Maltiverse Threat Observatory)

69.5.169.77 IPv4

69.5.169.74 IPv4

modified 2026-10-17 11:10:13
Proxy (IPWhois.io) · Cobalt Strike (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · IMAP Attacker (AbuseIPDB) · DDoS Attacker (AbuseIPDB)

rmmserver1.scsgrandrapids.com Hostname

modified 2026-10-17 11:10:13
Tactical RMM (Maltiverse Threat Observatory)

69.5.169.105 IPv4

modified 2026-10-17 11:10:12
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Generic Malware (Maltiverse Threat Observatory) · Proxy (AbuseIPDB)

69.5.169.106 IPv4

modified 2026-10-17 11:10:12
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · VPN (IPWhois.io) · IoT Attacker (AbuseIPDB)

69.5.169.107 IPv4

modified 2026-10-17 11:10:12
Proxy (IPWhois.io) · Cobalt Strike (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · FTP Attacker (AbuseIPDB) · Mail Spammer (Blocklist.de)

69.5.169.109 IPv4

modified 2026-10-17 11:10:12
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · DNS Compromise (AbuseIPDB) · DNS Poisoning (AbuseIPDB)

69.5.169.100 IPv4

modified 2026-10-17 11:10:11
Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · DNS Compromise (AbuseIPDB) · DNS Poisoning (AbuseIPDB)

69.5.169.102 IPv4

modified 2026-10-17 11:10:11
Suspicious Host (AbuseIPDB) · Proxy (IPWhois.io) · NjRAT (ThreatFox Abuse.ch) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · Proxy (AbuseIPDB)

47.77.225.61 IPv4

modified 2026-10-17 11:08:10
Suspicious Host (AbuseIPDB) · Cobalt Strike (ThreatFox Abuse.ch) · DNS Compromise (AbuseIPDB) · SQL Injection (AbuseIPDB) · IoT Attacker (AbuseIPDB)