bot.zwntl.cn
Classification: Malicious
bot.zwntl.cn is a malicious hostname. Reported by URLhaus Abuse.ch and ThreatFox Abuse.ch (Mirai, Malware Download), last seen 2025-04-19.
Current activity
- Online — resolving/reachable. Last checked 2026-10-18 04:37:19.
- Command & Control server — Used by cybercriminals to control victim computers.
- Malware distribution — This indicator is distributing malware.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Mirai | ThreatFox Abuse.ch | 2025-04-17 07:08:09 | 2025-04-19 07:59:19 | malicious-activity | |
| Malware Download | URLhaus Abuse.ch | 2025-04-17 08:12:26 | 2025-04-17 08:12:33 | malicious-activity |
Tags
c2 mirai katana botnetdomainIP addresses resolved by this hostname
- 45.196.239.74 (2025-04-27 04:51:43)
- 2600:1900:4001:96e:8000:1:d154:22a0 (2026-10-18 04:37:19)
- 34.41.139.193 (2026-10-18 04:37:19)
Whois information
- Domain
- zwntl.cn
- TLD
- cn
- DNSSEC
- ['unsigned']
- Nameservers
- tangent.dnspod.net, georgia.dnspod.net, ns1.hwrn.net, ns2.hwrn.net
- Registrant
- Dynadot Inc
- Contact email
- [email protected], [email protected]
- First indexed
- 2025-04-17 07:17:06
- Last updated
- 2026-10-18 04:37:19