{
  "name": "Infrastructure of Interest: High Confidence Command And Control",
  "slug": "infrastructure-of-interest-high-confidence-command-and-control",
  "description": "These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and external sources. The IOCs included in this pulse are associated with command and control (C2) infrastructure, facilitating malware communication, data exfiltration, and persistent threat actor operations. Use this data to enhance detection rules, block malicious infrastructure, or correlate with existing incident investigations.",
  "published": "2025-08-07T04:57:45+00:00",
  "created_at": "2025-08-07T04:57:45+00:00",
  "modified_at": "2025-08-08T05:46:05+00:00",
  "created_at_opencti": "2025-08-07T04:57:45+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-08-07"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "www.webmainclearca.com"
      },
      {
        "id": "",
        "name": "www.uptimesinstitute.com"
      },
      {
        "id": "",
        "name": "www.tnas.eu.org"
      },
      {
        "id": "",
        "name": "www.tl520.xyz"
      },
      {
        "id": "",
        "name": "www.telegramdesk.top"
      },
      {
        "id": "",
        "name": "www.telegramorg.icu"
      },
      {
        "id": "",
        "name": "www.telegram-market.ru"
      },
      {
        "id": "",
        "name": "www.sularu.com"
      },
      {
        "id": "",
        "name": "www.sharefiles.webredirect.org"
      },
      {
        "id": "",
        "name": "www.songqianxueshe.com"
      },
      {
        "id": "",
        "name": "www.server.fresnobusinesses.com"
      },
      {
        "id": "",
        "name": "www.renewnumber.com"
      },
      {
        "id": "",
        "name": "www.procleaning.kg"
      },
      {
        "id": "",
        "name": "www.qkfdh.com"
      },
      {
        "id": "",
        "name": "www.ojkh.org"
      },
      {
        "id": "",
        "name": "www.multifold.co.in"
      },
      {
        "id": "",
        "name": "www.maxidom.org"
      },
      {
        "id": "",
        "name": "www.lsiptv.cn"
      },
      {
        "id": "",
        "name": "www.kbawazir.com"
      },
      {
        "id": "",
        "name": "www.i-pro.shop"
      },
      {
        "id": "",
        "name": "www.hcm-foxconn.com"
      },
      {
        "id": "",
        "name": "www.harveynorman.one"
      },
      {
        "id": "",
        "name": "www.haifuimceshi.cyou"
      },
      {
        "id": "",
        "name": "www.googlelivenews.com"
      },
      {
        "id": "",
        "name": "www.goldenclear.top"
      },
      {
        "id": "",
        "name": "www.ff6288.com"
      },
      {
        "id": "",
        "name": "www.fenixwoman.com"
      },
      {
        "id": "",
        "name": "www.eubeafestival.com"
      },
      {
        "id": "",
        "name": "www.efwbhb.com"
      },
      {
        "id": "",
        "name": "www.dxto.net"
      },
      {
        "id": "",
        "name": "www.dsa4894d.vip"
      },
      {
        "id": "",
        "name": "www.ddnss.de"
      },
      {
        "id": "",
        "name": "www.dazzling-johnson.185-241-208-136.plesk.page"
      },
      {
        "id": "",
        "name": "www.consways.com"
      },
      {
        "id": "",
        "name": "www.consultasprocessual.com"
      },
      {
        "id": "",
        "name": "www.cipqa.com"
      },
      {
        "id": "",
        "name": "www.candwfarmsinc.com"
      },
      {
        "id": "",
        "name": "www.bestvillas.fr"
      },
      {
        "id": "",
        "name": "www.assu-ameli.net"
      },
      {
        "id": "",
        "name": "www.advocat.simsim.travel"
      },
      {
        "id": "",
        "name": "www.650c4138-96f4e-80104-9167-81hate8c91b4-671c6hj.com"
      },
      {
        "id": "",
        "name": "www-test.runcity.org"
      },
      {
        "id": "",
        "name": "www.2-58-56-225.sslip.io"
      },
      {
        "id": "",
        "name": "www.yfvb.com"
      },
      {
        "id": "",
        "name": "www.useushippinginc.com"
      },
      {
        "id": "",
        "name": "www.riderbit.com"
      },
      {
        "id": "",
        "name": "www.realpikachu.online"
      },
      {
        "id": "",
        "name": "www.qwrttech.com"
      },
      {
        "id": "",
        "name": "www.quoteconsumer.net"
      },
      {
        "id": "",
        "name": "www.minigroove.nl"
      },
      {
        "id": "",
        "name": "www.linkkedin.life"
      },
      {
        "id": "",
        "name": "www.kkuud.com"
      },
      {
        "id": "",
        "name": "www.hopee.app"
      },
      {
        "id": "",
        "name": "www.forcesystem.net"
      },
      {
        "id": "",
        "name": "www.cddlhis.com"
      },
      {
        "id": "",
        "name": "www.cd45.ru"
      },
      {
        "id": "",
        "name": "www.berfly.com"
      },
      {
        "id": "",
        "name": "www.7yamy.com"
      },
      {
        "id": "",
        "name": "www.activeer.today"
      },
      {
        "id": "",
        "name": "www.bestvilla.fr"
      },
      {
        "id": "",
        "name": "www-official-site-en-us.ru"
      },
      {
        "id": "",
        "name": "www.enoan2107.com"
      },
      {
        "id": "",
        "name": "zzsft66e80474075.top"
      },
      {
        "id": "",
        "name": "xpuvkfe42a7541ab.top"
      },
      {
        "id": "",
        "name": "wgoie06bfc3de90d.top"
      },
      {
        "id": "",
        "name": "wellbeing.work"
      },
      {
        "id": "",
        "name": "wblacknet-224.top"
      },
      {
        "id": "",
        "name": "seoapp.click"
      },
      {
        "id": "",
        "name": "sbird.xyz"
      },
      {
        "id": "",
        "name": "qynidd0fd22f8f9b.top"
      },
      {
        "id": "",
        "name": "refpaffkansb.top"
      },
      {
        "id": "",
        "name": "qilqxfc975904fc9.top"
      },
      {
        "id": "",
        "name": "qcbnge774be7472d.top"
      },
      {
        "id": "",
        "name": "owlfarm.nz"
      },
      {
        "id": "",
        "name": "ninhbinhweb.top"
      },
      {
        "id": "",
        "name": "nbmihc2f08204ae6.top"
      },
      {
        "id": "",
        "name": "milan77burn.top"
      },
      {
        "id": "",
        "name": "kingstontn.top"
      },
      {
        "id": "",
        "name": "jszhongdejs2022yidingniubob.com"
      },
      {
        "id": "",
        "name": "iydqtbf9cd38043e.top"
      },
      {
        "id": "",
        "name": "interlection.xyz"
      },
      {
        "id": "",
        "name": "hcn78blazernode8.top"
      },
      {
        "id": "",
        "name": "hd1080films.xyz"
      },
      {
        "id": "",
        "name": "gofoss.xyz"
      },
      {
        "id": "",
        "name": "glovis.eu"
      },
      {
        "id": "",
        "name": "dseveralmef.xyz"
      },
      {
        "id": "",
        "name": "death916.xyz"
      },
      {
        "id": "",
        "name": "culla.ml"
      },
      {
        "id": "",
        "name": "cos-mos.cam"
      },
      {
        "id": "",
        "name": "cegadable.xyz"
      },
      {
        "id": "",
        "name": "aypfx8b410a5434e.top"
      },
      {
        "id": "",
        "name": "buryebilgrill.xyz"
      },
      {
        "id": "",
        "name": "bftnnad35d0945f1.top"
      },
      {
        "id": "",
        "name": "bitumendanmark.dk"
      },
      {
        "id": "",
        "name": "youthful-herschel.208-85-19-80.plesk.page"
      },
      {
        "id": "",
        "name": "youdaopllvoi.icu"
      },
      {
        "id": "",
        "name": "youdaopllvoo.icu"
      },
      {
        "id": "",
        "name": "yfvb.com"
      },
      {
        "id": "",
        "name": "xinaecfia.org"
      },
      {
        "id": "",
        "name": "xsme.loseyourip.com"
      },
      {
        "id": "",
        "name": "xdxd.hoangmaidong.com"
      },
      {
        "id": "",
        "name": "xfini900.duckdns.org"
      },
      {
        "id": "",
        "name": "xai74k-cointelegraph.com"
      },
      {
        "id": "",
        "name": "wxhpddos.top"
      },
      {
        "id": "",
        "name": "wstc24.novatronica.com"
      },
      {
        "id": "",
        "name": "wsrfcontrol.novatronica.com"
      },
      {
        "id": "",
        "name": "wsapps.novatronica.com"
      },
      {
        "id": "",
        "name": "wpzvlds.gleeze.com"
      },
      {
        "id": "",
        "name": "wpherc-com.stag.tempweb.dev"
      },
      {
        "id": "",
        "name": "wpherc-es.dev.tempweb.dev"
      },
      {
        "id": "",
        "name": "wpe.mysynology.net"
      },
      {
        "id": "",
        "name": "wpad.zepre.com"
      },
      {
        "id": "",
        "name": "windows81.duckdns.org"
      },
      {
        "id": "",
        "name": "windows64bit.giize.com"
      },
      {
        "id": "",
        "name": "win-octo-55210.duckdns.org"
      },
      {
        "id": "",
        "name": "whiteking.giize.com"
      },
      {
        "id": "",
        "name": "whois.myserv012.com"
      },
      {
        "id": "",
        "name": "website3.production.meduza.io"
      },
      {
        "id": "",
        "name": "wcpanel.hackcrack.io"
      },
      {
        "id": "",
        "name": "w36s5.petusound.com"
      },
      {
        "id": "",
        "name": "vytokiurtye.com"
      },
      {
        "id": "",
        "name": "vps-fbbb3a38.vps.ovh.net"
      },
      {
        "id": "",
        "name": "volkatv500.sytes.net"
      },
      {
        "id": "",
        "name": "vpn294647220.softether.net"
      },
      {
        "id": "",
        "name": "vmi2025279.contaboserver.net"
      },
      {
        "id": "",
        "name": "valli-strassenbau.vpbx.iway.ch"
      },
      {
        "id": "",
        "name": "v361422.hosted-by-vdsina.com"
      },
      {
        "id": "",
        "name": "users.nvapps.novatronica.com"
      },
      {
        "id": "",
        "name": "ura.sh"
      },
      {
        "id": "",
        "name": "updatechrome.duckdns.org"
      },
      {
        "id": "",
        "name": "updatewindowsdriver.duckdns.org"
      },
      {
        "id": "",
        "name": "unititled.theworkpc.com"
      },
      {
        "id": "",
        "name": "unam.farorsps.com"
      },
      {
        "id": "",
        "name": "umbrelladownload.host"
      },
      {
        "id": "",
        "name": "ukrposhtkl.top"
      },
      {
        "id": "",
        "name": "tv.drs.yizu.tv"
      },
      {
        "id": "",
        "name": "tulueragemilang.com"
      },
      {
        "id": "",
        "name": "trustedvpnconnection.anondns.net"
      },
      {
        "id": "",
        "name": "transfermone.dynuddns.com"
      },
      {
        "id": "",
        "name": "top1miku.duckdns.org"
      },
      {
        "id": "",
        "name": "thelamapi.com"
      },
      {
        "id": "",
        "name": "test.www.organica.tv"
      },
      {
        "id": "",
        "name": "thederekmainblogportal.com"
      },
      {
        "id": "",
        "name": "test.sythora.dev"
      },
      {
        "id": "",
        "name": "tcremote.novatronica.com"
      },
      {
        "id": "",
        "name": "systemsupdated.duckdns.org"
      },
      {
        "id": "",
        "name": "systemcopilotdriver.ydns.eu"
      },
      {
        "id": "",
        "name": "swarmpit.rtu-tc.ru"
      },
      {
        "id": "",
        "name": "studioverso.wphercules.dev"
      },
      {
        "id": "",
        "name": "ststss.com"
      },
      {
        "id": "",
        "name": "stormpixel73.xyz"
      },
      {
        "id": "",
        "name": "staging.dbook.novatronica.com"
      },
      {
        "id": "",
        "name": "ssagnryvento.com"
      },
      {
        "id": "",
        "name": "sostexampp.duckdns.org"
      },
      {
        "id": "",
        "name": "spb.narkomed.clinic"
      },
      {
        "id": "",
        "name": "snxppyz.ddns.net"
      },
      {
        "id": "",
        "name": "skysirinfusion.xyz"
      },
      {
        "id": "",
        "name": "sirinnovaterra.xyz"
      },
      {
        "id": "",
        "name": "sipcoj.com"
      },
      {
        "id": "",
        "name": "shrunmei6.zhongzunli.com"
      },
      {
        "id": "",
        "name": "shellexperiencehost.ydns.eu"
      },
      {
        "id": "",
        "name": "sharessl.com"
      },
      {
        "id": "",
        "name": "servamhifiport.com"
      },
      {
        "id": "",
        "name": "securityhealthmonitor.duckdns.org"
      },
      {
        "id": "",
        "name": "securityhealthmonitorgiize.duckdns.org"
      },
      {
        "id": "",
        "name": "searcher-new.staging.meduza.io"
      },
      {
        "id": "",
        "name": "scde4.localtonet.com"
      },
      {
        "id": "",
        "name": "sc-test.runcity.org"
      },
      {
        "id": "",
        "name": "sasha.atls.app"
      },
      {
        "id": "",
        "name": "rtu-attends.rtu-tc.ru"
      },
      {
        "id": "",
        "name": "s95bca55387d2a9ba0d7.webredirect.org"
      },
      {
        "id": "",
        "name": "s2.petusound.com"
      },
      {
        "id": "",
        "name": "s1.ak-boss.com"
      },
      {
        "id": "",
        "name": "rx.softlinko.com"
      },
      {
        "id": "",
        "name": "s-vps.online"
      },
      {
        "id": "",
        "name": "rufc.cloud"
      },
      {
        "id": "",
        "name": "rokudearrols.com"
      },
      {
        "id": "",
        "name": "risbatatrisdis.com"
      },
      {
        "id": "",
        "name": "rex1010.duckdns.org"
      },
      {
        "id": "",
        "name": "realestats.space"
      },
      {
        "id": "",
        "name": "rdekonink.nl"
      },
      {
        "id": "",
        "name": "quotes.production.meduza.io"
      },
      {
        "id": "",
        "name": "qwertyxxx.duckdns.org"
      },
      {
        "id": "",
        "name": "qkfdh.com"
      },
      {
        "id": "",
        "name": "qfxazzhumg.chernuha.xyz"
      },
      {
        "id": "",
        "name": "pureworkcom.dynuddns.net"
      },
      {
        "id": "",
        "name": "puntoslife.icu"
      },
      {
        "id": "",
        "name": "prz1t6uq26.sbs"
      },
      {
        "id": "",
        "name": "pronedot9.ddns.net"
      },
      {
        "id": "",
        "name": "prenslertarihiyolu.xyz"
      },
      {
        "id": "",
        "name": "prommet-spb.ru"
      },
      {
        "id": "",
        "name": "procesosreyds.casacam.net"
      },
      {
        "id": "",
        "name": "prenslermucadelesan.xyz"
      },
      {
        "id": "",
        "name": "pmfch.ch"
      },
      {
        "id": "",
        "name": "pinkandgreen87.info"
      },
      {
        "id": "",
        "name": "pestcontrol.nvapps.novatronica.com"
      },
      {
        "id": "",
        "name": "pasar09enero.duckdns.org"
      },
      {
        "id": "",
        "name": "panel.ssagnryvento.com"
      },
      {
        "id": "",
        "name": "outlook.damnserver.com"
      },
      {
        "id": "",
        "name": "out.nekonya.win"
      }
    ],
    "attack_patterns": [
      {
        "id": "f586e043-1a3a-4e6f-882f-62165b7cd14a",
        "name": "TA0011"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "xn--c1abrbv9b.xn--p1ai"
      },
      {
        "id": "",
        "name": "xn--80aebhmti5d.xn--p1ai"
      },
      {
        "id": "",
        "name": "screenconnect.support"
      },
      {
        "id": "",
        "name": "mld.inshield.network"
      },
      {
        "id": "",
        "name": "jolpel.digital"
      },
      {
        "id": "",
        "name": "harnova.digital"
      },
      {
        "id": "",
        "name": "devrako.digital"
      },
      {
        "id": "",
        "name": "bremox.digital"
      },
      {
        "id": "",
        "name": "_dc-mx.35e26a42e868.vayacomida.es"
      },
      {
        "id": "",
        "name": "_dc-mx.571d7b212455.formv.biz"
      },
      {
        "id": "",
        "name": "_dc-mx.8b133658820f.commercialbankingservices.com"
      },
      {
        "id": "",
        "name": "support.management"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/68944e69eb92d0495e51e684"
  ]
}