Spamhaus Notification | 185.221.196.69 — Botnet C&C Activity

Hello,

IP address: 185.221.196.69
Issue: Botnet command and controller detection
Malware: win.rhadamanthys

What is the problem with this IP address?

The Spamhaus Project's research team has intelligence indicating that the above IP address is hosting an active botnet command and controller (C&C) used by bad actors to control infected devices using win.rhadamanthys malware.

What will happen due to this problem?

As a result of this detection, this IP address is now listed on the Spamhaus Botnet Controller List (BCL).

We advise all internet users worldwide NOT to accept network traffic to or from this IP address due to the threat it poses.

What action do you need to take?

1) Read further information regarding this listing at: https://check.spamhaus.org/listed/?searchterm=185.221.196.69

2) Please take the appropriate mitigation steps relating to this IP address to prevent further abuse.

3) Once you have resolved the abuse, please request the IPs’ removal from the IP and Domain Checker, https://check.spamhaus.org

Please provide the listing team with the corrective actions you have taken. The team will remove the listing where appropriate, increasing your IPs' reputation.

What is the Spamhaus Reputation Portal?

For ASN owners, the Spamhaus Reputation Portal provides free access to IP reputation data relating to your network, allows you to get regular updates on listings via email or API, and offers a quick removal process with the ability to track submissions via a Ticket Center.
Register for a free account at https://manage.spamhaus.com/register/
(Approval of your network to have access to the reputation portal is subject to verification and review of your network)
How can you contact us?

All communications regarding this listing should be made via the IP and Domain Reputation Checker. Type in the IP address, request removal, and a ticket will be raised.

Please do not reply to this email.

Thank you.

The Spamhaus Project
https://www.spamhaus.org/

-----------------------------------------------------------------------------
Posted in MSK