11 min read
1,509 WordPress sites feed an active SocGholish chain
One integrated WordPress-to-GhoLoader operation mapped to Proofpoint's TA2726 and TA569/SocGholish labels, followed by ClickFix on shared hosts.
Malware C2 Tracker
Command-and-control is where a sample reports once it runs: the address built into it, waiting for instructions. Derp counts the live ones across every family it tracks, every day. Below is the current seven-day picture of which families are moving and what the hosting underneath them looks like.
C2 hosts added per day
Infrastructure
C2 Infrastructure Type (7d)
Hosting89%(3,788)
ISP10%(424)
Unknown1%(39)
Business1%(22)
Education0%(4)
Government0%(2)
C2 Hosting Countries (7d)
CountryHosts
- 1🇺🇸 US1,350
- 2🇳🇱 NL995
- 3🇩🇪 DE696
- 4ðŸ‡ðŸ‡° HK170
- 5🇨🇳 CN157
- 6🇫🇷 FR101
- 7🇬🇧 GB93
- 8🇫🇮 FI76
- 9🇷🇺 RU63
- 10🇸🇬 SG56
- 11Other522
C2 Hosting Providers (7d)
ProviderHosts
- 1FlokiNET ehfAS200651776
- 2Cloudflare, Inc.AS13335665
- 3Hetzner Online GmbHAS24940446
- 4Omegatech LTDAS202412125
- 5Amazon.com, Inc.AS16509105
- 6DigitalOcean, LLCAS1406173
- 7Shenzhen Tencent Computer Systems Company LimitedAS4509052
- 8Amazon.com, Inc.AS1461848
- 9NetCrafters OUAS20327344
- 10Ghosty Networks LLCAS20575943
- 11Other providers1,902
Top Malware by Unique C2 (7d)
Top Malware by Unique C2 (24h)
Network Fronting (7d)
How live hosts are reached, counted once each. A host can carry more than one.
- 1 hosting 3,918
- 2 anycast 746
- 3 proxy 88
- 4 vpn 68
- 5 residential proxy 7
- 6 mobile 1
All Tracked Malware (7d)
202 families
| Trend | |||
|---|---|---|---|
| apateweb | 921 | trending up | Aug 8, 2026 |
| SMOKELOADER | 379 | trending up | Aug 8, 2026 |
| AsyncRAT | 370 | trending up | Aug 8, 2026 |
| XWorm | 242 | trending up | Aug 8, 2026 |
| NanoCore | 187 | trending up | Aug 8, 2026 |
| Remcos | 175 | trending up | Aug 8, 2026 |
| Cobalt Strike | 144 | stable | Aug 8, 2026 |
| Xred | 127 | trending down | Aug 8, 2026 |
| Remus | 113 | trending up | Aug 8, 2026 |
| XMRig | 110 | trending up | Aug 8, 2026 |
| QuasarRAT | 109 | trending up | Aug 8, 2026 |
| Mirai | 106 | trending up | Aug 8, 2026 |
| Vidar | 84 | stable | Aug 8, 2026 |
| gh0st RAT | 81 | trending up | Aug 8, 2026 |
| WannaCryptor | 81 | trending up | Aug 8, 2026 |
| VShell | 78 | trending down | Aug 8, 2026 |
| PureRAT | 71 | stable | Aug 8, 2026 |
| StealC | 70 | trending up | Aug 8, 2026 |
| XLoader | 64 | trending up | Aug 8, 2026 |
| Phorpiex | 55 | trending up | Aug 8, 2026 |
| Metasploit | 54 | trending down | Aug 8, 2026 |
| RedLine | 50 | trending down | Aug 8, 2026 |
| Adaptix C2 | 48 | trending up | Aug 8, 2026 |
| njRAT | 48 | trending up | Aug 8, 2026 |
| Defendnot | 46 | trending up | Aug 8, 2026 |
| ValleyRAT | 46 | trending up | Aug 8, 2026 |
| SharpHound | 45 | trending up | Aug 8, 2026 |
| DriveSurge | 44 | stable | Aug 8, 2026 |
| AnimateClipper | 42 | trending up | Aug 8, 2026 |
| DcRAT | 42 | trending up | Aug 8, 2026 |
| SVCStealer | 41 | trending down | Aug 8, 2026 |
| Lumma Stealer | 39 | trending up | Aug 8, 2026 |
| RatonRAT | 33 | trending up | Aug 8, 2026 |
| SALATSTEALER | 33 | trending up | Aug 8, 2026 |
| Floxif | 32 | trending down | Aug 8, 2026 |
| Amadey | 31 | trending up | Aug 8, 2026 |
| Vjw0rm | 30 | trending up | Aug 6, 2026 |
| Ramnit | 28 | trending down | Aug 8, 2026 |
| ACR | 27 | trending down | Aug 8, 2026 |
| LockBit | 26 | trending down | Aug 7, 2026 |
| NonEuclid RAT | 26 | trending down | Aug 8, 2026 |
| Overlord | 26 | trending up | Aug 8, 2026 |
| PrivateLoader | 26 | trending down | Aug 8, 2026 |
| Agent Tesla | 25 | trending up | Aug 8, 2026 |
| Aisuru | 24 | stable | Aug 8, 2026 |
| BLACKMATTER | 24 | trending down | Aug 7, 2026 |
| FleshStealer | 24 | trending down | Aug 8, 2026 |
| destinystealer | 23 | stable | Aug 8, 2026 |
| bdaejec | 22 | trending down | Aug 8, 2026 |
| BlankGrabber | 22 | trending down | Aug 8, 2026 |
| HijackLoader | 22 | trending up | Aug 8, 2026 |
| NetSupport RAT | 21 | trending up | Aug 8, 2026 |
| Berbew | 20 | trending up | Aug 8, 2026 |
| EvilGinx | 20 | trending up | Aug 8, 2026 |
| Hive | 20 | trending down | Aug 8, 2026 |
| FlawedAmmyy | 19 | trending down | Aug 2, 2026 |
| Koi Loader | 19 | trending up | Aug 8, 2026 |
| PhantomStealer | 19 | trending up | Aug 8, 2026 |
| Neptune RAT | 17 | trending down | Aug 8, 2026 |
| Redosdru | 17 | trending up | Aug 8, 2026 |
| Shade | 17 | trending down | Aug 8, 2026 |
| RisePro | 16 | trending down | Aug 8, 2026 |
| Kali365 | 14 | trending down | Aug 8, 2026 |
| rustme | 14 | trending down | Aug 8, 2026 |
| VIPKeylogger | 14 | trending up | Aug 8, 2026 |
| coffloader | 13 | trending down | Aug 7, 2026 |
| gurcu | 13 | trending down | Aug 8, 2026 |
| pykspa | 13 | trending up | Aug 8, 2026 |
| SolarisLoader | 13 | trending down | Aug 8, 2026 |
| Urelas | 13 | trending down | Aug 8, 2026 |
| WarzoneRAT | 13 | trending down | Aug 8, 2026 |
| PureLogs | 12 | trending down | Aug 8, 2026 |
| REvil | 12 | stable | Aug 8, 2026 |
| SilverFox | 12 | trending down | Aug 8, 2026 |
| discordrat | 11 | trending down | Aug 8, 2026 |
| SectopRAT | 11 | trending up | Aug 7, 2026 |
| Havoc | 10 | trending up | Aug 8, 2026 |
| Kimwolf | 10 | stable | Aug 6, 2026 |
| Tofsee | 10 | trending up | Aug 8, 2026 |
| lxbaserat | 9 | trending down | Aug 8, 2026 |
| PurpleFox | 9 | trending down | Aug 8, 2026 |
| siriusrat | 9 | trending down | Aug 8, 2026 |
| UmbralStealer | 9 | trending down | Aug 8, 2026 |
| Masslogger | 8 | trending down | Aug 7, 2026 |
| Stealerium | 8 | stable | Aug 8, 2026 |
| StormKitty | 8 | trending up | Aug 8, 2026 |
| XTinyLoader | 8 | trending up | Aug 8, 2026 |
| CryptoLocker | 7 | trending down | Aug 8, 2026 |
| darksiderat | 7 | trending up | Aug 8, 2026 |
| Mimikatz | 7 | trending down | Aug 8, 2026 |
| RevengeRAT | 7 | trending down | Aug 6, 2026 |
| Sality | 7 | trending up | Aug 8, 2026 |
| Sliver | 7 | trending down | Aug 8, 2026 |
| DanaBot | 6 | trending up | Aug 7, 2026 |
| draculastealer | 6 | trending up | Aug 8, 2026 |
| DarkComet | 5 | trending down | Aug 8, 2026 |
| Gcleaner | 5 | trending down | Aug 7, 2026 |
| HackBrowserData | 5 | trending up | Aug 8, 2026 |
| Jigsaw | 5 | trending down | Aug 7, 2026 |
| Neshta | 5 | trending up | Aug 8, 2026 |
| netreactor | 5 | trending down | Aug 8, 2026 |
| DeerStealer | 4 | trending down | Aug 8, 2026 |
| Exela Stealer | 4 | trending down | Aug 7, 2026 |
| GuLoader | 4 | stable | Aug 6, 2026 |
| juko | 4 | stable | Aug 8, 2026 |
| nabucur | 4 | stable | Aug 8, 2026 |
| NETWIRE | 4 | trending down | Aug 8, 2026 |
| 44 CALIBER | 3 | trending down | Aug 8, 2026 |
| Lokibot | 3 | trending down | Aug 8, 2026 |
| Neconyd | 3 | stable | Aug 8, 2026 |
| SnappyClient | 3 | trending up | Aug 8, 2026 |
| Socks5Systemz | 3 | stable | Aug 7, 2026 |
| waski | 3 | trending down | Aug 8, 2026 |
| Atomic Stealer | 2 | stable | Aug 2, 2026 |
| Beapy | 2 | stable | Aug 8, 2026 |
| blakcseestealer | 2 | stable | Aug 8, 2026 |
| Brute Ratel C4 | 2 | stable | Aug 2, 2026 |
| Chaos | 2 | stable | Aug 6, 2026 |
| Coper | 2 | stable | Aug 7, 2026 |
| CosmicDuke | 2 | stable | Aug 8, 2026 |
| DBatLoader | 2 | stable | Aug 6, 2026 |
| DeimosC2 | 2 | stable | Aug 8, 2026 |
| DragonForce | 2 | stable | Aug 6, 2026 |
| EyePyramid | 2 | stable | Aug 5, 2026 |
| GhostSocks | 2 | stable | Aug 7, 2026 |
| HiddenTear | 2 | stable | Aug 6, 2026 |
| Houdini | 2 | stable | Aug 6, 2026 |
| jlocker | 2 | stable | Aug 6, 2026 |
| la02loader | 2 | stable | Aug 8, 2026 |
| Raccoon Stealer | 2 | stable | Aug 6, 2026 |
| RAWorld | 2 | stable | Aug 6, 2026 |
| ROKRAT | 2 | stable | Aug 6, 2026 |
| seven | 2 | stable | Aug 8, 2026 |
| SmartLoader | 2 | stable | Aug 8, 2026 |
| SpyNote | 2 | stable | Aug 7, 2026 |
| STRRAT | 2 | stable | Aug 6, 2026 |
| URSNIF | 2 | stable | Aug 7, 2026 |
| vertexnet | 2 | stable | Aug 8, 2026 |
| WarmCookie | 2 | stable | Aug 8, 2026 |
| XenoRAT | 2 | stable | Aug 7, 2026 |
| Xorist | 2 | stable | Aug 6, 2026 |
| xorium_stealer | 2 | stable | Aug 3, 2026 |
| Albiriox | 1 | stable | Aug 7, 2026 |
| amus | 1 | stable | Aug 6, 2026 |
| Arkei | 1 | stable | Aug 6, 2026 |
| BianLian | 1 | stable | Aug 6, 2026 |
| BitRAT | 1 | stable | Aug 2, 2026 |
| Bobik | 1 | stable | Aug 2, 2026 |
| chromeb | 1 | stable | Aug 8, 2026 |
| Copybara | 1 | stable | Aug 6, 2026 |
| CryptoWall | 1 | stable | Aug 6, 2026 |
| DarkCloud | 1 | stable | Aug 4, 2026 |
| Darkside | 1 | stable | Aug 3, 2026 |
| DarkVisionRAT | 1 | stable | Aug 8, 2026 |
| Dharma | 1 | stable | Aug 6, 2026 |
| eaglerat | 1 | stable | Aug 3, 2026 |
| Emotet | 1 | stable | Aug 6, 2026 |
| glamour | 1 | stable | Aug 6, 2026 |
| GravityRAT | 1 | stable | Aug 8, 2026 |
| HawkEye | 1 | stable | Aug 2, 2026 |
| healer | 1 | stable | Aug 6, 2026 |
| honeystorm | 1 | trending up | Aug 8, 2026 |
| infinitylock | 1 | stable | Aug 6, 2026 |
| jeefo | 1 | stable | Aug 6, 2026 |
| jRAT | 1 | stable | Aug 7, 2026 |
| Kalim | 1 | stable | Aug 8, 2026 |
| kawaiiunicorn | 1 | stable | Aug 8, 2026 |
| Kongtuke | 1 | trending down | Aug 4, 2026 |
| Laplas | 1 | stable | Aug 6, 2026 |
| Latrodectus | 1 | stable | Aug 2, 2026 |
| LittleDaemon | 1 | stable | Aug 7, 2026 |
| LodaRAT | 1 | stable | Aug 5, 2026 |
| maskgramstealer | 1 | stable | Aug 6, 2026 |
| millenniumrat | 1 | stable | Aug 8, 2026 |
| monsterv2 | 1 | stable | Aug 2, 2026 |
| N-W0rm | 1 | stable | Aug 2, 2026 |
| Nemucod | 1 | stable | Aug 6, 2026 |
| NetWorm | 1 | stable | Aug 6, 2026 |
| NoEscape | 1 | stable | Aug 6, 2026 |
| onlylogger | 1 | stable | Aug 6, 2026 |
| overlayrat | 1 | stable | Aug 6, 2026 |
| Pupy | 1 | stable | Aug 8, 2026 |
| Python stealer | 1 | stable | Aug 6, 2026 |
| qqpass | 1 | stable | Aug 8, 2026 |
| qtr_stealer | 1 | stable | Aug 7, 2026 |
| Rustonotto | 1 | stable | Aug 8, 2026 |
| RustyStealer | 1 | stable | Aug 6, 2026 |
| Sakula | 1 | stable | Aug 8, 2026 |
| SantaStealer | 1 | stable | Aug 6, 2026 |
| SharkBot | 1 | stable | Aug 8, 2026 |
| Skuld | 1 | stable | Aug 7, 2026 |
| Sneaky2FA | 1 | trending up | Aug 8, 2026 |
| specter_stealer | 1 | stable | Aug 7, 2026 |
| Stop | 1 | stable | Aug 3, 2026 |
| systex | 1 | stable | Aug 8, 2026 |
| TinyNuke | 1 | stable | Aug 6, 2026 |
| Tsundere | 1 | stable | Aug 5, 2026 |
| vbrevshell | 1 | stable | Aug 5, 2026 |
| Violet | 1 | stable | Aug 6, 2026 |
| vryxen | 1 | stable | Aug 7, 2026 |
| WhiteSnake | 1 | stable | Aug 6, 2026 |
| ZPHP | 1 | trending down | Aug 2, 2026 |
No malware families found
Recent Research
15 min read
From EtherHiding to a native RAT: ClickFix on new-blog.artlist[.]io
Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT.
23 min read
SilverFox-style loader chain: Panasonic shells, Alibaba OSS carriers, and a Sauron backdoor
Technical analysis of a SilverFox-style loader chain hiding behind Panasonic PC Notification metadata, using Alibaba OSS carriers, signed side-load hosts, RPC Task Scheduler staging, and a Sauron backdoor.
13 min read
AI-Powered Cheats & Stolen Secrets: Teardown of the Yuta/Solara Roblox Stealer
Deep-dive analysis of a trojanized Roblox executor that functions as a highly convincing lure with live DeepSeek script generation, while silently staging a Python 3.12 variant of Glove Stealer that bypasses Google Chrome's App-Bound Encryption.
