Derp.ca
Data by Hatching Triage opens in a new tab

Malware C2 Tracker

Command-and-control is where a sample reports once it runs: the address built into it, waiting for instructions. Derp counts the live ones across every family it tracks, every day. Below is the current seven-day picture of which families are moving and what the hosting underneath them looks like.

3,761
Hostnames Tracked (7d)
1,200
IP Addresses Tracked (7d)

Infrastructure

C2 Infrastructure Type (7d)

Hosting 94% (4,686)
ISP 5% (226)
Unknown 1% (31)
Business 0% (11)
Education 0% (5)
Government 0% (2)

C2 Hosting Countries (7d)

Country Hosts
  1. 1 🇺🇸 US 3,173
  2. 2 🇳🇱 NL 568
  3. 3 🇩🇪 DE 188
  4. 4 🇨🇳 CN 182
  5. 5 🇭🇰 HK 147
  6. 6 🇫🇷 FR 69
  7. 7 🇬🇧 GB 68
  8. 8 🇸🇬 SG 66
  9. 9 🇷🇺 RU 44
  10. 10 🇹🇷 TR 39
  11. 11 Other 417

C2 Hosting Providers (7d)

Provider Hosts
  1. 1 Servers.com, Inc. 2,001
  2. 2 Cloudflare, Inc. 543
  3. 3 FlokiNET ehf 417
  4. 4 Amazon.com, Inc. 233
  5. 5 Amazon.com, Inc. 80
  6. 6 DigitalOcean, LLC 69
  7. 7 Shenzhen Tencent Computer Systems Company Limited 65
  8. 8 Hangzhou Alibaba Advertising Co.,Ltd. 54
  9. 9 Hetzner Online GmbH 47
  10. 10 Alibaba (US) Technology Co., Ltd. 44
  11. 11 Other providers 1,408

Top Malware by Unique C2 (7d)

Family Trend Hosts
  1. 1 apateweb stable 2,508
  2. 2 AsyncRAT trending up 572
  3. 3 QuasarRAT trending down 228
  4. 4 XWorm trending up 194
  5. 5 Remcos trending up 159
  6. 6 Cobalt Strike trending up 139
  7. 7 MyloBot stable 136
  8. 8 Remus trending up 97
  9. 9 Emotet trending down 82
  10. 10 Kongtuke trending down 81

Top Malware by Unique C2 (24h)

Family Trend Hosts
  1. 1 AsyncRAT trending up 132
  2. 2 XWorm trending up 32
  3. 3 NanoCore trending up 28
  4. 4 Remcos trending up 26
  5. 5 Cobalt Strike trending up 24
  6. 6 QuasarRAT trending down 23
  7. 7 XLoader trending up 20
  8. 8 XMRig trending up 19
  9. 9 VShell trending up 18
  10. 10 gh0st RAT trending up 16

C2 Ports (7d)

Ports observed across live C2 hosts

  1. 1 80 114
  2. 2 443 98
  3. 3 8443 78
  4. 4 6606 65
  5. 5 22 61
  6. 6 23 55
  7. 7 8080 55
  8. 8 25 23

Network Fronting (7d)

How live hosts are reached, counted once each. A host can carry more than one.

  1. 1 hosting 4,714
  2. 2 anycast 661
  3. 3 vpn 96
  4. 4 proxy 66
  5. 5 residential proxy 18
  6. 6 mobile 9
  7. 7 relay 1

All Tracked Malware (7d)

1-25 of 187 families
apateweb 2,508 C2 - Jul 22, 2026 AsyncRAT 572 C2 - Jul 24, 2026 QuasarRAT 228 C2 - Jul 24, 2026 XWorm 194 C2 - Jul 24, 2026 Remcos 159 C2 - Jul 24, 2026 Cobalt Strike 139 C2 - Jul 24, 2026 MyloBot 136 C2 - Jul 21, 2026 Remus 97 C2 - Jul 24, 2026 Emotet 82 C2 - Jul 22, 2026 Kongtuke 81 C2 - Jul 20, 2026 StealC 68 C2 - Jul 24, 2026 Lumma Stealer 67 C2 - Jul 24, 2026 XMRig 65 C2 - Jul 24, 2026 NanoCore 62 C2 - Jul 24, 2026 XLoader 59 C2 - Jul 24, 2026 AnimateClipper 57 C2 - Jul 24, 2026 gh0st RAT 53 C2 - Jul 24, 2026 gurcu 48 C2 - Jul 24, 2026 Phorpiex 47 C2 - Jul 24, 2026 ValleyRAT 47 C2 - Jul 24, 2026 Amadey 44 C2 - Jul 24, 2026 Vidar 44 C2 - Jul 24, 2026 VShell 44 C2 - Jul 24, 2026 Mirai 43 C2 - Jul 24, 2026 RatonRAT 42 C2 - Jul 24, 2026

Recent Research

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage opens in new tab IPinfo opens in new tab urlscan.io opens in new tab Mallory opens in new tab eCrime.ch opens in new tab ransomware.live opens in new tab