8 min read
ClickFix via Cloudflare Zaraz and the BW Panel
A malicious Cloudflare Zaraz action on edgeupstudio[.]com loaded an ErrTraffic BW Panel bootstrap that looked up its panel address in a Polygon contract.
Malware C2 Tracker
Command-and-control is where a sample reports once it runs: the address built into it, waiting for instructions. Derp counts the live ones across every family it tracks, every day. Below is the current seven-day picture of which families are moving and what the hosting underneath them looks like.
C2 hosts added per day
Infrastructure
C2 Infrastructure Type (7d)
Hosting90%(3,468)
ISP8%(297)
Unknown2%(70)
Business1%(20)
Education0%(7)
Government0%(7)
C2 Hosting Countries (7d)
CountryHosts
- 1🇺🇸 US2,022
- 2🇩🇪 DE260
- 3🇳🇱 NL220
- 4🇨🇳 CN181
- 5ðŸ‡ðŸ‡° HK175
- 6🇬🇧 GB103
- 7🇫🇷 FR95
- 8🇫🇮 FI74
- 9🇸🇬 SG69
- 10🇷🇺 RU60
- 11Other610
C2 Hosting Providers (7d)
ProviderHosts
- 1Cloudflare, Inc.AS133351,054
- 2Amazon.com, Inc.AS14618161
- 3Amazon.com, Inc.AS16509136
- 4NetCrafters OUAS20327372
- 5Hetzner Online GmbHAS2494070
- 6DigitalOcean, LLCAS1406169
- 7Hangzhou Alibaba Advertising Co.,Ltd.AS3796360
- 8OOO GETWIFIAS19813460
- 9Shenzhen Tencent Computer Systems Company LimitedAS4509059
- 10Omegatech LTDAS20241254
- 11Other providers2,074
Top Malware by Unique C2 (7d)
Top Malware by Unique C2 (24h)
Network Fronting (7d)
How live hosts are reached, counted once each. A host can carry more than one.
- 1 hosting 3,472
- 2 anycast 1,167
- 3 proxy 11
- 4 vpn 5
All Tracked Malware (7d)
252 families
| Trend | |||
|---|---|---|---|
| AsyncRAT | 632 | trending up | Sep 8, 2026 |
| Remcos | 310 | trending up | Sep 8, 2026 |
| XWorm | 295 | trending down | Sep 8, 2026 |
| Cobalt Strike | 263 | trending up | Sep 8, 2026 |
| XMRig | 202 | trending up | Sep 8, 2026 |
| NanoCore | 175 | trending up | Sep 8, 2026 |
| DriveSurge | 167 | trending up | Sep 8, 2026 |
| QuasarRAT | 155 | stable | Sep 8, 2026 |
| gh0st RAT | 141 | trending up | Sep 8, 2026 |
| Vidar | 137 | trending up | Sep 8, 2026 |
| StealC | 133 | trending up | Sep 8, 2026 |
| Xred | 113 | trending up | Sep 8, 2026 |
| ValleyRAT | 104 | trending up | Sep 8, 2026 |
| trackmyposs | 103 | trending up | Sep 8, 2026 |
| WannaCryptor | 99 | trending up | Sep 8, 2026 |
| Remus | 96 | trending up | Sep 8, 2026 |
| SocGholish | 96 | trending up | Sep 8, 2026 |
| PureRAT | 92 | stable | Sep 8, 2026 |
| VShell | 92 | trending up | Sep 8, 2026 |
| njRAT | 86 | stable | Sep 8, 2026 |
| MeshAgent | 76 | trending up | Sep 8, 2026 |
| WarzoneRAT | 75 | trending up | Sep 8, 2026 |
| PurpleFox | 73 | trending up | Sep 8, 2026 |
| Phorpiex | 71 | stable | Sep 8, 2026 |
| darksiderat | 70 | trending up | Sep 8, 2026 |
| Floxif | 68 | trending up | Sep 8, 2026 |
| Overlord | 68 | trending up | Sep 8, 2026 |
| Lumma Stealer | 67 | trending down | Sep 8, 2026 |
| Metasploit | 66 | trending up | Sep 8, 2026 |
| Emotet | 63 | trending down | Sep 8, 2026 |
| bdaejec | 62 | trending up | Sep 8, 2026 |
| Kongtuke | 61 | trending up | Sep 8, 2026 |
| Mirai | 61 | trending up | Sep 8, 2026 |
| DcRAT | 52 | trending down | Sep 8, 2026 |
| RatonRAT | 50 | stable | Sep 8, 2026 |
| Amadey | 47 | trending up | Sep 8, 2026 |
| Defendnot | 45 | stable | Sep 8, 2026 |
| SALATSTEALER | 45 | trending up | Sep 8, 2026 |
| RedLine | 42 | trending down | Sep 8, 2026 |
| SVCStealer | 42 | stable | Sep 8, 2026 |
| Agent Tesla | 40 | trending down | Sep 8, 2026 |
| XLoader | 40 | trending down | Sep 8, 2026 |
| SNOWLIGHT | 39 | trending up | Sep 8, 2026 |
| DarkComet | 34 | trending up | Sep 8, 2026 |
| LenAI | 34 | trending up | Sep 8, 2026 |
| PrivateLoader | 34 | trending up | Sep 8, 2026 |
| Sality | 34 | trending up | Sep 8, 2026 |
| Sliver | 34 | trending down | Sep 7, 2026 |
| StormKitty | 34 | trending up | Sep 8, 2026 |
| SharpHound | 32 | trending down | Sep 8, 2026 |
| SolarisLoader | 32 | trending down | Sep 8, 2026 |
| PhantomStealer | 31 | trending up | Sep 8, 2026 |
| UmbralStealer | 31 | trending down | Sep 8, 2026 |
| Vjw0rm | 31 | trending up | Sep 8, 2026 |
| lnkr | 30 | trending up | Sep 8, 2026 |
| la02 | 29 | trending up | Sep 8, 2026 |
| Adaptix C2 | 28 | trending up | Sep 8, 2026 |
| Aisuru | 28 | trending down | Sep 8, 2026 |
| Neptune RAT | 28 | trending up | Sep 8, 2026 |
| NonEuclid RAT | 28 | trending up | Sep 8, 2026 |
| Ramnit | 28 | trending up | Sep 8, 2026 |
| Stealerium | 27 | trending down | Sep 8, 2026 |
| FlawedAmmyy | 26 | trending up | Sep 8, 2026 |
| Mimikatz | 26 | trending down | Sep 8, 2026 |
| LockBit | 25 | stable | Sep 8, 2026 |
| discordrat | 24 | trending down | Sep 8, 2026 |
| gzipgnaw | 24 | trending up | Sep 8, 2026 |
| sepolia | 24 | trending up | Sep 8, 2026 |
| BLACKMATTER | 23 | stable | Sep 8, 2026 |
| RisePro | 23 | stable | Sep 8, 2026 |
| rustme | 23 | stable | Sep 8, 2026 |
| HijackLoader | 22 | trending down | Sep 8, 2026 |
| Berbew | 21 | stable | Sep 8, 2026 |
| Jigsaw | 21 | trending down | Sep 8, 2026 |
| Needle Stealer | 21 | stable | Sep 8, 2026 |
| AnimateClipper | 20 | trending up | Sep 8, 2026 |
| ErrTraffic | 20 | trending up | Sep 8, 2026 |
| Mythic | 20 | trending down | Sep 8, 2026 |
| Rhadamanthys | 20 | trending up | Sep 8, 2026 |
| SilverFox | 20 | trending down | Sep 8, 2026 |
| ZPHP | 20 | trending up | Sep 8, 2026 |
| Simda | 19 | trending up | Sep 8, 2026 |
| ACR | 18 | trending up | Sep 8, 2026 |
| NetSupport RAT | 17 | trending up | Sep 8, 2026 |
| destinystealer | 15 | trending up | Sep 8, 2026 |
| bwpanel | 14 | trending up | Sep 8, 2026 |
| DeerStealer | 14 | trending up | Sep 8, 2026 |
| Kali365 | 14 | trending down | Sep 7, 2026 |
| Redosdru | 14 | trending up | Sep 8, 2026 |
| Apollo | 13 | trending up | Sep 8, 2026 |
| DanaBot | 13 | trending up | Sep 8, 2026 |
| EvilGinx | 13 | trending down | Sep 6, 2026 |
| HexMage | 13 | trending down | Sep 8, 2026 |
| Gcleaner | 12 | trending down | Sep 8, 2026 |
| GhostSocks | 12 | stable | Sep 8, 2026 |
| Koi Loader | 12 | trending up | Sep 8, 2026 |
| KPOT Stealer | 12 | trending up | Sep 8, 2026 |
| siriusrat | 12 | trending down | Sep 8, 2026 |
| VIPKeylogger | 12 | trending down | Sep 8, 2026 |
| BREEZE COMET | 11 | stable | Sep 3, 2026 |
| NoChain | 11 | trending up | Sep 7, 2026 |
| SectopRAT | 11 | trending up | Sep 5, 2026 |
| Shade | 11 | trending up | Sep 8, 2026 |
| gurcu | 10 | stable | Sep 8, 2026 |
| healer | 10 | trending down | Sep 8, 2026 |
| SuperShell | 10 | stable | Sep 8, 2026 |
| Amatera | 9 | trending up | Sep 7, 2026 |
| FleshStealer | 9 | trending up | Sep 8, 2026 |
| Havoc | 9 | trending down | Sep 8, 2026 |
| Masslogger | 9 | trending down | Sep 8, 2026 |
| netreactor | 9 | trending down | Sep 8, 2026 |
| Balada | 8 | stable | Sep 8, 2026 |
| BlankGrabber | 8 | trending down | Sep 8, 2026 |
| branchhop | 8 | trending up | Sep 8, 2026 |
| lxbaserat | 8 | trending up | Sep 7, 2026 |
| SMOKELOADER | 8 | trending down | Sep 8, 2026 |
| CryptoLocker | 7 | trending down | Sep 8, 2026 |
| Gafgyt | 7 | trending down | Sep 8, 2026 |
| Hive | 7 | trending down | Sep 8, 2026 |
| RevengeRAT | 7 | trending down | Sep 8, 2026 |
| SnappyClient | 7 | trending up | Sep 8, 2026 |
| Winos | 7 | trending down | Sep 8, 2026 |
| 44 CALIBER | 6 | trending up | Sep 8, 2026 |
| Bumblebee | 6 | stable | Sep 7, 2026 |
| DanBot | 6 | trending down | Sep 8, 2026 |
| HackBrowserData | 5 | trending down | Sep 8, 2026 |
| Lokibot | 5 | stable | Sep 5, 2026 |
| MacSync | 5 | trending down | Sep 7, 2026 |
| Neshta | 5 | trending down | Sep 8, 2026 |
| PureLogs | 5 | trending up | Sep 8, 2026 |
| RMS | 5 | stable | Sep 6, 2026 |
| SYSTEMBC | 5 | trending down | Sep 8, 2026 |
| Tofsee | 5 | trending down | Sep 8, 2026 |
| XenoRAT | 5 | trending down | Sep 7, 2026 |
| XTinyLoader | 5 | trending up | Sep 4, 2026 |
| apateweb | 4 | trending down | Sep 8, 2026 |
| Coper | 4 | stable | Sep 8, 2026 |
| draculastealer | 4 | stable | Sep 8, 2026 |
| Latrodectus | 4 | stable | Sep 8, 2026 |
| MageCart | 4 | trending up | Sep 8, 2026 |
| MyDoom | 4 | stable | Sep 8, 2026 |
| Omegatech LTD | 4 | trending up | Sep 8, 2026 |
| PavinLoader | 4 | stable | Sep 4, 2026 |
| Redtail | 4 | stable | Sep 4, 2026 |
| SpySheriff | 4 | stable | Sep 8, 2026 |
| vertexnet | 4 | stable | Sep 8, 2026 |
| BoratRAT | 3 | trending down | Sep 6, 2026 |
| nabucur | 3 | stable | Sep 8, 2026 |
| Neconyd | 3 | stable | Sep 6, 2026 |
| onlylogger | 3 | trending up | Sep 5, 2026 |
| Pupy | 3 | trending down | Sep 7, 2026 |
| pykspa | 3 | stable | Sep 2, 2026 |
| Urelas | 3 | trending down | Sep 8, 2026 |
| waski | 3 | trending up | Sep 8, 2026 |
| xorium_stealer | 3 | trending down | Sep 6, 2026 |
| Beapy | 2 | stable | Sep 8, 2026 |
| BianLian | 2 | stable | Sep 5, 2026 |
| bingomod | 2 | stable | Sep 8, 2026 |
| blakcseestealer | 2 | stable | Sep 8, 2026 |
| Brute Ratel C4 | 2 | stable | Sep 5, 2026 |
| chainbite | 2 | trending up | Sep 8, 2026 |
| Chaos | 2 | stable | Sep 5, 2026 |
| CosmicDuke | 2 | stable | Sep 8, 2026 |
| DBatLoader | 2 | stable | Sep 5, 2026 |
| designerlink | 2 | trending up | Sep 8, 2026 |
| Dharma | 2 | stable | Sep 8, 2026 |
| DragonForce | 2 | stable | Sep 5, 2026 |
| evolutionrat | 2 | stable | Sep 8, 2026 |
| Exela Stealer | 2 | stable | Sep 8, 2026 |
| fakeav | 2 | stable | Sep 5, 2026 |
| FatalRAT | 2 | stable | Sep 8, 2026 |
| Glupteba | 2 | stable | Sep 8, 2026 |
| GravityRAT | 2 | stable | Sep 8, 2026 |
| GuLoader | 2 | stable | Sep 7, 2026 |
| hashtail | 2 | stable | Sep 7, 2026 |
| HawkEye | 2 | stable | Sep 7, 2026 |
| HiddenTear | 2 | stable | Sep 5, 2026 |
| Houdini | 2 | stable | Sep 2, 2026 |
| hypeagent | 2 | stable | Sep 7, 2026 |
| jlocker | 2 | stable | Sep 5, 2026 |
| n0va | 2 | stable | Sep 8, 2026 |
| NullMixer | 2 | stable | Sep 4, 2026 |
| petbackdoor | 2 | stable | Sep 8, 2026 |
| prolivfix | 2 | stable | Sep 8, 2026 |
| Raccoon Stealer | 2 | stable | Sep 8, 2026 |
| RAWorld | 2 | stable | Sep 5, 2026 |
| REvil | 2 | stable | Sep 7, 2026 |
| ROKRAT | 2 | stable | Sep 5, 2026 |
| Sakula | 2 | stable | Sep 8, 2026 |
| Socks5Systemz | 2 | stable | Sep 8, 2026 |
| SoumniBot | 2 | stable | Sep 8, 2026 |
| SpyNote | 2 | stable | Sep 7, 2026 |
| Stop | 2 | stable | Sep 8, 2026 |
| STRRAT | 2 | stable | Sep 7, 2026 |
| TAG-150 | 2 | trending up | Sep 7, 2026 |
| TerminalFix | 2 | stable | Sep 7, 2026 |
| Tsundere | 2 | stable | Sep 7, 2026 |
| Venom | 2 | stable | Sep 7, 2026 |
| Violet | 2 | stable | Sep 6, 2026 |
| Xorist | 2 | stable | Sep 5, 2026 |
| 751 stealer | 1 | stable | Sep 3, 2026 |
| ANDROMEDA | 1 | stable | Sep 7, 2026 |
| Anubis | 1 | stable | Sep 5, 2026 |
| Archer | 1 | stable | Sep 5, 2026 |
| Azorult | 1 | stable | Sep 8, 2026 |
| BazarLoader | 1 | stable | Sep 3, 2026 |
| C2Looper | 1 | stable | Sep 5, 2026 |
| coffloader | 1 | stable | Sep 5, 2026 |
| CoinMiner | 1 | trending up | Sep 5, 2026 |
| CryptoMix | 1 | stable | Sep 3, 2026 |
| DarkCloud | 1 | stable | Sep 2, 2026 |
| DarkWatchman | 1 | stable | Sep 2, 2026 |
| exastealer | 1 | stable | Sep 4, 2026 |
| Fabookie | 1 | stable | Sep 4, 2026 |
| fadok | 1 | stable | Sep 8, 2026 |
| FlowerStorm | 1 | trending down | Sep 5, 2026 |
| flyagent | 1 | stable | Sep 2, 2026 |
| framegnaw | 1 | trending up | Sep 8, 2026 |
| GandCrab | 1 | stable | Sep 8, 2026 |
| ganelp | 1 | stable | Sep 3, 2026 |
| Gootloader | 1 | stable | Sep 8, 2026 |
| grenam | 1 | stable | Sep 8, 2026 |
| infinitylock | 1 | trending up | Sep 8, 2026 |
| JokerStat | 1 | trending down | Sep 6, 2026 |
| kawaiiunicorn | 1 | stable | Sep 4, 2026 |
| kindbackdoor | 1 | stable | Sep 7, 2026 |
| knight-office | 1 | stable | Sep 2, 2026 |
| ladvix | 1 | stable | Sep 8, 2026 |
| M0yv | 1 | stable | Sep 3, 2026 |
| macoute | 1 | stable | Sep 2, 2026 |
| MatIEx | 1 | stable | Sep 8, 2026 |
| Meduza | 1 | stable | Sep 8, 2026 |
| monitormolar | 1 | stable | Sep 8, 2026 |
| Mozi | 1 | trending down | Sep 4, 2026 |
| OrcusRAT | 1 | stable | Sep 7, 2026 |
| r77 | 1 | stable | Sep 8, 2026 |
| reverseloader | 1 | stable | Sep 3, 2026 |
| RustyStealer | 1 | stable | Sep 8, 2026 |
| seven | 1 | stable | Sep 8, 2026 |
| SharkBot | 1 | stable | Sep 7, 2026 |
| shieldbeaver | 1 | trending up | Sep 7, 2026 |
| SmartLoader | 1 | stable | Sep 7, 2026 |
| SnakeKeylogger | 1 | stable | Sep 7, 2026 |
| Socelars | 1 | stable | Sep 4, 2026 |
| SpankRAT | 1 | stable | Sep 8, 2026 |
| spring-ring | 1 | stable | Sep 3, 2026 |
| sshdkit | 1 | trending down | Sep 2, 2026 |
| ted backdoor | 1 | stable | Sep 4, 2026 |
| Toy Ghouls | 1 | stable | Sep 5, 2026 |
| Wabot | 1 | stable | Sep 6, 2026 |
| zgRAT | 1 | stable | Sep 7, 2026 |
| ZLoader | 1 | stable | Sep 7, 2026 |
No malware families found
Recent Research
11 min read
1,509 WordPress sites feed an active SocGholish chain
One integrated WordPress-to-GhoLoader operation mapped to Proofpoint's TA2726 and TA569/SocGholish labels, followed by ClickFix on shared hosts.
15 min read
From EtherHiding to a native RAT: ClickFix on new-blog.artlist[.]io
Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT.
23 min read
SilverFox-style loader chain: Panasonic shells, Alibaba OSS carriers, and a Sauron backdoor
Technical analysis of a SilverFox-style loader chain hiding behind Panasonic PC Notification metadata, using Alibaba OSS carriers, signed side-load hosts, RPC Task Scheduler staging, and a Sauron backdoor.
