Last seven days
- First activity
- Sep 9, 2026
- Last activity
- Sep 9, 2026
- Feed role
- C2 / Distribution
- Host form
- 0 IP / 310 hostnames
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
128 Sep 9
Observed infrastructure
Leading locations
- US125
- SE3
Leading providers
- Cloudflare, Inc.79
- Namecheap, Inc.33
- Google LLC6
- Amazon.com, Inc.4
- Glesys AB3
- Amazon.com, Inc.1
Infrastructure traits
- Hosting 128
- Anycast 83
- Proxy 1
Samples
Recent associated samples
Reported operators
Threat actors
1 named in public reporting“OfferLoader – The delivery mechanism behind all recorded intrusions, an Inno Setup trojanized installer that sets up the other payloads.”
MITRE ATT&CK
