malware family

DeimosC2

2 hosts convicted as DeimosC2 command-and-control servers: 2 still listed, 0 archived. First seen 2026-08-30.

feed checked TLP:CLEAR
hosts 2 2 still listed
listings 3
networks 2
first seen 2026-08-30

About

DeimosC2 is an open-source, Go-based post-exploitation command-and-control framework with HTTPS, DNS-over-HTTPS, TCP and QUIC listeners and a web management panel. Published for red-team use; a listener on the internet is a team server regardless of who runs it.

Ports

:4431:84431:581951

Detection packs

Rules for this hub's 2 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.

Hosts

Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.