Malware command-and-control servers tracked by security researchers

StagedC2 malware August 19–22, 2026 6 C2 servers tracked 193.161.193.99 Pastebin

Between August 19 and 22, 2026, security researchers documented at least six distinct command-and-control (C2) server configurations for a malware variant called StagedC2, posted via Pastebin, with C2 addresses spanning multiple IP ranges and portmap.host domains primarily linked to 193.161.193.99.

19 social postsother

Malware command-and-control servers tracked by security researchers

Claim audit

All coverage

# StagedC2 config observed at Wed Aug 19 12:08:05 2026 UTC, located at hXXps://pastebin[.]com/raw/b2M5D0ze C2: voxmodz-63034[.]portmap[.]host:63034 (IP: 193.161.193.99)

# StagedC2 config observed at Wed Aug 19 16:02:02 2026 UTC, located at hXXps://pastebin[.]com/raw/Ez0uivhg C2: 154[.]57[.]164[.]77:30678

# StagedC2 config observed at Wed Aug 19 17:44:04 2026 UTC, located at hXXps://pastebin[.]com/raw/U3M7Chha C2: abdoussa-61932[.]portmap[.]host:61932 (IP: 193.161.193.99)

# StagedC2 config observed at Wed Aug 19 18:16:05 2026 UTC, located at hXXps://pastebin[.]com/raw/m6NtXjv7 C2: abdoussa-43502[.]portmap[.]host:43502 (IP: 193.161.193.99)

# StagedC2 config observed at Wed Aug 19 18:24:05 2026 UTC, located at hXXps://pastebin[.]com/raw/7itEjDUc C2: 91[.]92[.]40[.]209:1300

# StagedC2 config observed at Wed Aug 19 21:48:02 2026 UTC, located at hXXps://pastebin[.]com/raw/19tpxrsC C2: 103[.]131[.]130[.]166:5872

# StagedC2 config observed at Wed Aug 19 23:54:03 2026 UTC, located at hXXps://pastebin[.]com/raw/gEjy2bE5 C2: Xuser45-64772[.]portmap[.]host:64772 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Aug 20 07:56:04 2026 UTC, located at hXXps://pastebin[.]com/raw/nUDE3CPH C2: GHOSTES10-36761[.]portmap[.]host:36761 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Aug 20 08:16:02 2026 UTC, located at hXXps://pastebin[.]com/raw/Vg2ykzpe C2: marioshikord-52402[.]portmap[.]host:52402 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Aug 20 18:46:02 2026 UTC, located at hXXps://pastebin[.]com/raw/GcqyK8Uj C2: 45[.]141[.]27[.]211:3232

# StagedC2 config observed at Thu Aug 20 18:41:03 2026 UTC, located at hXXps://pastebin[.]com/raw/Lxt2QBGF C2: 45[.]141[.]27[.]211:6000

# StagedC2 config observed at Fri Aug 21 02:24:04 2026 UTC, located at hXXps://pastebin[.]com/raw/vABSa95m C2: Raihan-60994[.]portmap[.]host:60994 (IP: 193.161.193.99)

# StagedC2 config observed at Fri Aug 21 14:38:03 2026 UTC, located at hXXps://pastebin[.]com/raw/9ftx58AL C2: Si-One-55439[.]portmap[.]host:55439 (IP: 193.161.193.99)

# StagedC2 config observed at Fri Aug 21 15:01:06 2026 UTC, located at hXXps://pastebin[.]com/raw/MSDVxK9s C2: Si-One-55439[.]portmap[.]host:55439 (IP: 193.161.193.99)

# StagedC2 config observed at Fri Aug 21 21:56:04 2026 UTC, located at hXXps://pastebin[.]com/raw/dcjKQh5F C2: nnxfdbqg2x[.]localto[.]net:8624 (IP: 194.182.79.61)

# StagedC2 config observed at Fri Aug 21 22:03:02 2026 UTC, located at hXXps://pastebin[.]com/raw/h3CE7Wr2 C2: 147[.]185[.]221[.]231:50239

# StagedC2 config observed at Sat Aug 22 03:55:03 2026 UTC, located at hXXps://pastebin[.]com/raw/vPA59KY7 C2: 26[.]170[.]248[.]210:6000

# StagedC2 config observed at Sat Aug 22 11:02:02 2026 UTC, located at hXXps://pastebin[.]com/raw/ajYeyVrG C2: bortmap991-35224[.]portmap[.]host:35224 (IP: 193.161.193.99)

# StagedC2 config observed at Sat Aug 22 17:04:03 2026 UTC, located at hXXps://pastebin[.]com/raw/6KY9sEnu C2: 2[.]26[.]83[.]27:7777