ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain 39rwd49tgi9.xyz.

Database Entry

IOC ID:	1971471
IOC:	39rwd49tgi9.xyz
IOC Type :	domain
Threat Type :	botnet_cc
Malware:	Unknown malware
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-10-17 15:21:09 UTC
Last seen:	never
UUID:	50929c97-ca36-11f1-bd13-42010aa4000a
Reporter	eFeSpain
Reward	5 credits from ThreatFox
Tags:	DDoS elf fallback go legea
Reference:	https://blog.efespain.com/en/chapter-32/

eFeSpain

Legea botnet hardcoded fallback C2 domains (port 7001). Fixed list of 7, NOT a date-based DGA (identical list with the clock moved a month ahead); recovered from process memory because garble -literals keeps them encrypted at rest. 6 of the 7 were never registered and the 7th went to serverHold 21h after registration - still valid IOCs, the bot tries them regardless. Analysis: https://blog.efespain.com/en/chapter-32/