🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain btwpayme.top.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1975032
IOC: btwpayme.top
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is high (85%)
Is compromised? : True
First seen:2026-10-20 05:10:56 UTC
Last seen:never
UUID:aaa0b828-cc3f-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:botnet irc-bot panel

Avatar
Darkfibr
C03 k4_irc_bot panel/API host, hardcoded in rodata at 0x2c0c7b across all twelve builds as http://wtf.btwpayme.top:8080. The domain suffix `.btwpayme.top` is a separate constant at 0x2bb1c2 used to compose per-bot hostnames; the register endpoint pattern `%s/api/register` is at 0x2bb20b. Never resolved or contacted.