Aged 2018 Domain Repointed to Fresh Emotet C2 in Turkey
A domain registered in 2018 now resolves to a Turkish VPS IP flagged for the first time this month, wrapped in a Let's Encrypt certificate issued only weeks ago. The pairing surfaced the same week a fresh Emotet Excel4 macro downloader began circulating, with two C2 IPs going live within roughly a day of the document's appearance.
A domain registered back in April 2018 — long enough to have aged out of any registrar-freshness scrutiny — currently resolves to a command-and-control IP that was flagged for the first time on 2026-09-18. The domain is atici.net, and its single A-record points to 185.15.196.157, a Turkish address on AS201520 (Dedicated Telekomunikasyon Teknoloji Hiz. Tic. San. LTD. STI., Istanbul) that carries a Let's Encrypt certificate minted only weeks earlier.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read