Russian-Registered AS213010 Has Hosted C2 Since 2019
A hosting persona on AS213010, tied to a RIPE registrant in Barnaul, has anchored malicious domains from a 2019 bulk-domain certificate through infrastructure registered just 14 days before observation. The continuity of that address space, not the malware chain it fronts, is the standout finding.
The most durable artifact in this record isn't a binary or a certificate — it's a network. Autonomous System 213010, registered to an entity RIPE lists as "Gening Nikita Dmitrievich," has hosted at least two IP addresses that anchor domains registered three years apart: 87.251.75.204, which carries a domain first registered on 2023-09-20 (poolfreshstep.com), and 80.66.76.210, which is fronting a domain that was only 14 days old when this record closed (bunnysecurityrelay.com, created…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read