Havoc
Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors.
0New IOCs · 24h
10New IOCs · 7 days
106Indicators tracked
2Independent feeds
2026-10-10 09:45Last activity
New indicators per day
2026-09-29 to 2026-10-12, by first report.
- IP87
- URL1
- TLS cert18
- C2105
- Malware1
MITRE ATT&CK lists this as malware Havoc. Explore the ATT&CK matrix →
Where its infrastructure is hosted
Latest indicators
Filter the live feed →| First seen | Type | Indicator | Role | Where |
|---|---|---|---|---|
| 2026-10-10 09:45 | IP | 5.163.189[.]237:443 | Botnet C2 | — |
| 2026-10-09 19:05 | URL | hxxps://ed75a310[.]infinityindians[.]pages[.]dev/ktool.exe | Payload delivery | — |
| 2026-10-08 06:05 | IP | 74.241.250[.]35:443 | Botnet C2 | — |
| 2026-10-07 19:43 | IP | 157.137.215[.]66:8443 | Botnet C2 | — |
| 2026-10-07 09:45 | IP | 52.246.183[.]133:443 | Botnet C2 | — |
| 2026-10-07 03:05 | IP | 45.79.198[.]116:443 | Botnet C2 | — |
| 2026-10-06 08:05 | IP | 64.227.35[.]8:443 | Botnet C2 | — |
| 2026-10-05 19:43 | IP | 13.233.118[.]170:8443 | Botnet C2 | — |
| 2026-10-05 09:43 | IP | 137.184.139[.]185:8081 | Botnet C2 | — |
| 2026-10-05 09:43 | IP | 100.57.14[.]236:443 | Botnet C2 | — |
| 2026-10-04 15:05 | IP | 100.61.249[.]34:443 | Botnet C2 | — |
| 2026-10-04 10:05 | IP | 137.175.102[.]11:443 | Botnet C2 | — |
| 2026-10-04 05:05 | IP | 44.243.239[.]80:443 | Botnet C2 | — |
| 2026-10-03 19:05 | IP | 179.43.170[.]151:8443 | Botnet C2 | — |
| 2026-10-03 09:43 | IP | 164.90.190[.]203:8090 | Botnet C2 | — |
| 2026-10-02 13:13 | IP | 68.178.205[.]17:443 | Botnet C2 | — |
| 2026-10-02 09:45 | IP | 92.51.46[.]35:8443 | Botnet C2 | — |
| 2026-10-02 09:43 | IP | 158.94.210[.]16:2853 | Botnet C2 | — |
| 2026-10-02 04:47 | IP | 68.178.202[.]150:443 | Botnet C2 | — |
| 2026-10-02 04:47 | IP | 192.169.176[.]54:443 | Botnet C2 | — |
| 2026-10-01 13:05 | IP | 13.61.179[.]31:443 | Botnet C2 | — |
| 2026-09-29 07:19 | TLS cert | b9a4c53e64dd5dd4e23e24d4f525bd30e58a875a | Botnet C2 | — |
| 2026-09-28 19:45 | IP | 34.116.132[.]157:8444 | Botnet C2 | — |
| 2026-09-28 12:05 | IP | 144.172.69[.]79:443 | Botnet C2 | — |
| 2026-09-28 09:58 | IP | 78.17.93[.]159:8090 | Botnet C2 | — |
| 2026-09-26 12:44 | IP | 169.58.39[.]189:8443 | Botnet C2 | — |
| 2026-09-25 19:46 | IP | 34.51.203[.]250:8444 | Botnet C2 | — |
| 2026-09-23 09:46 | IP | 51.159.21[.]191:80 | Botnet C2 | — |
| 2026-09-22 19:44 | IP | 162.33.177[.]101:443 | Botnet C2 | — |
| 2026-09-22 09:44 | IP | 188.48.121[.]249:443 | Botnet C2 | — |
| 2026-09-21 19:46 | IP | 38.60.136[.]202:443 | Botnet C2 | — |
| 2026-09-21 19:43 | IP | 13.140.145[.]33:443 | Botnet C2 | — |
| 2026-09-21 09:46 | IP | 45.86.229[.]111:40062 | Botnet C2 | — |
| 2026-09-20 09:43 | IP | 132.226.198[.]241:80 | Botnet C2 | — |
| 2026-09-19 19:47 | IP | 51.222.87[.]92:8089 | Botnet C2 | — |
| 2026-09-18 09:57 | IP | 5.163.239[.]119:443 | Botnet C2 | — |
| 2026-09-18 09:56 | IP | 38.242.209[.]29:8080 | Botnet C2 | — |
| 2026-09-18 09:43 | IP | 109.205.212[.]241:80 | Botnet C2 | — |
| 2026-09-17 16:05 | IP | 188.166.254[.]199:443 | Botnet C2 | — |
| 2026-09-17 09:46 | IP | 209.38.100[.]69:443 | Botnet C2 | — |
| 2026-09-16 09:44 | IP | 154.36.161[.]180:443 | Botnet C2 | — |
| 2026-09-15 19:45 | IP | 208.84.103[.]159:443 | Botnet C2 | — |
| 2026-09-15 09:46 | IP | 57.154.15[.]252:443 | Botnet C2 | — |
| 2026-09-15 09:44 | IP | 158.247.202[.]60:443 | Botnet C2 | — |
| 2026-09-14 19:45 | IP | 207.89.17[.]5:443 | Botnet C2 | — |
| 2026-09-14 09:43 | IP | 104.164.46[.]36:10443 | Botnet C2 | — |
| 2026-09-13 20:05 | IP | 104.248.156[.]16:80 | Botnet C2 | — |
| 2026-09-11 19:45 | IP | 198.13.158[.]57:443 | Botnet C2 | — |
| 2026-09-11 09:44 | IP | 16.5.7[.]159:443 | Botnet C2 | — |
| 2026-09-10 19:43 | IP | 154.46.30[.]12:443 | Botnet C2 | — |
| 2026-09-08 19:47 | IP | 66.78.40[.]93:443 | Botnet C2 | — |
| 2026-09-08 09:46 | IP | 50.60.157[.]152:443 | Botnet C2 | — |
| 2026-09-07 09:47 | IP | 85.9.199[.]115:8443 | Botnet C2 | — |
| 2026-09-06 09:44 | IP | 191.252.184[.]198:1080 | Botnet C2 | — |
| 2026-09-05 09:44 | IP | 194.113.73[.]246:8443 | Botnet C2 | — |
| 2026-09-02 19:45 | IP | 20.2.140[.]201:8443 | Botnet C2 | — |
| 2026-08-26 19:46 | IP | 49.232.135[.]25:8080 | Botnet C2 | — |
| 2026-08-22 09:47 | IP | 93.152.223[.]39:28447 | Botnet C2 | — |
| 2026-08-20 09:46 | IP | 4.193.136[.]143:443 | Botnet C2 | — |
| 2026-08-20 09:05 | IP | 43.134.42[.]247:443 | Botnet C2 | — |
| 2026-08-19 19:46 | IP | 95.133.166[.]10:80 | Botnet C2 | — |
| 2026-08-17 09:44 | IP | 178.128.14[.]67:4443 | Botnet C2 | — |
| 2026-08-16 19:46 | IP | 68.183.248[.]32:4443 | Botnet C2 | — |
| 2026-08-14 19:44 | IP | 212.103.26[.]10:55000 | Botnet C2 | — |
| 2026-08-10 08:18 | TLS cert | 60df0e327f3736946e966b453ef233da0c42b927 | Botnet C2 | — |
| 2026-07-31 19:43 | IP | 167.172.142[.]69:443 | Botnet C2 | — |
| 2026-07-24 19:43 | IP | 151.236.21[.]109:2096 | Botnet C2 | — |
| 2026-07-13 19:44 | IP | 37.235.54[.]142:53236 | Botnet C2 | — |
| 2026-07-09 19:44 | IP | 212.46.38[.]117:4445 | Botnet C2 | — |
| 2026-07-06 09:43 | IP | 173.249.41[.]141:80 | Botnet C2 | — |
| 2026-07-06 09:43 | IP | 143.198.120[.]167:80 | Botnet C2 | — |
| 2026-06-30 19:43 | IP | 107.172.22[.]3:443 | Botnet C2 | — |
| 2026-06-30 17:45 | IP | 41.216.189[.]153:2096 | Botnet C2 | — |
| 2026-06-24 19:43 | IP | 146.190.80[.]105:443 | Botnet C2 | — |
| 2026-06-17 17:00 | IP | 20.39.60[.]137:443 | Botnet C2 | — |
| 2026-06-07 19:45 | IP | 82.156.224[.]184:8080 | Botnet C2 | — |
| 2026-05-01 02:43 | IP | 142.93.88[.]220:443 | Botnet C2 | — |
| 2026-03-24 07:40 | TLS cert | 64791ca37e56aa878c44021a630634bca999cdbe | Botnet C2 | — |
| 2026-03-16 20:01 | IP | 35.179.229[.]71:80 | Botnet C2 | — |
| 2026-02-12 17:48 | TLS cert | c1c0073363896e9c687faf206199b45ffe4297b6 | Botnet C2 | — |
| 2026-02-09 11:00 | IP | 15.204.14[.]143:443 | Botnet C2 | — |
| 2026-02-08 04:00 | IP | 15.204.95[.]228:443 | Botnet C2 | — |
| 2026-01-07 13:50 | TLS cert | bd906a4c3e6d1498f8b883c1fa00666d70096850 | Botnet C2 | — |
| 2025-12-03 14:51 | TLS cert | 9cc8b187f164e52b6652317c01658435019bdce8 | Botnet C2 | — |
| 2025-11-10 16:02 | IP | 154.205.145[.]109:2096 | Botnet C2 | — |
| 2025-09-08 12:15 | TLS cert | 4ecce8335d5a54f34f5d8542d646a8e4f077eb69 | Botnet C2 | — |
| 2025-08-20 13:18 | TLS cert | 4c2ab1e806a01937dd1150b3a8ece6f2fbb4665c | Botnet C2 | — |
| 2025-08-18 06:18 | TLS cert | 3b1955afa9e1ee701966e1ad553064230a6c4452 | Botnet C2 | — |
| 2025-07-28 12:40 | TLS cert | b4c3c564fb085147d9bff80593a7ffcdd2949e35 | Botnet C2 | — |
| 2025-07-12 00:01 | IP | 51.81.171[.]234:443 | Botnet C2 | — |
| 2025-06-24 05:31 | TLS cert | e67418e586adf899a6bdd8401355e851eb8db9bb | Botnet C2 | — |
| 2025-06-10 05:13 | TLS cert | 2f28768eda7d542e3b177a621c2a477222c89686 | Botnet C2 | — |
| 2025-06-02 12:01 | IP | 193.239.85[.]15:2083 | Botnet C2 | — |
| 2025-05-29 22:26 | IP | 161.35.176[.]231:443 | Botnet C2 | — |
| 2025-04-15 16:02 | IP | 47.83.134[.]97:443 | Botnet C2 | — |
| 2025-03-30 08:09 | TLS cert | bfe059b0195593107e1d35aa85f9468ea6bb811e | Botnet C2 | — |
| 2025-02-19 04:01 | IP | 54.95.208[.]190:80 | Botnet C2 | — |
| 2024-11-14 06:55 | TLS cert | 413ebc4b5c780fde38082487898391382d60e6bd | Botnet C2 | — |
| 2024-07-12 07:46 | TLS cert | 3ecd22a76155f63c9a83206a22a01279fe386ea5 | Botnet C2 | — |
| 2024-05-23 18:47 | IP | 38.242.151[.]91:443 | Botnet C2 | — |
Defanged for safety. URL query strings removed.