SarlackLab

FAQ: Are all these #CIDR blocks and #subdomains 100% malicious? - No, but they do host a SUBSTANTIAL amount of #C2 infrastructure What’s the grid thingy? - A #HilbertCurve map of #IPv4 space You spelled #sarlacc wrong! - The name is intentional🤓 DM @Abjuri5t for more info

#njrat #C2 server 85.214.12[.]66:5552 urregular[.]ddnsgeek[.]com confirmed 2026-03-30

#njrat #C2 server 103.78.0[.]204:30047 confirmed 2026-03-30

live #darkcomet #C2 server 196.251.107[.]24:5552 confirmed 2026-03-30

Command-and-control domain tree, 2026-03-16 to 2026-03-29 #Malware abjuri5t.github.io/SarlackLa… *.www[.]childreninachangingclimate[.]org *.adept[.]uk[.]com *.dianqi1[.]jiayongdianqi[.]xyz *.dianqi2[.]jiayongdianqi[.]xyz *.bj[.]baidubce[.]com

#njrat #C2 server 3.69.157[.]220:14708 confirmed 2026-03-28

#njrat #C2 server 3.68.171[.]119:14708 confirmed 2026-03-28

#CnC IPv4 map, 2026-03-15 to 2026-03-28 abjuri5t.github.io/SarlackLa… 156.234.208[.]0/20 156.234.56[.]0/23 156.234.188[.]0/22 156.234.204[.]0/22 156.234.224[.]0/22 156.234.232[.]0/22 178.16.52[.]0/22 43.243.188[.]0/23 103.54.62[.]0/24 158.94.208[.]0/22

#njrat #C2 server 143.198.52[.]66:5050 confirmed 2026-03-27

#njrat #C2 server 193.161.193[.]99:48045 qwe111222-48045[.]portmap[.]host confirmed 2026-03-27

live #darkcomet #C2 server 185.157.46[.]232:1604 confirmed 2026-03-27

Command-and-control domain tree, 2026-03-14 to 2026-03-27 #Tree abjuri5t.github.io/SarlackLa… *.msbwfi[.]za[.]com *.www[.]childreninachangingclimate[.]org *.adept[.]uk[.]com *.dianqi1[.]jiayongdianqi[.]xyz *.dianqi2[.]jiayongdianqi[.]xyz

live #darkcomet #C2 server 78.189.159[.]88:4587 confirmed 2026-03-27

#njrat #C2 server 80.211.137[.]34:5348 26xkbec3l[.]localto[.]net confirmed 2026-03-27

#njrat #C2 server 143.198.52[.]66:1177 confirmed 2026-03-26

#lokibot #C2 server 185.246.220[.]85:80 confirmed 2026-03-26

#lokibot #C2 server 158.94.211[.]95:80 confirmed 2026-03-26

Command-and-control IPv4 map, 2026-03-13 to 2026-03-26 #SOC abjuri5t.github.io/SarlackLa… 156.234.208[.]0/20 156.234.56[.]0/23 156.234.188[.]0/22 156.234.204[.]0/22 156.234.224[.]0/22 156.234.232[.]0/22 178.16.52[.]0/22 43.243.188[.]0/23 103.54.62[.]0/24

#lokibot #C2 server 171.22.30[.]147:80 confirmed 2026-03-26

live #nanocore #C2 server 167.99.64[.]212:5005 confirmed 2026-03-26

Command-and-control domain tree, 2026-03-12 to 2026-03-25 #TLD abjuri5t.github.io/SarlackLa…