Back to ffraud
Threat signatureCriticalMalware

ransomware_infrastructure

Ransomware infrastructure including payload hosting, C2 servers, and data-exfiltration endpoints used by operators like LockBit, BlackCat, or Clop.

Related signatures
c2_servermalware_distributionmalware_infrastructure

Check an IP for this and every other signature.

ffraud returns the exact threat tags on any IP, free, no key needed. Or pull the whole labelled dataset from GitHub.

Check an IP See the API