SarlackLab

THIS ACCOUNT IS A #BOT 🤖 (mostly)
Autonomous #malware sandbox && #C2 cartographer
Developed by @Abjuri5t and assistants

[SarlackLab @SarlackLab]

FAQ:
Are all these #CIDR blocks and #subdomains 100% malicious? - No, but they do host a SUBSTANTIAL amount of #C2 infrastructure
What’s the grid thingy? - A #HilbertCurve map of #IPv4 space
You spelled #sarlacc wrong! - The name is intentional🤓

DM @Abjuri5t for more info

[SarlackLab @SarlackLab]

#njrat #C2 server
85.214.12[.]66:5552
urregular[.]ddnsgeek[.]com
confirmed 2026-03-30

[SarlackLab @SarlackLab]

#njrat #C2 server
103.78.0[.]204:30047

confirmed 2026-03-30

[SarlackLab @SarlackLab]

live #darkcomet #C2 server
196.251.107[.]24:5552

confirmed 2026-03-30

[SarlackLab @SarlackLab]

Command-and-control domain tree, 2026-03-16 to 2026-03-29 #Malware
https://t.co/LSAHyBXJiE

*.www[.]childreninachangingclimate[.]org
*.adept[.]uk[.]com
*.dianqi1[.]jiayongdianqi[.]xyz
*.dianqi2[.]jiayongdianqi[.]xyz
*.bj[.]baidubce[.]com

[SarlackLab @SarlackLab]

#njrat #C2 server
3.69.157[.]220:14708

confirmed 2026-03-28

[SarlackLab @SarlackLab]

#njrat #C2 server
3.68.171[.]119:14708

confirmed 2026-03-28

[SarlackLab @SarlackLab]

#CnC IPv4 map, 2026-03-15 to 2026-03-28
https://t.co/LSAHyBXJiE

156.234.208[.]0/20
156.234.56[.]0/23
156.234.188[.]0/22
156.234.204[.]0/22
156.234.224[.]0/22
156.234.232[.]0/22
178.16.52[.]0/22
43.243.188[.]0/23
103.54.62[.]0/24
158.94.208[.]0/22

[SarlackLab @SarlackLab]

#njrat #C2 server
143.198.52[.]66:5050

confirmed 2026-03-27

[SarlackLab @SarlackLab]

#njrat #C2 server
193.161.193[.]99:48045
qwe111222-48045[.]portmap[.]host
confirmed 2026-03-27

[SarlackLab @SarlackLab]

live #darkcomet #C2 server
185.157.46[.]232:1604

confirmed 2026-03-27

[SarlackLab @SarlackLab]

Command-and-control domain tree, 2026-03-14 to 2026-03-27 #Tree
https://t.co/LSAHyBXJiE

*.msbwfi[.]za[.]com
*.www[.]childreninachangingclimate[.]org
*.adept[.]uk[.]com
*.dianqi1[.]jiayongdianqi[.]xyz
*.dianqi2[.]jiayongdianqi[.]xyz

[SarlackLab @SarlackLab]

live #darkcomet #C2 server
78.189.159[.]88:4587

confirmed 2026-03-27

[SarlackLab @SarlackLab]

#njrat #C2 server
80.211.137[.]34:5348
26xkbec3l[.]localto[.]net
confirmed 2026-03-27

[SarlackLab @SarlackLab]

#njrat #C2 server
143.198.52[.]66:1177

confirmed 2026-03-26

[SarlackLab @SarlackLab]

#lokibot #C2 server
185.246.220[.]85:80

confirmed 2026-03-26

[SarlackLab @SarlackLab]

#lokibot #C2 server
158.94.211[.]95:80

confirmed 2026-03-26

[SarlackLab @SarlackLab]

Command-and-control IPv4 map, 2026-03-13 to 2026-03-26 #SOC
https://t.co/LSAHyBXJiE

156.234.208[.]0/20
156.234.56[.]0/23
156.234.188[.]0/22
156.234.204[.]0/22
156.234.224[.]0/22
156.234.232[.]0/22
178.16.52[.]0/22
43.243.188[.]0/23
103.54.62[.]0/24

[SarlackLab @SarlackLab]

#lokibot #C2 server
171.22.30[.]147:80

confirmed 2026-03-26

[SarlackLab @SarlackLab]

live #nanocore #C2 server
167.99.64[.]212:5005

confirmed 2026-03-26

[SarlackLab @SarlackLab]

Command-and-control domain tree, 2026-03-12 to 2026-03-25 #TLD
https://t.co/LSAHyBXJiE