index.md

FakeSpy C2

Create a query to find FakeSpy C2 hosts.

Background & hints

FakeSpy is a name of an Android malware and it uses web-based C2.

• FakeSpy Android Information-Stealing Malware Targets Japanese and Korean-Speaking Users

Here is a list of ex-FakeSpy C2.

• 195.123.226.243
• 195.123.227.140
• 195.123.228.134
• 195.123.228.14
• 216.198.66.107
• 5.34.177.240
• 5.34.179.34
• 5.34.179.9
• 82.118.21.126
• 82.118.21.131

You might find active FakeSpy C2s by leveraging OSINT data from VirusTotal, urlscan.io, etc and Shodan.