alex00.ddns.net:4000

domain not resolving

Tracked by C2 Tracker · Whois queried 2026-10-04T14:35:08

Registration

Registrar: —
Registered: —
Expires: —

DNS

Resolves to: 216.218.135.118
Nameservers: —
Status: —

Observed in malware

Family	Sample SHA-256	First seen
BladeHawk	2a4cf22220b9…	2021-09-10

About BladeHawk

Android spyware family identified by its distinctive package dat.a8andoserverx with a persistent MainService. The C2 host and port sit as plain const-strings in an inner thread class (MainService$1), handed directly to InetAddress.getByName() and Integer.parseInt().

ESET: BladeHawk - Android espionage campaign against Kurds

Signing certificate

Subject CN: Android
Issuer CN: Android
Valid: 2008-02-29 → 2035-07-17
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Other samples signed with this certificate? That's a lead worth checking — but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.