Koktevrat MandatGO phishing domain fb-market-play.cc accessed

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•0

This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.