Hunt.io Maps 1,250+ C2 Servers Concentrated Across 165 Russian Hosting Providers, Led by TimeWeb, WebHost1, and REG.RU
Hunt.io's provider-level mapping, drawn from proprietary Host Radar scanning that has not been independently validated and may over-count shared-hosting artifacts as live C2s, shifts the threat-hunting problem from indicator-level triage, which Russian and PRC operators now cycle faster than defenders can burn, to infrastructure chokepoints that sanctions and covert takedowns can actually reach. TimeWeb's 311 C2s represent an extraordinary single-provider exposure that very likely reflects either an FSB tolerance arrangement or straightforward capture as of early 2026, making it a priority candidate for Treasury or Cyber Command action within the next sanctions cycle. Keitaro's 587-IP dominance carries a more specific implication: the framework's repeated selection by Russian-nexus operators reflects its native integration with Cobalt Strike and Sliver workflows, so defenders can raise operator cost in the coming weeks by fingerprinting Keitaro upstream rather than chasing individual payloads. The concentration figures may instead track Hunt.io's own scanning access, with providers cooperating with Western telemetry appearing heavier than truly opaque ones, in which case the most operationally significant infrastructure remains below the current measurement horizon.