> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# IOC Alert: AuraStealer C2 Domain Identified
- URL: https://darkwebinformer.com/ioc-alert-aurastealer-c2-domain-identified/
- Published: 2025-08-30T18:46:52.000Z
- Updated: 2025-09-04T22:19:42.000Z
- Author: Dark Web Informer
- Tags: IOC

📖 **Overview**  
A domain-based indicator tied to command-and-control infrastructure for **AuraStealer** has been identified. The domain poses a high-confidence threat and disguises itself with a generic login page to support malicious C2 operations.

---

📌 **Key Details**

| Field           | Information                    |
| --------------- | ------------------------------ |
| **Type**        | Domain                         |
| **Indicator**   | softytoys\[.\]shop             |
| **Threat Type** | Botnet C2                      |
| **Malware**     | unknown\_stealer (AuraStealer) |
| **Confidence**  | 100%                           |
| **Date**        | 30 Aug 2025 – 14:44:14 UTC     |
| **Tags**        | AuraStealer                    |
| **Reporter**    | abuse\_ch                      |

---

🔎 **URLScan Result**  
Page Title: Sign in  
Screenshot: <https://urlscan.io/screenshots/0198cb96-bce3-73ee-a9b3-8400d5a011dd.png>  
Result: <https://urlscan.io/result/0198cb96-bce3-73ee-a9b3-8400d5a011dd/>

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/08/27389598729786435782367823-2.jpg)

---

📡 **Related Intelligence**  
WHOIS Record: <https://who.is/whois/softytoys.shop>  
VirusTotal Report: <https://www.virustotal.com/gui/domain/softytoys.shop>  
Reference: <https://foresiet.com/blog/aura-stealer-malware-analysis/>

---

🛡️ **Defensive Guidance**

- Block `softytoys[.]shop` at DNS, proxy, and endpoint layers.
- Monitor for C2 callbacks and credential theft tied to AuraStealer.
- Hunt for persistence artifacts and stealer-related payloads on endpoints.
- Review DNS, proxy, and firewall logs for traffic to the domain.