> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# IOC Alert: Formbook C2 Infrastructure Linked to Parked Domain
- URL: https://darkwebinformer.com/ioc-alert-formbook-c2-infrastructure-linked-to-parked-domain/
- Published: 2025-10-03T17:20:41.000Z
- Updated: 2025-10-03T17:20:41.000Z
- Author: Dark Web Informer
- Tags: IOC

## 📖 Overview

A domain has been identified as potential infrastructure supporting the **Formbook** stealer malware family. While the domain currently appears as a parked page on Hostinger’s DNS system, certificate records and passive DNS suggest prior use for malicious activity. Confidence in the attribution is assessed at 50%.

---

## 📌 Key Details

| Field           | Information                |
| --------------- | -------------------------- |
| **Type**        | Domain                     |
| **Indicator**   | www.hawala\[.\]shop        |
| **Threat Type** | Botnet C2                  |
| **Malware**     | win.formbook               |
| **Confidence**  | 50%                        |
| **Date**        | 03 Oct 2025 – 14:22:32 UTC |
| **Tags**        | c2, Formbook               |
| **Reporter**    | juroots                    |
| **Reference**   | None                       |

---

## 🔎 URLScan Result

- **Verdict Score:** 0
- **Page Title:** Parked Domain name on Hostinger DNS system
- **Screenshot:** [View Screenshot](https://urlscan.io/screenshots/0199aa92-56af-71d9-98c0-ee5d649a1205.png)
- **Result:** [Full Scan Report](https://urlscan.io/result/0199aa92-56af-71d9-98c0-ee5d649a1205/)

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/10/80734608793496087093-2.jpg)

---

## 📡 Domain & Certificate Info

- **DNS A Record:** 84\[.\]32\[.\]84\[.\]32
- **DNS AAAA Record:** hawala.shop
- **MX Record:** hawala.shop
- **Recent Certificates:**
  - C=US, O=Let's Encrypt, CN=R10 (Valid: 2025-04-15 → 2025-07-14)
  - C=US, O=Let's Encrypt, CN=R10 (Valid: 2025-04-15 → 2025-07-14)
  - C=US, O=Let's Encrypt, CN=R3 (Valid: 2023-06-16 → 2023-09-14)

---

## 📡 Related Intelligence

- **Certificate Transparency:** [crt.sh Report](https://crt.sh/?q=www.hawala.shop)
- **VirusTotal Report:** [VirusTotal Domain Report](https://www.virustotal.com/gui/domain/www.hawala.shop)
- **URLScan Domain Overview:** [urlscan.io Domain Page](https://urlscan.io/domain/www.hawala.shop)
- **DNS Analytics:** [dnslytics.com Report](https://dnslytics.com/domain/www.hawala.shop)

---

## 🛡️ Defensive Guidance

- Block **www.hawala\[.\]shop** and its associated IP (**84\[.\]32\[.\]84\[.\]32**) at DNS, proxy, and endpoint levels.
- Monitor for traffic patterns associated with Formbook stealer, including suspicious POST requests or credential exfiltration attempts.
- Add Formbook-related domains to SIEM or threat hunting dashboards for proactive detection.
- Leverage certificate transparency monitoring to identify new infrastructure registered for Formbook campaigns.

---

⚠️ This IOC highlights the **reuse of commodity domains and cheap hosting setups** to stage or disguise Formbook C2 infrastructure, often hiding behind parked pages when not actively engaged in operations.