The FBI Seized Seven Flax Typhoon Domains. Our Feed Had One. Now It Has All Seven, and the Botnet's C2 Domain Is Already Sinkholed.
Two days ago we wrote about AA26-281A, the joint advisory on Integrity Technology Group, the company behind the activity known as Flax Typhoon. Since then the FBI and the Justice Department announced the seizure of seven domains tied to the same operation. When we checked those seven against our feed this morning, we had exactly one of them. That is a gap, and this is the fix.
Read the original post first if you have not: The Flax Typhoon Advisory Lists 514 IP Addresses. Two Were Seen After 2024. We Checked What Still Answers.
What was seized
The seven domains are c0cc.cc, 98aiblog.com, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com and linkedinns.net. According to the FBI affidavit as reported by The Hacker News, c0cc.cc gave access to MicroScan, a Python web tool that bundles more than 1,300 penetration-testing scripts, and it was reachable as recently as September 9. Three of the names borrow trusted brands (Outlook, YouTube, LinkedIn), which is what you register when you want a link to look safe in an email.
We checked the seizure ourselves rather than taking the press release on faith. As of this afternoon, all seven domains delegate to the name servers ns1.fbi.seized.gov and ns2.fbi.seized.gov. Their A records now point at the content-delivery network serving the seizure banner. Those addresses are not attacker infrastructure, and we did not and will not put them in the feed.
The C2 domain was already sinkholed
The coverage also named w8510.com, whose subdomains served as command and control for the Integrity Tech botnet. It was not one of the seven. When we looked it up, it turned out to be quietly out of the attacker's hands already: it delegates to Shadowserver's sinkhole name servers, resolves to Shadowserver's sinkhole address, and carries registry-level locks against transfer, update and deletion. The registry record was last updated on June 10, 2026.
That changes what the indicator means. A sinkholed domain cannot hurt you. But a machine on your network that is still trying to resolve it is very likely an infected device trying to phone home. So w8510.com is in our feed as a detection signal: if you see it in your DNS logs, go find that device. We did not add the sinkhole's IP address, because Shadowserver runs it to protect people, and blocking it would only blind the people collecting infection data.
What our feed carries now
Eight new indicators, all under source manual-batch-flax-typhoon-seizure-2026-10, each written and read back by primary key, and each confirmed present in the downloadable CSV files rather than just in our search index.
The six seized domains we lacked are at confidence 80. w8510.com is at 85. The original MicroScan host, 198.13.53.226, is at 60, because it is a rented cloud address that may well belong to someone else by now. That is below our own edge shield's blocking floor of 80, and a subscriber pulling with min_confidence=80 will not get it. The default ips.csv does carry it. Where you set the dial is your call; we just score it honestly.
98aiblog.com and the infected-device database at 202.182.109.151 were already in the feed from our October 9 import of the advisory's indicator file.
Why we had one of seven
The advisory's machine-readable file was the input to our October 9 work, and we ingested what it shipped. The seizure is a separate action with its own list, announced the same week. Nothing linked the two automatically, and nobody had checked until this morning's sweep. The lesson we keep relearning is that covering a campaign once is not the same as keeping its indicators current. The follow-up news is where the gaps hide.
Both Flax Typhoon IPs that matter here sit on the same rental cloud provider, which is common for this kind of operation and not, by itself, a lead. We found no infrastructure overlap between this campaign and the other campaigns we ingested this week.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=flax-typhoon-seized-domains-addendum-sinkholed-c2
Comments