domain
update.apex-arena-router.com
discovered 2026-07-22
Primary C2 / exfil host. Resolves to 172.93.185.150 (xTom GmbH, AS3214, Frankfurt). Caddy reverse proxy in front of Uvicorn/FastAPI, wildcard Let's Encrypt cert for *.apex-arena-router.com, /openapi.json exposed unauthenticated. Serves loader.sh + payload.enc, receives exfil uploads, and answers the 60s persistence ping.
