Conti Ransomware: Still Alive and Kicking | WhoisXML API

Threat reports

Conti Ransomware: Still Alive and Kicking

Despite the heightened lookout for key members of Wizard Spider given the huge reward offered by the U.S. government,1 Conti ransomware continues to plague individuals and businesses worldwide.

WhoisXML API threat researcher Dancho Danchev’s investigation, in fact, found:

  • Nearly 30 known Wizard Spider gang members’ aliases or online handles
  • 250+ email addresses belonging to the gang’s members
  • 50+ domains that served as Conti ransomware hosts
  • 500+ domains that pointed to Conti ransomware command-and-control (C&C) servers, a vast majority of which were registered in the U.S.
  • 1,400+ IP address resolutions of the domains primarily geolocated in the U.S., 19% of which were tagged “malicious” by various malware engines
  • 70+ domains that shared the C&C domains’ IP hosts, 9% of which were dubbed “malicious” by various malware engines

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

  • [1] https://www.theregister.com/2022/05/09/us-reward-conti-ransomware/
Try our WhoisXML API for free
Get started