Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out if any of our clients have been infected by the recent trojan/worm Flame.

I have access to our proxy logs, so I want to search for any requests made to the "known" C&C domains.

In this article, it says it uses 10 domains for C&C domain servers. Also in another report they found 50 C&C domains, IPs and mentioned domain-fluxing techniques.

Unfortunately, these domain servers are not publicly known (as-of-yet).

Have anyone found any publicly available sources mentioning the actual C&C domains?

share|improve this question
Since Flame is a targeted attack, a question to ask early on is "would any of my clients be likely to be targeted?" – Graham Hill May 31 '12 at 16:17
• Am I protected from Flame? That's the wrong question. You should be asking yourself this: am I at risk? • Alright then, am I at risk from Flame? Let's see, are you a systems administrator for a Middle Eastern government? No? Then no… you aren't at risk. - – Dog eat cat world Jun 1 '12 at 10:08
up vote 6 down vote accepted

As far as I'm aware, Kaspersky were the first company to discover it and they've written some great blogs on it, with excellent detail on the registry keys, files etc that are affected but there isn't much information on the IP addresses of CC servers. Here's their most recent blog detailed the registry keys etc -

and in a previous blog, they talked about the communications to the C&C servers -

saying that

"Recorded data is sent to the C&C through a covert SSL channel, on a regular schedule. We are still analyzing this; more information will be available on our website soon.


so I think it's probably best to keep watching Kaspersky's blog as they appear to be further along in analysing Flame (although that can obviously change).

According to this post (, the domains/ips are being actively sinkholed, which possibly explains why there's nothing been publicised as of yet.

Update: Looks like Kaspersky have identified information on the C&C servers -

share|improve this answer

The only article I've seen so far that gives any IP or domain information is It gives the following IP as one of the C&C servers: Here is the actual article:

Edit: This website now has a lot more of the C&C domains on it. (After I updated this I just now saw that someone else has already linked to it. I'll go ahead and keep it on here for reference as well.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.