Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?

share|improve this question
up vote 7 down vote accepted

Providing that you are looking for information already analyzed, and your question is not about the technical ways to identify a Zeus C&C Server, you can look at the following places:

Note that you can also use those places to look for many other threats / malicious activities than Zeus.

share|improve this answer

First, you can look at the zeustracker list.

Second, note that the list is the primary source for the zeus list. You may also wish to look through some of the many other malware lists on to check for other malware sites.

Separately, you can check to see on what basis your security appliance is making the determination - is it using a list (perhaps one of these)? If it is using a list, which one, and how often does it update it? Is it using traffic analsis (like Snort would) instead?

share|improve this answer

When I get alerts of possible zeus infection from the security appliances, this is what I usually do:

  1. check the URL with zeustracker
  2. if the URL is not in the zeustracker db, check on virustotal
  3. if there is detections, likely this is a malicious connection
  4. Run a tcpdump on the connection to check the packets

zeustracker has a guide showing how to identify zeus malware, go take a look

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.