malware and is considered by some to be a hotbed of espionage C2s, especially the 123.120.96.0/19, 114.248.80.0/20 and 114.248.96.0/20 subnets. These subnets have been seen in DNS records for hundreds of C2 hostnames for dozens of custom malware families, either known for or