Shared strictly for defensive threat intelligence and research purposes. Identified a C2 panel hosted on msomali[.]club and 89.34.90[.]33:4444 Analysis of the login page and /bots dashboard frontend indicates an Android-focused bot management platform. By directly accessing the /bots endpoint, the dashboard resources were briefly loaded before the application redirected to the login page. Capturing the frontend with HTTP Toolkit revealed the following Android-specific capabilities: Observed capabilities: - Android-specific command handlers and com. android.* package processing - Remote VNC and stealth camera streaming - Accessibility service abuse for device control and permission handling - SMS interception and USSD operations - Overlay injection capabilities - Keylogging support - Dynamic DEX module loading - Remote Android device management I did not observe Windows-specific management functionality in the exposed frontend. IOCs: Domain: msomali[.]club IP: 89.34.90[.]33:4444 Login: https://msomali[.]club/ Dashboard: https://msomali[.]club/bots Auth API: POST /api/auth/login Verify API: GET /api/auth/verify #C2Panel #C2 #Android #malware @malwrhunterteam @skocherhan @JAMESWT_WT @Fact_Finder03 @James_inthe_box