Prosecutor release

# VPNFilter botnet C2 domain seizure

US DOJ / USAO WDPA, May 23, 2018. Establishes the court-authorized domain seizure and redirection used to disrupt VPNFilter..

**Source type:** Prosecutor release

**Published:** May 23, 2018

**Research grade:** P1

**Used in entries:** 3

## Bibliographic record

**Publisher:** US DOJ / USAO WDPA

**Published:** May 23, 2018

**Source type:** Prosecutor release

**Research grade:** Source grade P1

**Language:** English

**Official record:** Official publication

**Address:** No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

**What it supports:** Establishes the court-authorized domain seizure and redirection used to disrupt VPNFilter.

**Dataset id:** src\_doj\_vpnfilter\_2018

## Research notes

- Not independently re-verified in this pass.

How this source is used

Cited 3 times across 2 record types.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 20, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Organization roles

2 citations

Cited for an organization's recorded role in a takedown.

-
[Federal Bureau of Investigation](https://takedownindex.org/takedowns/vpnfilter-botnet-disruption)

Operational lead, VPNFilter botnet disruption

Primary source
-
[The Shadowserver Foundation](https://takedownindex.org/takedowns/vpnfilter-botnet-disruption)

Technical partner, VPNFilter botnet disruption

Primary source

### Infrastructure

1 citation

Cited for infrastructure recorded as acted on.

-
[1 domain](https://takedownindex.org/takedowns/vpnfilter-botnet-disruption)

Domain seized, VPNFilter botnet disruption

Primary source

[All sources](https://takedownindex.org/sources)