Operation DragonReturn: MoF Tax Lure Spearphish with govtop[.]one/incometax URL

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects network communication with known malicious IP addresses or URLs associated with the 'govtop.one' infrastructure, which is commonly indicative of command and control activity or malware beaconing.