title: Watcher-NetAI — skn scanner operational C2 (connexionlost.{net,zip})
id: 7a9e2c80-3d8f-4f1d-9c7a-1a4e5d8b0c04
status: experimental
description: |
  Detects the Watcher-NetAI scanner module's operational C2 traffic to
  `194.5.97.46` (AS149020 WebHorizon, Netherlands) or to
  `connexionlost.net` / `connexionlost.zip` (DNS aliases for the same IP).
  High-confidence on infrastructure match (IP or domain). The URL-path
  selection alone is path-only and is gated by the destination port (443)
  to avoid matching benign internal applications with similar path strings.
author: OHIIHO Research
date: 2026-05-14
references:
  - Watcher-NetAI / skn public report, OHIIHO Research, 2026-05-14
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
  - attack.t1041
logsource:
  category: network_connection
  product: linux
detection:
  selection_infra_ip:
    destination.ip: '194.5.97.46'
  selection_infra_domain:
    destination.domain:
      - 'connexionlost.net'
      - 'connexionlost.zip'
  selection_port:
    destination.port: 443
  selection_url_path:
    url.path|contains:
      - '/update/scanfiles/ranges.txt'
      - '/update/scanfiles/banIps.txt'
      - '/update/scanfiles/filters.txt'
      - '/update/pass/'
      - '/harvest/sshsv'
      - '/harvest/users'
      - '/harvest/sshlist'
  condition: selection_infra_ip or selection_infra_domain or (selection_url_path and selection_port)
fields:
  - source.ip
  - destination.ip
  - destination.domain
  - destination.port
  - url.path
falsepositives:
  - Path-only matches without the documented IP/domain context should be treated as medium-confidence and triaged with the destination port + HTTPS handshake.
level: high
