APT-C-35 Infrastructure Activity Leveraged Using Apache HTTP Response Indicators

**Executive Summary:** Researchers identified active infrastructure clusters linked to APT-C-35 (DoNot), documenting Apache HTTP response header patterns (for example, an "Expires: Thu, 19 Nov 1981 08:52:00 GMT" header paired with "HTTP/1.1 200 OK"), ASN 399629, roughly 36 unique IPs (~73 results), and a key host (gilbertfix.info at 149.248.76.43), enabling security teams to hunt and monitor the group's C2 infrastructure.