s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932731 medium

📛 Threat Title

Unknown RAT: Domain that is used for botnet Command&control (C&C) sotikan.net

Category: Unknown RAT Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown RAT. Confidence: 50. First seen: 2026-09-25 08:34:30 UTC. Reporter: emilstahl. Tags: ChainScript, etherhiding, NodeJS-RAT, on-chain-c2, Polygon.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain sotikan.net VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/domains/sotikan.net
UrlVoid 3 / 36

IOC database

Type
domain
Value
sotikan.net
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/domains/sotikan.net

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown RAT. Confidence: 50. First seen: 2026-09-25 08:34:30 UTC. Reporter: emilstahl. Tags: ChainScript, etherhiding, NodeJS-RAT, on-chain-c2, Polygon.

Remediations (10)

  • PDF Spamhaus Botnet Threat Update
    web:content.spamhaus.org

    The number of botnet command and control (C&C) servers continued to rise between July and December 2025, increasing by +24%. During this period, Remote Access Trojans ( RATs ) grew in popularity to 42% of malware associated with observed botnet C&Cs , overtaking penetration testing frameworks as the most prevalent malware type.

  • Botnet Infection Findings - Bitsight Knowledge Base
    web:help.bitsighttech.com

    The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navigation Options SPM App: Finding...

  • PDF Spamhaus Botnet Threat Update
    web:info.spamhaus.com

    About this report Spamhaus tracks both Internet Protocol (IP) addresses and domain names used by threat actors for hosting botnet command & control (C&C) servers. This data enables us to identify associated elements, including the geolocation of the botnet C&Cs , the malware associated with them, the top-level domains used when registering a domain for a botnet C&C , the sponsoring registrars ...

  • Recognizing Botnet Command and Control Made Simple
    web:networkthreatdetection.com

    Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  • ThreatFox | Share Indicators Of Compromise (IOCs)
    web:threatfox.abuse.ch

    ThreatFox ThreatFox is a platform from abuse.ch and Spamhaus dedicated to sharing indicators of compromise (IOCs) associated with malware, with the infosec community, AV vendors and cyber threat intelligence providers. Upload IOCs and explore the database for valuable intelligence. Use the APIs to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain ...

  • 4 Botnet Detection Techniques, Challenges & Best Practices
    web:www.radware.com

    4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  • Best Botnet Defense Tools: Top 8 Solutions in 2026 | Radware
    web:www.radware.com

    Organizations deploy botnet defense tools to identify infected devices, disrupt command-and-control (C&C) communications, and block malicious traffic originating from these networks.

  • Live botnet threats worldwide | Spamhaus Technology
    web:www.spamhaus.com

    Explore the Spamhaus Live Botnet Threat Map. Track global botnet activity in real time and see where malware and infected devices are operating worldwide.

  • Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
    web:www.spamhaus.org

    The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  • Botnet C&C | Botnet Threat Update July to December 2025 | Report
    web:www.spamhaus.org

    Botnet Threat Update July to December 2025 Botnet Command & Controller (C&C) activity increased 24% this period, with Remote Access Trojans ( RATs ) accounting for 42% of the Top 20 malware associated with botnets .

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.