s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2020040 high

📛 Threat Title

Unknown RAT: Domain that is used for botnet Command&control (C&C) kiyamet.lol

Category: Unknown RAT Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown RAT. Confidence: 90. First seen: 2026-11-08 07:47:39 UTC. Reporter: LoneNco. Tags: ens, etherhiding, IRAHook, java, minecraft, RAT, stealer.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain kiyamet.lol UrlVoid 0 / 36

IOC database

Type
domain
Value
kiyamet.lol
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain that is used for botnet Command&control (C&C) attributed to Unknown RAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (3)

  • External reference Threatfox IOCs/Threats
  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown RAT. Confidence: 90. First seen: 2026-11-08 07:47:39 UTC. Reporter: LoneNco. Tags: ens, etherhiding, IRAHook, java, minecraft, RAT, stealer.

Remediations (10)

  • PDF Spamhaus Botnet Threat Update
    web:content.spamhaus.org

    The number of botnet command and control (C&C) servers continued to rise between July and December 2025, increasing by +24%. During this period, Remote Access Trojans ( RATs ) grew in popularity to 42% of malware associated with observed botnet C&Cs , overtaking penetration testing frameworks as the most prevalent malware type.

  • C2 Tracker - Community-Driven Malware and C2 Monitoring Tool
    web:ethicalhacksacademy.com

    C2 Tracker is a free, community-driven Indicator of Compromise (IOC) feed designed to track IP addresses associated with known malware, botnets , and Command-and-Control (C2) infrastructure.

  • Recently categorized IP addresses for Botnet Command and Control Server
    web:exchange.xforce.ibmcloud.com

    IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers

  • Feodo Tracker | Blocklist
    web:feodotracker.abuse.ch

    Botnet C2 IP Blocklist Dridex, Heodo (aka Emotet), TrickBot, QakBot (aka QuakBot / Qbot) and BazarLoader (aka BazarBackdoor) botnet command&control servers (C2s) usually reside on compromised servers and such that have been rented and setup by the threat actor itself for the sole purpose of botnet hosting.

  • Feodo Tracker | Browse Botnet C&Cs
    web:feodotracker.abuse.ch

    Here you can browse the list of botnet Command&Control servers ( C&Cs ) tracked by Feodo Tracker, associated with Dridex, TrickBot, QakBot (aka QuakBot/Qbot), BazarLoader (aka BazarBackdoor) and Emotet (aka Heodo). When Feodo Tracker was launched in 2010, it was meant to track Feodo botnet C&Cs .

  • Botnet Infection Findings - Bitsight Knowledge Base
    web:help.bitsighttech.com

    The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers).Navigation Options SPM App Findings ...

  • PDF Spamhaus Botnet Threat Update
    web:info.spamhaus.com

    About this report Spamhaus tracks both Internet Protocol (IP) addresses and domain names used by threat actors for hosting botnet command & control (C&C) servers.

  • Live botnet threats worldwide | Spamhaus Technology
    web:www.spamhaus.com

    Explore the Spamhaus Live Botnet Threat Map. Track global botnet activity in real time and see where malware and infected devices are operating worldwide.

  • Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
    web:www.spamhaus.org

    The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  • Botnet C&C | Botnet Threat Update January to June 2026 | Report
    web:www.spamhaus.org

    Botnet Threat Update January to June 2026 Between Jan-Jun 2026 botnet C&C servers observed decreased -30% to 14,952. Sliver overtook Cobalt Strike for the #1 spot (+58%). Meanwhile .cn botnet C&C domains surged +771% and India's PDR registrar saw a +901% spike in abused registrations - though REGRU bucked the trend with a -90% reduction. Read the latest report to learn more.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.