kpq.at

Checking live DNS resolution...

100/100

CRITICAL RISK

Malware URLs

Resolved IPs

Abuse Reports

Active URLs

Threat Intelligence Summary: kpq.at

Risk Level: CRITICAL — Threat Score: 100/100

Assessment: kpq.at is actively hosting 48 malware URLs across 1 resolved IP address. The number of active endpoints suggests ongoing, organized malware distribution. This domain should be blocked at the DNS or firewall level. Malware families associated with this domain include elf, censys, mirai.

Recommendation: Block immediately at DNS and firewall level

Total Malware URLs: 49 — Active: 48 — Resolved IPs: 1 — Abuse Reports: 0

First Seen: 2025-12-18T07:24:16 — Last Online: 2026-01-20T03:22:30

Domain Threat Analysis

kpq.at has been associated with 49 malware URLs , of which 48 are currently active . The primary threat types are malware_download, malware.

Active threat. This domain is currently serving malicious content. Multiple malware URLs have been identified on this domain. Network administrators should consider blocking this domain or monitoring traffic to it closely.

Look Up Another Domain or IP

Check any domain or IP address against our threat intelligence database.

Access This Data via API

Integrate WAYSCloud domain threat intelligence into your security tools, SIEM, or firewall rules. Query any domain programmatically for malware URLs, resolved IPs, and threat scores.

API Documentation Integration Guide

See how we classify and verify threats →

Related Threat Intelligence

Top Threats Today Latest Attacks Active Malware Domains Understanding Botnets SSH Attack Explainer How to Block Threats What is a Phishing Domain? About Malware Distribution Check Another Domain

Timeline

First Seen

2025-12-18T07:24:16

Last Seen Online

2026-01-20T03:22:30

Data Last Updated

2026-05-04T06:28:50.407226

Status Activity Timeline (45 changes recorded)

Complete history of all status changes detected for URLs on this domain. Tracking online/offline transitions helps identify malware lifecycle patterns.

ONLINE

                    http://kpq.at/a
                

First detected as online

ONLINE

                    http://kpq.at/e
                

First detected as online

ONLINE

                    http://kpq.at/bins/arm
                

First detected as online

ONLINE

                    http://kpq.at/j
                

First detected as online

ONLINE

                    http://kpq.at/k
                

First detected as online

ONLINE

                    http://kpq.at/h
                

First detected as online

ONLINE

                    http://kpq.at/i
                

First detected as online

ONLINE

                    http://kpq.at/m
                

First detected as online

ONLINE

                    http://kpq.at/c
                

First detected as online

ONLINE

                    http://kpq.at/b
                

First detected as online

ONLINE

                    http://kpq.at/t
                

First detected as online

ONLINE

                    http://kpq.at/g
                

First detected as online

ONLINE

                    http://kpq.at/ssh.sh
                

First detected as online

OFFLINE

                    http://kpq.at/dvr.sh
                

First detected as offline

ONLINE

                    http://kpq.at/yrn.sh
                

First detected as online

ONLINE

                    http://kpq.at/bins/arm5
                

First detected as online

ONLINE

                    http://kpq.at/bins/x86_64
                

First detected as online

ONLINE

                    http://kpq.at/bins/arm7
                

First detected as online

ONLINE

                    http://kpq.at/bins/mipsel
                

First detected as online

ONLINE

                    http://kpq.at/dlr.m68k
                

First detected as online

Showing 20 most recent changes of 45 total

Associated IP Addresses (1)

All IP addresses this domain has resolved to (current and historical). These IPs may host or have hosted malware URLs.

179.43.172.109

0 abuse reports

Malware Classification

elf

Malware family "elf" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.

censys

Malware family "censys" detected in threat intelligence feeds. This threat is actively monitored. Exercise caution - infrastructure may be compromised or intentionally malicious.

mirai

Infamous IoT botnet source code released in 2016, spawning thousands of variants. Responsible for record-breaking DDoS attacks exceeding 1 Tbps. Spreads by scanning for devices with default credentials. Target routers, cameras, DVRs globally.

botnetdomain

Generic botnet command-and-control infrastructure. Domain used to coordinate infected devices, issue commands, and exfiltrate stolen data. Part of distributed botnet network infrastructure.

Malicious shell script campaign. Bash/sh scripts used for initial access, downloading additional malware, establishing persistence, or cryptocurrency mining. Common in Linux server compromises.

ua-wget

Automated malware download campaign using wget user-agent strings. Indicates command-line driven infection attempts, typically part of shell script malware loaders targeting servers and IoT devices.

Malware URLs (49)

All malicious URLs identified on this domain. Status reflects last known state from threat intelligence feeds.

https://kpq.at/

Active Threat

Type: malware

http://kpq.at/e

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

censys elf mirai ua-wget

http://kpq.at/a

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

censys elf mirai ua-wget

http://kpq.at/dlr.x86_64

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

censys elf mirai ua-wget

http://kpq.at/dlr.mips

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

censys elf mirai ua-wget

http://kpq.at/dlr.arm

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

censys elf mirai ua-wget

http://kpq.at/l

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/dvr.sh

Taken Down

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys sh ua-wget

http://kpq.at/yrn.sh

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys mirai sh ua-wget

http://kpq.at/bins/arm

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

censys elf mirai ua-wget

http://kpq.at/j

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/k

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/h

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/i

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/m

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/c

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/b

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/t

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/g

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys elf mirai ua-wget

http://kpq.at/ssh.sh

Active Threat

IP: 179.43.172.109

Type: malware_download

First Seen: 2025-12-21

botnetdomain censys mirai sh ua-wget

Showing 20 of 49 URLs