TF-1868507 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 100. First seen: 2026-08-04 19:58:41 UTC. Reporter: threatcat_ch. Tags: ClickFix.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 100. First seen: 2026-08-04 19:58:41 UTC. Reporter: threatcat_ch. Tags: ClickFix.

• ️CyberHost Malware and Phishing Blocklist
  web:cyberhost.uk

  Our Malware & Phishing Blocklist is a carefully curated list of known malicious domains , collected from reputable public threat intelligence sources, Infosec communities, and user submissions.

  2026-08-05 06:27 UTC
• GitHub - PeterDaveHello/threat-hostlist: Comprehensive domain ...
  web:github.com

  This project aims to provide a resource for malicious domain intelligence gathered from various sources, focusing on threats like malware , ransomware, phishing, spyware, and botnets. The goal is to simplify the process of accessing and utilizing this information for users, without the need to manually search for and maintain these lists themselves. By incorporating these blocklists into your ...

  2026-08-05 06:27 UTC
• MalwareWorld
  web:malwareworld.com

  MalwareWorld: aggregated threat intelligence MalwareWorld aggregates hundreds of public blacklists into a unified dataset of suspicious IPs, domains and ranges.

  2026-08-05 06:27 UTC
• Malware Domain List - PrecisionSec
  web:precisionsec.com

  You get the Malware Domain List with every PrecisionSec intelligence subscription, alongside malicious IP, URL and hash feeds. Request evaluation access to see live data, delivery formats and integration options.

  2026-08-05 06:27 UTC
• DriveSurge Uses ClickFix and Fake Update Attacks
  web:socprime.com

  The actor then serves fake browser update pages or ClickFix-style prompts that deliver malware to macOS and Windows users through deceptive downloads or malicious PowerShell commands. Its infrastructure includes thousands of .icu domains registered through NiceNIC and hosted on bulletproof infrastructure.

  2026-08-05 06:27 UTC
• ThreatFox | Share Indicators Of Compromise (IOCs)
  web:threatfox.abuse.ch

  ThreatFox is a platform from abuse.ch and Spamhaus dedicated to sharing indicators of compromise (IOCs) associated with malware , with the infosec community, AV vendors and cyber threat intelligence providers.

  2026-08-05 06:27 UTC
• ThreatFox | Unknown malware
  web:threatfox.abuse.ch

  ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with unknown . You can also get this data through the ThreatFox API. Database Entry

  2026-08-05 06:27 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  2026-08-05 06:27 UTC
• URLhaus | Browse - abuse.ch
  web:urlhaus.abuse.ch

  Here you can propose new malware urls or just browse the URLhaus database. If you are looking for a parsable list of the dataset, you might want to check out the URLhaus API.

  2026-08-05 06:27 UTC
• ThreatLog — Malicious Domains Database & Threat Intelligence
  web:www.threatlog.com

  ThreatLog tracks 380,000+ malicious domains linked to malware , phishing, scams and fraud. A continuously growing database of malicious domains .

  2026-08-05 06:27 UTC

Only Available for Registered Users. Sign in to view.