TF-1868552
high
📛 Threat Title
Unknown malware: Domain name that delivers a malware payload roadsteriio981.icu
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 100. First seen: 2026-08-04 22:49:42 UTC. Reporter: anonymous. Tags: ClickFix, injected-loader.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
roadsteriio981.icu
UrlVoid 0 / 35
IOC database
- Type
- domain
- Value
roadsteriio981.icu- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to Unknown malware
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 100. First seen: 2026-08-04 22:49:42 UTC. Reporter: anonymous. Tags: ClickFix, injected-loader.
Remediations (10)
-
web:cyberhost.uk
Our Malware & Phishing Blocklist is a carefully curated list of known malicious domains , collected from reputable public threat intelligence sources, Infosec communities, and user submissions.
-
web:github.com
Malicious- Domain -Threat-List A continuously updated list of malicious, suspicious and high-risk domains collected from multiple intelligence sources. You can use the raw TXT feed for firewalls, SIEM, SOAR, DNS filtering and threat-blocking tools. Stay secure, stay informed and contribute if you identify new threats.
-
web:malwareworld.com
MalwareWorld: aggregated threat intelligence MalwareWorld aggregates hundreds of public blacklists into a unified dataset of suspicious IPs, domains and ranges.
-
web:precisionsec.com
You get the Malware Domain List with every PrecisionSec intelligence subscription, alongside malicious IP, URL and hash feeds. Request evaluation access to see live data, delivery formats and integration options.
-
web:socprime.com
The actor then serves fake browser update pages or ClickFix-style prompts that deliver malware to macOS and Windows users through deceptive downloads or malicious PowerShell commands. Its infrastructure includes thousands of .icu domains registered through NiceNIC and hosted on bulletproof infrastructure.
-
web:threatfox.abuse.ch
ThreatFox is a platform from abuse.ch and Spamhaus dedicated to sharing indicators of compromise (IOCs) associated with malware , with the infosec community, AV vendors and cyber threat intelligence providers.
-
web:urlhaus.abuse.ch
URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...
-
web:urlhaus.abuse.ch
Here you can propose new malware urls or just browse the URLhaus database. If you are looking for a parsable list of the dataset, you might want to check out the URLhaus API.
-
web:www.malwarebytes.com
We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader.
-
web:www.threatlog.com
ThreatLog tracks 380,000+ malicious domains linked to malware , phishing, scams and fraud. A continuously growing database of malicious domains .
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.