s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1933814 high

📛 Threat Title

Unknown Loader: Domain name that delivers a malware payload thedermacareclinic.com

Category: Unknown Loader Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:28 UTC. Reporter: varysz. Tags: etherhiding, victim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain thedermacareclinic.com VT 2 / 91 UrlVoid 4 / 36

IOC database

Type
domain
Value
thedermacareclinic.com
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 2 of 91 VirusTotal vendors

VendorVerdictDetection
CRDF malicious malicious
Gridinsoft suspicious suspicious

Details From VirusTotal

Basic Properties
RegistrarGoDaddy.com, LLC
TLDcom
History
Creation date2011-09-04 20:46 UTC
Last analysis2026-09-25 17:17 UTC
Last modified on VirusTotal2026-09-25 23:59 UTC
Last WHOIS update2024-09-11 19:50 UTC
WHOIS record date2026-09-25 17:23 UTC

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:28 UTC. Reporter: varysz. Tags: etherhiding, victim.

Remediations (10)

  • One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader ...
    web:blog.sicuranext.com

    EtherHiding: blockchain-based payload delivery Two seconds after the page loaded, the injected JavaScript initiated outbound queries to the BNB Smart Chain (BSC) Testnet. The BSC Testnet (Chain ID 97) is a free-to-use Ethereum Virtual Machine-compatible blockchain.

  • Understanding the ClickFix Malware Loader Threat
    web:femtosec.io

    Analysis of the ClickFix loader emerging on underground forums. Learn how this malware deployment tool impacts enterprise security and how to mitigate the risk.

  • Unknown Loader malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    4,553 indicators of compromise attributed to the Unknown Loader malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

  • URL Scanner | Cloudflare Radar
    web:radar.cloudflare.com

    Understand the security, performance, technology, and network details of a URL with a publicly shareable report.

  • DeepLoad Malware Pairs ClickFix Delivery with AI-Generated Evasion
    web:reliaquest.com

    "DeepLoad" malware has arrived in enterprise environments via "ClickFix" delivery, turning one user action into rapid, fileless compromise. It likely uses AI-assisted obfuscation and process injection to evade static scanning, while credential theft starts immediately and captures passwords and sessions even if the primary loader is ...

  • DOUBLECUP ClickFix Loader Delivers CountLoader and ... - RH-ISAC
    web:rhisac.org

    The malware provides operators with persistence, system reconnaissance, command execution, payload delivery, and resilient command and control capabilities. Key Takeaways DOUBLECUP is a Russian Loader - as -a-Service developed for ClickFix campaigns and has operated since early June 2026.

  • Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for ...
    web:thehackernews.com

    Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware , enabling stealthy payload delivery and RAT deployment.

  • Criminals turn placeholder domain into ClickFix trap
    web:www.malwarebytes.com

    A domain used in software examples—third-party[.]com—now serves up a fake verification page that tells Windows users to run a PowerShell command.

  • Fake Google and Cloudflare verification pages spread multiple malware ...
    web:www.malwarebytes.com

    We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader .

  • ACR Stealer: Two observed intrusion chains amid increased threat ...
    web:www.microsoft.com

    The retrieved content is executed directly in memory. Steganography-based payload delivery A notable technique in this campaign is the use of steganography to conceal malicious content inside a publicly hosted image. Instead of downloading a secondary script ( as in Campaign 1), the malware retrieves a JPEG image from an image-hosting service.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.