s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932579 high

📛 Threat Title

ClearFake: Domain name that delivers a malware payload pnw4rjw2.takvarzesh.ir

Category: ClearFake Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: ClearFake. Confidence: 100. First seen: 2026-09-25 02:20:51 UTC. Reporter: anonymous. Tags: ClearFake, mac-0xdcf2, macOS.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain pnw4rjw2.takvarzesh.ir UrlVoid 3 / 36

IOC database

Type
domain
Value
pnw4rjw2.takvarzesh.ir
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain name that delivers a malware payload attributed to ClearFake

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: ClearFake. Confidence: 100. First seen: 2026-09-25 02:20:51 UTC. Reporter: anonymous. Tags: ClearFake, mac-0xdcf2, macOS.

Remediations (10)

  • IOC Alert: ClearFake JavaScript Payload Delivered via Compromised Domain
    web:darkwebinformer.com

    📖 Overview A domain associated with the ClearFake JavaScript-based malware campaign has been identified. The domain currently displays a Cloudflare phishing warning and has been reported for malicious activity. ClearFake campaigns are known for distributing malicious scripts that deliver payloads or redirect users to further phishing pages. Confidence is assessed at 100%.

  • ClearFake Malicious Framework Updates Tactics with Binance ... - RH-ISAC
    web:rhisac.org

    Context Sekoia researchers have released updates on ClearFake , a malicious JavaScript framework that infects compromised websites to deliver malware through drive-by downloads and social engineering tactics. Initially observed in July 2023, ClearFake utilized fake browser update prompts to trick users into downloading malware .

  • ClearFake 2026 | Malware Analysis - rmceoin.github.io
    web:rmceoin.github.io

    Analysis of a recent ClearFake infection showing how Etherhiding on BSC testnet delivers Windows and macOS ClickFix payloads .

  • ClearFake malware payload delivery - securereading.com
    web:securereading.com

    Once delivered, ClearFake malware typically enables follow-on activity such as credential theft, redirection to scam content, or additional payload downloads. Because the delivery channel appears legitimate, many perimeter defenses fail to block access by default.

  • ThreatFox | ClearFake
    web:threatfox.abuse.ch

    ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with js. clearfake . You can also get this data through the ThreatFox API. Database Entry

  • ThreatFox | ClearFake
    web:threatfox.abuse.ch

    The page below gives you an overview on IOCs that are tagged with ClearFake . You can also get this data through the ThreatFox API. Database Entry ... Indicators Of Compromise The table below shows all indicators of compromise (IOCs) that are associated with this particulare tag (max 1000).

  • ClearFake Campaign - Delivering Malware via "Fake Browser Updates
    web:www.bridewell.com

    ClearFake is a relatively new, malicious JavaScript framework that was first identified in July 2023 by security researcher Randy McEoin.

  • ClickFix Malware Report 2026: Attack Techniques, Campaign Analysis ...
    web:www.ctm360.com

    ClickFix is a rapidly evolving social engineering technique that tricks users into executing malicious commands through fake CAPTCHA checks, browser errors, verification prompts, and other seemingly legitimate instructions. Unlike traditional malware delivery, ClickFix often requires no software exploit—the user is manipulated into initiating the attack themselves. In ClickFix & Beyond ...

  • ClearFake: From Fake CAPTCHAs to Blockchain-Driven Payload Retrieval
    web:www.darktrace.com

    Darktrace detected a potential ClearFake‑related incident involving signs of EtherHiding activity and interactions with blockchain‑based infrastructure. A single device showed repeated suspicious command‑line behavior, primarily involving Microsoft HTML Application Host. The activity occurred over the course of a day and indicated early‑stage attempts to load malicious content ...

  • ClearFake malware — IOCs & CVEs | isMalicious
    web:www.ismalicious.com

    30,881 indicators of compromise attributed to the ClearFake malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.