New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
UNC5142, a financially motivated threat actor, has been tracked since late 2023 for abusing blockchain technology to distribute infostealers. The group exploits vulnerable WordPress sites and employs the 'EtherHiding' technique to obscure malicious code on the BNB Smart Chain. Their infection chain involves a multistage JavaScript downloader called CLEARSHORT, compromised WordPress sites, and smart contracts. UNC5142 has evolved its tactics, using a three-level smart contract system for dynamic payload delivery and abusing legitimate services like Cloudflare Pages. The group has distributed various infostealers, including ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF. Their operations have impacted multiple industries and geographic regions, with approximately 14,000 compromised web pages identified as of June 2025.
AI Analysis
Technical Summary
UNC5142 is a financially motivated cyber threat group tracked since late 2023 that innovatively combines traditional web exploitation with blockchain technology to distribute infostealer malware. The group targets vulnerable WordPress websites, exploiting common web application weaknesses to inject malicious JavaScript code. Their infection chain begins with a multistage JavaScript downloader called CLEARSHORT, which is designed to fetch and execute payloads dynamically. A key innovation is their use of the 'EtherHiding' technique on the BNB Smart Chain, a blockchain platform, where malicious code is embedded within smart contracts to evade traditional detection mechanisms. UNC5142 employs a sophisticated three-level smart contract system that allows dynamic and flexible payload delivery, making it harder for defenders to predict or block the malware distribution. They also abuse legitimate cloud services, notably Cloudflare Pages, to host or proxy malicious content, further complicating detection and takedown efforts. The malware payloads distributed include several well-known infostealers such as ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF, which are capable of stealing sensitive information like credentials, cookies, and system data. The group’s operations have compromised approximately 14,000 web pages globally by mid-2025, affecting multiple industries including finance, e-commerce, and technology. The use of blockchain smart contracts for malware delivery represents an evolution in threat actor tactics, blending decentralized technologies with traditional cybercrime methods. This approach allows UNC5142 to maintain persistence, evade signature-based detection, and dynamically update payloads. The threat actor’s abuse of WordPress—a widely used content management system—combined with blockchain and cloud service exploitation, poses a multifaceted challenge for defenders.
Potential Impact
For European organizations, the impact of UNC5142’s operations can be significant. The compromise of WordPress sites can lead to unauthorized access, data theft, and reputational damage, especially for businesses relying on e-commerce or customer portals. Infostealers like ATOMIC and VIDAR can exfiltrate sensitive credentials, financial information, and personal data, potentially leading to further intrusions or fraud. The use of blockchain smart contracts for malware delivery complicates detection and response, increasing dwell time and the risk of widespread infection. Organizations in finance, technology, and retail sectors are particularly vulnerable due to their reliance on web platforms and blockchain technologies. Additionally, the abuse of legitimate services such as Cloudflare Pages can hinder traditional network-based defenses, allowing malware distribution to continue undetected. The scale of compromise—approximately 14,000 web pages—indicates a broad attack surface and potential for supply chain impacts if third-party websites are affected. This threat also raises concerns about the security of blockchain-based applications and smart contracts, which are increasingly adopted in European markets. Overall, the threat could lead to significant data breaches, financial losses, and erosion of trust in digital services.
Mitigation Recommendations
1. Harden WordPress installations by applying all security patches promptly, disabling unused plugins/themes, and enforcing strong authentication mechanisms such as MFA. 2. Conduct regular vulnerability assessments and penetration testing focused on web applications to identify and remediate exploitable weaknesses. 3. Monitor JavaScript execution and network traffic for unusual patterns, especially those involving dynamic payload downloads or connections to blockchain nodes and smart contracts. 4. Implement web application firewalls (WAFs) with updated signatures and behavioral detection capabilities to block malicious payload delivery attempts. 5. Scrutinize and restrict the use of third-party cloud services like Cloudflare Pages, ensuring only trusted content is served and monitoring for abuse. 6. Employ threat intelligence feeds to detect indicators related to UNC5142 infrastructure and malware hashes. 7. Educate web administrators and developers on secure coding practices and the risks of blockchain-based malware delivery. 8. Use endpoint detection and response (EDR) tools capable of detecting infostealer behaviors and anomalous process executions. 9. Establish incident response plans that include blockchain forensic capabilities to analyze smart contract abuse. 10. Collaborate with blockchain platform providers to report and mitigate malicious smart contracts leveraging EtherHiding techniques.
Affected Countries
Germany, United Kingdom, France, Netherlands, Italy, Spain, Poland, Belgium, Sweden, Switzerland
Indicators of Compromise
- ip: 80.64.30.238
- ip: 82.115.223.9
- hash: 7456f63a46cc318334a70159aa3c4291
- hash: e94affb98148fc4e0cfb9a486bb37160
- hash: 3cf9cbca48ed9e36a0ccd17cf97f6e4b96c14a24
- hash: 53fd54f55c93f9bcca471cd0ccbabc3acbd3e4aa
- hash: 8fba1667bef5eda433928b220886a830488549bd
- hash: 9179dda8b285040bf381aabb8a1f4a1b8c37ed53
- hash: 091f9db54382708327f5bb1831a4626897b6710ffe11d835724be5c224a0cf83
- hash: 27105be1bdd9f15a1b1a2b0cc5de625e2ecd47fdeaed135321641eea86ad6cb0
- hash: 3023b0331baff73ff894087d1a425ea4b2746caf514ada624370318f27e29c2c
- hash: 4b47b55ae448668e549ffc04e82aee41ac10e3c8b183012a105faf2360fc5ec1
- hash: 72d8fa46f402dcc4be78306d0535c9ace0eb9fabae59bd3ba3cc62a0bdf3db91
- hash: 88019011af71af986a64f68316e80f30d3f57186aa62c3cef5ed139eb49a6842
- hash: bcbdb74f97092dfd68e7ec1d6770b6d1e1aae091f43bcebb0b7bce6c8188e310
- ip: 83.217.208.130
- ip: 91.240.118.2
- url: http://83.217.208.130/xfiles/Ohio.mp4
- url: http://83.217.208.130/xfiles/VIDA.mp3
- url: http://83.217.208.130/xfiles/VIDA.mp4
- url: http://83.217.208.130/xfiles/trip.mp4
- url: http://83.217.208.130/xfiles/trip.psd
- url: http://ads.green-pickle-jo.shop/1.m4a
- url: http://ai.fdswgw.shop/one.mp4
- url: http://app.bytevista.cloud/wfree
- url: http://betiv.fun/7456f63a46cc318334a70159aa3c4291.txt
- url: http://black.hologramm.us/
- url: http://block.a-1-a1a.shop/drive.mp3
- url: http://bridge.tree-sock-rain.today/
- url: http://butanse.shop/
- url: http://bytes.microstorage.shop/
- url: http://captcha-cdn.com/verify.sh
- url: http://captcha-verify-6r4x.com/verify.sh
- url: http://def.ball-strike-up.shop/
- url: http://discover-travel-agency.pro/1.m4a
- url: http://discover-travel-agency.pro/joke.m4a
- url: http://discover-travel-agency.pro/walking.mp3
- url: http://dns-verify-me.pro/xfiles/train.mp4
- url: http://e.overallwobbly.ru/era-stc
- url: http://entrinidad.cfd/1/verify.sh
- url: http://human-verify-4r.pro/xfiles/human.cpp
- url: http://human-verify-4r.pro/xfiles/verify.mp4
- url: http://human-verify.shop/xfiles/verify.mp4
- url: http://hur.bweqlkjr.shop/1a.m4a
- url: http://hur.bweqlkjr.shop/m41.mp4
- url: http://items.kycc-camera.shop/
- url: http://jdiazmemory.com/4/verify.sh
- url: http://kimbeech.cfd/cap/verify.sh
- url: http://lammysecurity.com/4/verify.sh
- url: http://lapkimeow.icu/check
- url: http://lumichain.pro/
- url: http://message.zoo-ciry.shop/
- url: http://mnjk-jk.bsdfg-zmp-q-n.shop/1.mp4
- url: http://nbhg-v.iuksdfb-f.shop/ajax.mp3
- url: http://note1.nz7bn.pro/nnp.mp4
- url: http://ok.fish-cloud-jar.us/
- url: http://power.moon-river-coin.xyz/
- url: http://privatunis.cfd/1/verify.sh
- url: http://recaptcha-manual.shop/kangarooing.m4a
- url: http://recaptcha-verify-4h.pro/kangarooing.m4a
- url: http://recaptcha-verify-4h.pro/xfiles/kangarooing.vsdx
- url: http://recaptcha-verify-4h.pro/xfiles/verify.mp4
- url: http://rengular11.today/
- url: http://run.fox-chair-dust.xyz/
- url: http://salorttactical.top/2/verify.sh
- url: http://sandbox.silver-map-generator.shop/
- url: http://sandbox.yunqof.shop/macan.mp3
- url: http://security-2k7q-check.com/1/verify.sh
- url: http://security-2u6g-log.com/1/verify.sh
- url: http://security-7f2c-run.com/2/verify.sh
- url: http://security-9y5v-scan.com/3/verify.sh
- url: http://security-9y5v-scan.com/7/verify.sh
- url: http://security-a2k8-go.com/6/verify.sh
- url: http://security-check-l2j4.com/verify.sh
- url: http://security-check-u8a6.com/2/verify.sh
- url: http://start.cleaning-room-device.shop/sha589.m4a
- url: http://stat.bluetroniq.vip/
- url: http://tofukai.cfd/2/verify.sh
- url: http://tumbl.design-x.xyz/glass.mp3
- url: http://xxx.retweet.shop/
- url: http://yob.yrwebsdf.shop/1a.m4a
- url: http://yob.yrwebsdf.shop/3t.mp4
- url: https://browser-storage.com/update
- url: https://saaadnesss.shop/check'
- domain: actiothreaz.com
- domain: betiv.fun
- domain: blast-hubs.com
- domain: blastikcn.com
- domain: breedertremnd.com
- domain: browser-storage.com
- domain: butanse.shop
- domain: captcha-cdn.com
- domain: captcha-verify-6r4x.com
- domain: cxheerfulriver.pics
- domain: decreaserid.world
- domain: discover-travel-agency.pro
- domain: dns-verify-me.pro
- domain: dsfljsdfjewf.info
- domain: entrinidad.cfd
- domain: fleebunga.sbs
- domain: garulouscuto.com
- domain: hfdjmoedkjf.asia
- domain: hoyoverse.blog
- domain: human-verify-4r.pro
- domain: human-verify.shop
- domain: importenptoc.com
- domain: inputrreparnt.com
- domain: jdiazmemory.com
- domain: kimbeech.cfd
- domain: lammysecurity.com
- domain: lapkimeow.icu
- domain: lumichain.pro
- domain: opbafindi.com
- domain: orange-service.xyz
- domain: pasteflawwed.world
- domain: polovoiinspektor.shop
- domain: privatunis.cfd
- domain: ratatui.today
- domain: rebeldettern.com
- domain: recaptcha-manual.shop
- domain: recaptcha-verify-4h.pro
- domain: rengular11.today
- domain: saaadnesss.shop
- domain: salorttactical.top
- domain: security-2k7q-check.com
- domain: security-2u6g-log.com
- domain: security-7f2c-run.com
- domain: security-9y5v-scan.com
- domain: security-a2k8-go.com
- domain: security-check-l2j4.com
- domain: security-check-u8a6.com
- domain: stchkr.rest
- domain: stormlegue.com
- domain: technavix.cloud
- domain: tlfiyat.shop
- domain: tofukai.cfd
- domain: torpdidebar.com
- domain: voicesharped.com
- domain: zenrichyourlife.tech
- domain: ads.green-pickle-jo.shop
- domain: ai.fdswgw.shop
- domain: black.hologramm.us
- domain: block.a-1-a1a.shop
- domain: bridge.tree-sock-rain.today
- domain: bytes.microstorage.shop
- domain: def.ball-strike-up.shop
- domain: e.overallwobbly.ru
- domain: googleapis-n-cdn3s-server.willingcapablepatronage.shop
- domain: hur.bweqlkjr.shop
- domain: items.kycc-camera.shop
- domain: kangla.klipxytozyi.shop
- domain: message.zoo-ciry.shop
- domain: mnjk-jk.bsdfg-zmp-q-n.shop
- domain: nbhg-v.iuksdfb-f.shop
- domain: note1.nz7bn.pro
- domain: ok.fish-cloud-jar.us
- domain: power.moon-river-coin.xyz
- domain: rbk.scalingposturestrife.shop
- domain: run.fox-chair-dust.xyz
- domain: sandbox.silver-map-generator.shop
- domain: sandbox.yunqof.shop
- domain: start.cleaning-room-device.shop
- domain: stat.bluetroniq.vip
- domain: text.cherry-pink.shop
- domain: tumbl.design-x.xyz
- domain: ty.klipxytozyi.shop
- domain: w1.discoverconicalcrouton.shop
- domain: xxx.retweet.shop
- domain: yob.yrwebsdf.shop
New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
Description
UNC5142, a financially motivated threat actor, has been tracked since late 2023 for abusing blockchain technology to distribute infostealers. The group exploits vulnerable WordPress sites and employs the 'EtherHiding' technique to obscure malicious code on the BNB Smart Chain. Their infection chain involves a multistage JavaScript downloader called CLEARSHORT, compromised WordPress sites, and smart contracts. UNC5142 has evolved its tactics, using a three-level smart contract system for dynamic payload delivery and abusing legitimate services like Cloudflare Pages. The group has distributed various infostealers, including ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF. Their operations have impacted multiple industries and geographic regions, with approximately 14,000 compromised web pages identified as of June 2025.
AI-Powered Analysis
Technical Analysis
UNC5142 is a financially motivated cyber threat group tracked since late 2023 that innovatively combines traditional web exploitation with blockchain technology to distribute infostealer malware. The group targets vulnerable WordPress websites, exploiting common web application weaknesses to inject malicious JavaScript code. Their infection chain begins with a multistage JavaScript downloader called CLEARSHORT, which is designed to fetch and execute payloads dynamically. A key innovation is their use of the 'EtherHiding' technique on the BNB Smart Chain, a blockchain platform, where malicious code is embedded within smart contracts to evade traditional detection mechanisms. UNC5142 employs a sophisticated three-level smart contract system that allows dynamic and flexible payload delivery, making it harder for defenders to predict or block the malware distribution. They also abuse legitimate cloud services, notably Cloudflare Pages, to host or proxy malicious content, further complicating detection and takedown efforts. The malware payloads distributed include several well-known infostealers such as ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF, which are capable of stealing sensitive information like credentials, cookies, and system data. The group’s operations have compromised approximately 14,000 web pages globally by mid-2025, affecting multiple industries including finance, e-commerce, and technology. The use of blockchain smart contracts for malware delivery represents an evolution in threat actor tactics, blending decentralized technologies with traditional cybercrime methods. This approach allows UNC5142 to maintain persistence, evade signature-based detection, and dynamically update payloads. The threat actor’s abuse of WordPress—a widely used content management system—combined with blockchain and cloud service exploitation, poses a multifaceted challenge for defenders.
Potential Impact
For European organizations, the impact of UNC5142’s operations can be significant. The compromise of WordPress sites can lead to unauthorized access, data theft, and reputational damage, especially for businesses relying on e-commerce or customer portals. Infostealers like ATOMIC and VIDAR can exfiltrate sensitive credentials, financial information, and personal data, potentially leading to further intrusions or fraud. The use of blockchain smart contracts for malware delivery complicates detection and response, increasing dwell time and the risk of widespread infection. Organizations in finance, technology, and retail sectors are particularly vulnerable due to their reliance on web platforms and blockchain technologies. Additionally, the abuse of legitimate services such as Cloudflare Pages can hinder traditional network-based defenses, allowing malware distribution to continue undetected. The scale of compromise—approximately 14,000 web pages—indicates a broad attack surface and potential for supply chain impacts if third-party websites are affected. This threat also raises concerns about the security of blockchain-based applications and smart contracts, which are increasingly adopted in European markets. Overall, the threat could lead to significant data breaches, financial losses, and erosion of trust in digital services.
Mitigation Recommendations
1. Harden WordPress installations by applying all security patches promptly, disabling unused plugins/themes, and enforcing strong authentication mechanisms such as MFA. 2. Conduct regular vulnerability assessments and penetration testing focused on web applications to identify and remediate exploitable weaknesses. 3. Monitor JavaScript execution and network traffic for unusual patterns, especially those involving dynamic payload downloads or connections to blockchain nodes and smart contracts. 4. Implement web application firewalls (WAFs) with updated signatures and behavioral detection capabilities to block malicious payload delivery attempts. 5. Scrutinize and restrict the use of third-party cloud services like Cloudflare Pages, ensuring only trusted content is served and monitoring for abuse. 6. Employ threat intelligence feeds to detect indicators related to UNC5142 infrastructure and malware hashes. 7. Educate web administrators and developers on secure coding practices and the risks of blockchain-based malware delivery. 8. Use endpoint detection and response (EDR) tools capable of detecting infostealer behaviors and anomalous process executions. 9. Establish incident response plans that include blockchain forensic capabilities to analyze smart contract abuse. 10. Collaborate with blockchain platform providers to report and mitigate malicious smart contracts leveraging EtherHiding techniques.
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware"]
- Adversary
- UNC5142
- Pulse Id
- 68f130fe56a14a2de8f391b4
- Threat Score
- null
Indicators of Compromise
Ip
| Value | Description | Copy |
|---|---|---|
ip80.64.30.238 | — | |
ip82.115.223.9 | — | |
ip83.217.208.130 | — | |
ip91.240.118.2 | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash7456f63a46cc318334a70159aa3c4291 | — | |
hashe94affb98148fc4e0cfb9a486bb37160 | — | |
hash3cf9cbca48ed9e36a0ccd17cf97f6e4b96c14a24 | — | |
hash53fd54f55c93f9bcca471cd0ccbabc3acbd3e4aa | — | |
hash8fba1667bef5eda433928b220886a830488549bd | — | |
hash9179dda8b285040bf381aabb8a1f4a1b8c37ed53 | — | |
hash091f9db54382708327f5bb1831a4626897b6710ffe11d835724be5c224a0cf83 | — | |
hash27105be1bdd9f15a1b1a2b0cc5de625e2ecd47fdeaed135321641eea86ad6cb0 | — | |
hash3023b0331baff73ff894087d1a425ea4b2746caf514ada624370318f27e29c2c | — | |
hash4b47b55ae448668e549ffc04e82aee41ac10e3c8b183012a105faf2360fc5ec1 | — | |
hash72d8fa46f402dcc4be78306d0535c9ace0eb9fabae59bd3ba3cc62a0bdf3db91 | — | |
hash88019011af71af986a64f68316e80f30d3f57186aa62c3cef5ed139eb49a6842 | — | |
hashbcbdb74f97092dfd68e7ec1d6770b6d1e1aae091f43bcebb0b7bce6c8188e310 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://83.217.208.130/xfiles/Ohio.mp4 | — | |
urlhttp://83.217.208.130/xfiles/VIDA.mp3 | — | |
urlhttp://83.217.208.130/xfiles/VIDA.mp4 | — | |
urlhttp://83.217.208.130/xfiles/trip.mp4 | — | |
urlhttp://83.217.208.130/xfiles/trip.psd | — | |
urlhttp://ads.green-pickle-jo.shop/1.m4a | — | |
urlhttp://ai.fdswgw.shop/one.mp4 | — | |
urlhttp://app.bytevista.cloud/wfree | — | |
urlhttp://betiv.fun/7456f63a46cc318334a70159aa3c4291.txt | — | |
urlhttp://black.hologramm.us/ | — | |
urlhttp://block.a-1-a1a.shop/drive.mp3 | — | |
urlhttp://bridge.tree-sock-rain.today/ | — | |
urlhttp://butanse.shop/ | — | |
urlhttp://bytes.microstorage.shop/ | — | |
urlhttp://captcha-cdn.com/verify.sh | — | |
urlhttp://captcha-verify-6r4x.com/verify.sh | — | |
urlhttp://def.ball-strike-up.shop/ | — | |
urlhttp://discover-travel-agency.pro/1.m4a | — | |
urlhttp://discover-travel-agency.pro/joke.m4a | — | |
urlhttp://discover-travel-agency.pro/walking.mp3 | — | |
urlhttp://dns-verify-me.pro/xfiles/train.mp4 | — | |
urlhttp://e.overallwobbly.ru/era-stc | — | |
urlhttp://entrinidad.cfd/1/verify.sh | — | |
urlhttp://human-verify-4r.pro/xfiles/human.cpp | — | |
urlhttp://human-verify-4r.pro/xfiles/verify.mp4 | — | |
urlhttp://human-verify.shop/xfiles/verify.mp4 | — | |
urlhttp://hur.bweqlkjr.shop/1a.m4a | — | |
urlhttp://hur.bweqlkjr.shop/m41.mp4 | — | |
urlhttp://items.kycc-camera.shop/ | — | |
urlhttp://jdiazmemory.com/4/verify.sh | — | |
urlhttp://kimbeech.cfd/cap/verify.sh | — | |
urlhttp://lammysecurity.com/4/verify.sh | — | |
urlhttp://lapkimeow.icu/check | — | |
urlhttp://lumichain.pro/ | — | |
urlhttp://message.zoo-ciry.shop/ | — | |
urlhttp://mnjk-jk.bsdfg-zmp-q-n.shop/1.mp4 | — | |
urlhttp://nbhg-v.iuksdfb-f.shop/ajax.mp3 | — | |
urlhttp://note1.nz7bn.pro/nnp.mp4 | — | |
urlhttp://ok.fish-cloud-jar.us/ | — | |
urlhttp://power.moon-river-coin.xyz/ | — | |
urlhttp://privatunis.cfd/1/verify.sh | — | |
urlhttp://recaptcha-manual.shop/kangarooing.m4a | — | |
urlhttp://recaptcha-verify-4h.pro/kangarooing.m4a | — | |
urlhttp://recaptcha-verify-4h.pro/xfiles/kangarooing.vsdx | — | |
urlhttp://recaptcha-verify-4h.pro/xfiles/verify.mp4 | — | |
urlhttp://rengular11.today/ | — | |
urlhttp://run.fox-chair-dust.xyz/ | — | |
urlhttp://salorttactical.top/2/verify.sh | — | |
urlhttp://sandbox.silver-map-generator.shop/ | — | |
urlhttp://sandbox.yunqof.shop/macan.mp3 | — | |
urlhttp://security-2k7q-check.com/1/verify.sh | — | |
urlhttp://security-2u6g-log.com/1/verify.sh | — | |
urlhttp://security-7f2c-run.com/2/verify.sh | — | |
urlhttp://security-9y5v-scan.com/3/verify.sh | — | |
urlhttp://security-9y5v-scan.com/7/verify.sh | — | |
urlhttp://security-a2k8-go.com/6/verify.sh | — | |
urlhttp://security-check-l2j4.com/verify.sh | — | |
urlhttp://security-check-u8a6.com/2/verify.sh | — | |
urlhttp://start.cleaning-room-device.shop/sha589.m4a | — | |
urlhttp://stat.bluetroniq.vip/ | — | |
urlhttp://tofukai.cfd/2/verify.sh | — | |
urlhttp://tumbl.design-x.xyz/glass.mp3 | — | |
urlhttp://xxx.retweet.shop/ | — | |
urlhttp://yob.yrwebsdf.shop/1a.m4a | — | |
urlhttp://yob.yrwebsdf.shop/3t.mp4 | — | |
urlhttps://browser-storage.com/update | — | |
urlhttps://saaadnesss.shop/check' | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainactiothreaz.com | — | |
domainbetiv.fun | — | |
domainblast-hubs.com | — | |
domainblastikcn.com | — | |
domainbreedertremnd.com | — | |
domainbrowser-storage.com | — | |
domainbutanse.shop | — | |
domaincaptcha-cdn.com | — | |
domaincaptcha-verify-6r4x.com | — | |
domaincxheerfulriver.pics | — | |
domaindecreaserid.world | — | |
domaindiscover-travel-agency.pro | — | |
domaindns-verify-me.pro | — | |
domaindsfljsdfjewf.info | — | |
domainentrinidad.cfd | — | |
domainfleebunga.sbs | — | |
domaingarulouscuto.com | — | |
domainhfdjmoedkjf.asia | — | |
domainhoyoverse.blog | — | |
domainhuman-verify-4r.pro | — | |
domainhuman-verify.shop | — | |
domainimportenptoc.com | — | |
domaininputrreparnt.com | — | |
domainjdiazmemory.com | — | |
domainkimbeech.cfd | — | |
domainlammysecurity.com | — | |
domainlapkimeow.icu | — | |
domainlumichain.pro | — | |
domainopbafindi.com | — | |
domainorange-service.xyz | — | |
domainpasteflawwed.world | — | |
domainpolovoiinspektor.shop | — | |
domainprivatunis.cfd | — | |
domainratatui.today | — | |
domainrebeldettern.com | — | |
domainrecaptcha-manual.shop | — | |
domainrecaptcha-verify-4h.pro | — | |
domainrengular11.today | — | |
domainsaaadnesss.shop | — | |
domainsalorttactical.top | — | |
domainsecurity-2k7q-check.com | — | |
domainsecurity-2u6g-log.com | — | |
domainsecurity-7f2c-run.com | — | |
domainsecurity-9y5v-scan.com | — | |
domainsecurity-a2k8-go.com | — | |
domainsecurity-check-l2j4.com | — | |
domainsecurity-check-u8a6.com | — | |
domainstchkr.rest | — | |
domainstormlegue.com | — | |
domaintechnavix.cloud | — | |
domaintlfiyat.shop | — | |
domaintofukai.cfd | — | |
domaintorpdidebar.com | — | |
domainvoicesharped.com | — | |
domainzenrichyourlife.tech | — | |
domainads.green-pickle-jo.shop | — | |
domainai.fdswgw.shop | — | |
domainblack.hologramm.us | — | |
domainblock.a-1-a1a.shop | — | |
domainbridge.tree-sock-rain.today | — | |
domainbytes.microstorage.shop | — | |
domaindef.ball-strike-up.shop | — | |
domaine.overallwobbly.ru | — | |
domaingoogleapis-n-cdn3s-server.willingcapablepatronage.shop | — | |
domainhur.bweqlkjr.shop | — | |
domainitems.kycc-camera.shop | — | |
domainkangla.klipxytozyi.shop | — | |
domainmessage.zoo-ciry.shop | — | |
domainmnjk-jk.bsdfg-zmp-q-n.shop | — | |
domainnbhg-v.iuksdfb-f.shop | — | |
domainnote1.nz7bn.pro | — | |
domainok.fish-cloud-jar.us | — | |
domainpower.moon-river-coin.xyz | — | |
domainrbk.scalingposturestrife.shop | — | |
domainrun.fox-chair-dust.xyz | — | |
domainsandbox.silver-map-generator.shop | — | |
domainsandbox.yunqof.shop | — | |
domainstart.cleaning-room-device.shop | — | |
domainstat.bluetroniq.vip | — | |
domaintext.cherry-pink.shop | — | |
domaintumbl.design-x.xyz | — | |
domainty.klipxytozyi.shop | — | |
domainw1.discoverconicalcrouton.shop | — | |
domainxxx.retweet.shop | — | |
domainyob.yrwebsdf.shop | — |
Threat ID: 68f163919f8a5dbaea0bfdd7
Added to database: 10/16/2025, 9:28:49 PM
Last enriched: 10/16/2025, 9:45:02 PM
Last updated: 12/2/2025, 10:02:12 AM
Views: 245
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
ThreatFox IOCs for 2025-12-01
MediumArkanix Stealer: Newly discovered short term profit malware
MediumNew Albiriox Android Malware Developed by Russian Cybercriminals
MediumWebinar: The "Agentic" Trojan Horse: Why the New AI Browsers War is a Nightmare for Security Teams
MediumNew Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control
MediumActions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.