New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
UNC5142 is a financially motivated threat actor active since late 2023, leveraging blockchain technology and compromised WordPress sites to distribute infostealer malware. They employ a sophisticated technique called EtherHiding on the BNB Smart Chain to obscure malicious code within smart contracts. Their infection chain uses a multistage JavaScript downloader named CLEARSHORT, combined with a three-level smart contract system for dynamic payload delivery, and abuses legitimate services such as Cloudflare Pages. The group distributes multiple infostealers including ATOMIC, VIDAR, LUMMAC. V2, and RADTHIEF, impacting diverse industries globally. Approximately 14,000 compromised web pages have been identified as of mid-2025. This threat exploits web application vulnerabilities and blockchain smart contracts to evade detection and maintain persistence. European organizations using WordPress and interacting with blockchain technologies are at risk, especially those in finance, e-commerce, and technology sectors. Mitigation requires securing WordPress instances, monitoring blockchain interactions, and scrutinizing third-party services like Cloudflare Pages. Given the complexity, dynamic payload delivery, and potential data theft, the threat severity is assessed as high.
AI Analysis
Technical Summary
UNC5142 is a financially motivated cyber threat group tracked since late 2023 that innovatively combines traditional web exploitation with blockchain technology to distribute infostealer malware. The group targets vulnerable WordPress websites, exploiting common web application weaknesses to inject malicious JavaScript code. Their infection chain begins with a multistage JavaScript downloader called CLEARSHORT, which is designed to fetch and execute payloads dynamically. A key innovation is their use of the 'EtherHiding' technique on the BNB Smart Chain, a blockchain platform, where malicious code is embedded within smart contracts to evade traditional detection mechanisms. UNC5142 employs a sophisticated three-level smart contract system that allows dynamic and flexible payload delivery, making it harder for defenders to predict or block the malware distribution. They also abuse legitimate cloud services, notably Cloudflare Pages, to host or proxy malicious content, further complicating detection and takedown efforts. The malware payloads distributed include several well-known infostealers such as ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF, which are capable of stealing sensitive information like credentials, cookies, and system data. The group’s operations have compromised approximately 14,000 web pages globally by mid-2025, affecting multiple industries including finance, e-commerce, and technology. The use of blockchain smart contracts for malware delivery represents an evolution in threat actor tactics, blending decentralized technologies with traditional cybercrime methods. This approach allows UNC5142 to maintain persistence, evade signature-based detection, and dynamically update payloads. The threat actor’s abuse of WordPress—a widely used content management system—combined with blockchain and cloud service exploitation, poses a multifaceted challenge for defenders.
Potential Impact
For European organizations, the impact of UNC5142’s operations can be significant. The compromise of WordPress sites can lead to unauthorized access, data theft, and reputational damage, especially for businesses relying on e-commerce or customer portals. Infostealers like ATOMIC and VIDAR can exfiltrate sensitive credentials, financial information, and personal data, potentially leading to further intrusions or fraud. The use of blockchain smart contracts for malware delivery complicates detection and response, increasing dwell time and the risk of widespread infection. Organizations in finance, technology, and retail sectors are particularly vulnerable due to their reliance on web platforms and blockchain technologies. Additionally, the abuse of legitimate services such as Cloudflare Pages can hinder traditional network-based defenses, allowing malware distribution to continue undetected. The scale of compromise—approximately 14,000 web pages—indicates a broad attack surface and potential for supply chain impacts if third-party websites are affected. This threat also raises concerns about the security of blockchain-based applications and smart contracts, which are increasingly adopted in European markets. Overall, the threat could lead to significant data breaches, financial losses, and erosion of trust in digital services.
Mitigation Recommendations
1. Harden WordPress installations by applying all security patches promptly, disabling unused plugins/themes, and enforcing strong authentication mechanisms such as MFA. 2. Conduct regular vulnerability assessments and penetration testing focused on web applications to identify and remediate exploitable weaknesses. 3. Monitor JavaScript execution and network traffic for unusual patterns, especially those involving dynamic payload downloads or connections to blockchain nodes and smart contracts. 4. Implement web application firewalls (WAFs) with updated signatures and behavioral detection capabilities to block malicious payload delivery attempts. 5. Scrutinize and restrict the use of third-party cloud services like Cloudflare Pages, ensuring only trusted content is served and monitoring for abuse. 6. Employ threat intelligence feeds to detect indicators related to UNC5142 infrastructure and malware hashes. 7. Educate web administrators and developers on secure coding practices and the risks of blockchain-based malware delivery. 8. Use endpoint detection and response (EDR) tools capable of detecting infostealer behaviors and anomalous process executions. 9. Establish incident response plans that include blockchain forensic capabilities to analyze smart contract abuse. 10. Collaborate with blockchain platform providers to report and mitigate malicious smart contracts leveraging EtherHiding techniques.
Affected Countries
Germany, United Kingdom, France, Netherlands, Italy, Spain, Poland, Belgium, Sweden, Switzerland
Indicators of Compromise
- ip: 80.64.30.238
- ip: 82.115.223.9
- hash: 7456f63a46cc318334a70159aa3c4291
- hash: e94affb98148fc4e0cfb9a486bb37160
- hash: 3cf9cbca48ed9e36a0ccd17cf97f6e4b96c14a24
- hash: 53fd54f55c93f9bcca471cd0ccbabc3acbd3e4aa
- hash: 8fba1667bef5eda433928b220886a830488549bd
- hash: 9179dda8b285040bf381aabb8a1f4a1b8c37ed53
- hash: 091f9db54382708327f5bb1831a4626897b6710ffe11d835724be5c224a0cf83
- hash: 27105be1bdd9f15a1b1a2b0cc5de625e2ecd47fdeaed135321641eea86ad6cb0
- hash: 3023b0331baff73ff894087d1a425ea4b2746caf514ada624370318f27e29c2c
- hash: 4b47b55ae448668e549ffc04e82aee41ac10e3c8b183012a105faf2360fc5ec1
- hash: 72d8fa46f402dcc4be78306d0535c9ace0eb9fabae59bd3ba3cc62a0bdf3db91
- hash: 88019011af71af986a64f68316e80f30d3f57186aa62c3cef5ed139eb49a6842
- hash: bcbdb74f97092dfd68e7ec1d6770b6d1e1aae091f43bcebb0b7bce6c8188e310
- ip: 83.217.208.130
- ip: 91.240.118.2
- url: http://83.217.208.130/xfiles/Ohio.mp4
- url: http://83.217.208.130/xfiles/VIDA.mp3
- url: http://83.217.208.130/xfiles/VIDA.mp4
- url: http://83.217.208.130/xfiles/trip.mp4
- url: http://83.217.208.130/xfiles/trip.psd
- url: http://ads.green-pickle-jo.shop/1.m4a
- url: http://ai.fdswgw.shop/one.mp4
- url: http://app.bytevista.cloud/wfree
- url: http://betiv.fun/7456f63a46cc318334a70159aa3c4291.txt
- url: http://black.hologramm.us/
- url: http://block.a-1-a1a.shop/drive.mp3
- url: http://bridge.tree-sock-rain.today/
- url: http://butanse.shop/
- url: http://bytes.microstorage.shop/
- url: http://captcha-cdn.com/verify.sh
- url: http://captcha-verify-6r4x.com/verify.sh
- url: http://def.ball-strike-up.shop/
- url: http://discover-travel-agency.pro/1.m4a
- url: http://discover-travel-agency.pro/joke.m4a
- url: http://discover-travel-agency.pro/walking.mp3
- url: http://dns-verify-me.pro/xfiles/train.mp4
- url: http://e.overallwobbly.ru/era-stc
- url: http://entrinidad.cfd/1/verify.sh
- url: http://human-verify-4r.pro/xfiles/human.cpp
- url: http://human-verify-4r.pro/xfiles/verify.mp4
- url: http://human-verify.shop/xfiles/verify.mp4
- url: http://hur.bweqlkjr.shop/1a.m4a
- url: http://hur.bweqlkjr.shop/m41.mp4
- url: http://items.kycc-camera.shop/
- url: http://jdiazmemory.com/4/verify.sh
- url: http://kimbeech.cfd/cap/verify.sh
- url: http://lammysecurity.com/4/verify.sh
- url: http://lapkimeow.icu/check
- url: http://lumichain.pro/
- url: http://message.zoo-ciry.shop/
- url: http://mnjk-jk.bsdfg-zmp-q-n.shop/1.mp4
- url: http://nbhg-v.iuksdfb-f.shop/ajax.mp3
- url: http://note1.nz7bn.pro/nnp.mp4
- url: http://ok.fish-cloud-jar.us/
- url: http://power.moon-river-coin.xyz/
- url: http://privatunis.cfd/1/verify.sh
- url: http://recaptcha-manual.shop/kangarooing.m4a
- url: http://recaptcha-verify-4h.pro/kangarooing.m4a
- url: http://recaptcha-verify-4h.pro/xfiles/kangarooing.vsdx
- url: http://recaptcha-verify-4h.pro/xfiles/verify.mp4
- url: http://rengular11.today/
- url: http://run.fox-chair-dust.xyz/
- url: http://salorttactical.top/2/verify.sh
- url: http://sandbox.silver-map-generator.shop/
- url: http://sandbox.yunqof.shop/macan.mp3
- url: http://security-2k7q-check.com/1/verify.sh
- url: http://security-2u6g-log.com/1/verify.sh
- url: http://security-7f2c-run.com/2/verify.sh
- url: http://security-9y5v-scan.com/3/verify.sh
- url: http://security-9y5v-scan.com/7/verify.sh
- url: http://security-a2k8-go.com/6/verify.sh
- url: http://security-check-l2j4.com/verify.sh
- url: http://security-check-u8a6.com/2/verify.sh
- url: http://start.cleaning-room-device.shop/sha589.m4a
- url: http://stat.bluetroniq.vip/
- url: http://tofukai.cfd/2/verify.sh
- url: http://tumbl.design-x.xyz/glass.mp3
- url: http://xxx.retweet.shop/
- url: http://yob.yrwebsdf.shop/1a.m4a
- url: http://yob.yrwebsdf.shop/3t.mp4
- url: https://browser-storage.com/update
- url: https://saaadnesss.shop/check'
- domain: actiothreaz.com
- domain: betiv.fun
- domain: blast-hubs.com
- domain: blastikcn.com
- domain: breedertremnd.com
- domain: browser-storage.com
- domain: butanse.shop
- domain: captcha-cdn.com
- domain: captcha-verify-6r4x.com
- domain: cxheerfulriver.pics
- domain: decreaserid.world
- domain: discover-travel-agency.pro
- domain: dns-verify-me.pro
- domain: dsfljsdfjewf.info
- domain: entrinidad.cfd
- domain: fleebunga.sbs
- domain: garulouscuto.com
- domain: hfdjmoedkjf.asia
- domain: hoyoverse.blog
- domain: human-verify-4r.pro
- domain: human-verify.shop
- domain: importenptoc.com
- domain: inputrreparnt.com
- domain: jdiazmemory.com
- domain: kimbeech.cfd
- domain: lammysecurity.com
- domain: lapkimeow.icu
- domain: lumichain.pro
- domain: opbafindi.com
- domain: orange-service.xyz
- domain: pasteflawwed.world
- domain: polovoiinspektor.shop
- domain: privatunis.cfd
- domain: ratatui.today
- domain: rebeldettern.com
- domain: recaptcha-manual.shop
- domain: recaptcha-verify-4h.pro
- domain: rengular11.today
- domain: saaadnesss.shop
- domain: salorttactical.top
- domain: security-2k7q-check.com
- domain: security-2u6g-log.com
- domain: security-7f2c-run.com
- domain: security-9y5v-scan.com
- domain: security-a2k8-go.com
- domain: security-check-l2j4.com
- domain: security-check-u8a6.com
- domain: stchkr.rest
- domain: stormlegue.com
- domain: technavix.cloud
- domain: tlfiyat.shop
- domain: tofukai.cfd
- domain: torpdidebar.com
- domain: voicesharped.com
- domain: zenrichyourlife.tech
- domain: ads.green-pickle-jo.shop
- domain: ai.fdswgw.shop
- domain: black.hologramm.us
- domain: block.a-1-a1a.shop
- domain: bridge.tree-sock-rain.today
- domain: bytes.microstorage.shop
- domain: def.ball-strike-up.shop
- domain: e.overallwobbly.ru
- domain: googleapis-n-cdn3s-server.willingcapablepatronage.shop
- domain: hur.bweqlkjr.shop
- domain: items.kycc-camera.shop
- domain: kangla.klipxytozyi.shop
- domain: message.zoo-ciry.shop
- domain: mnjk-jk.bsdfg-zmp-q-n.shop
- domain: nbhg-v.iuksdfb-f.shop
- domain: note1.nz7bn.pro
- domain: ok.fish-cloud-jar.us
- domain: power.moon-river-coin.xyz
- domain: rbk.scalingposturestrife.shop
- domain: run.fox-chair-dust.xyz
- domain: sandbox.silver-map-generator.shop
- domain: sandbox.yunqof.shop
- domain: start.cleaning-room-device.shop
- domain: stat.bluetroniq.vip
- domain: text.cherry-pink.shop
- domain: tumbl.design-x.xyz
- domain: ty.klipxytozyi.shop
- domain: w1.discoverconicalcrouton.shop
- domain: xxx.retweet.shop
- domain: yob.yrwebsdf.shop
New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
Description
UNC5142 is a financially motivated threat actor active since late 2023, leveraging blockchain technology and compromised WordPress sites to distribute infostealer malware. They employ a sophisticated technique called EtherHiding on the BNB Smart Chain to obscure malicious code within smart contracts. Their infection chain uses a multistage JavaScript downloader named CLEARSHORT, combined with a three-level smart contract system for dynamic payload delivery, and abuses legitimate services such as Cloudflare Pages. The group distributes multiple infostealers including ATOMIC, VIDAR, LUMMAC. V2, and RADTHIEF, impacting diverse industries globally. Approximately 14,000 compromised web pages have been identified as of mid-2025. This threat exploits web application vulnerabilities and blockchain smart contracts to evade detection and maintain persistence. European organizations using WordPress and interacting with blockchain technologies are at risk, especially those in finance, e-commerce, and technology sectors. Mitigation requires securing WordPress instances, monitoring blockchain interactions, and scrutinizing third-party services like Cloudflare Pages. Given the complexity, dynamic payload delivery, and potential data theft, the threat severity is assessed as high.
AI-Powered Analysis
Technical Analysis
UNC5142 is a financially motivated cyber threat group tracked since late 2023 that innovatively combines traditional web exploitation with blockchain technology to distribute infostealer malware. The group targets vulnerable WordPress websites, exploiting common web application weaknesses to inject malicious JavaScript code. Their infection chain begins with a multistage JavaScript downloader called CLEARSHORT, which is designed to fetch and execute payloads dynamically. A key innovation is their use of the 'EtherHiding' technique on the BNB Smart Chain, a blockchain platform, where malicious code is embedded within smart contracts to evade traditional detection mechanisms. UNC5142 employs a sophisticated three-level smart contract system that allows dynamic and flexible payload delivery, making it harder for defenders to predict or block the malware distribution. They also abuse legitimate cloud services, notably Cloudflare Pages, to host or proxy malicious content, further complicating detection and takedown efforts. The malware payloads distributed include several well-known infostealers such as ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF, which are capable of stealing sensitive information like credentials, cookies, and system data. The group’s operations have compromised approximately 14,000 web pages globally by mid-2025, affecting multiple industries including finance, e-commerce, and technology. The use of blockchain smart contracts for malware delivery represents an evolution in threat actor tactics, blending decentralized technologies with traditional cybercrime methods. This approach allows UNC5142 to maintain persistence, evade signature-based detection, and dynamically update payloads. The threat actor’s abuse of WordPress—a widely used content management system—combined with blockchain and cloud service exploitation, poses a multifaceted challenge for defenders.
Potential Impact
For European organizations, the impact of UNC5142’s operations can be significant. The compromise of WordPress sites can lead to unauthorized access, data theft, and reputational damage, especially for businesses relying on e-commerce or customer portals. Infostealers like ATOMIC and VIDAR can exfiltrate sensitive credentials, financial information, and personal data, potentially leading to further intrusions or fraud. The use of blockchain smart contracts for malware delivery complicates detection and response, increasing dwell time and the risk of widespread infection. Organizations in finance, technology, and retail sectors are particularly vulnerable due to their reliance on web platforms and blockchain technologies. Additionally, the abuse of legitimate services such as Cloudflare Pages can hinder traditional network-based defenses, allowing malware distribution to continue undetected. The scale of compromise—approximately 14,000 web pages—indicates a broad attack surface and potential for supply chain impacts if third-party websites are affected. This threat also raises concerns about the security of blockchain-based applications and smart contracts, which are increasingly adopted in European markets. Overall, the threat could lead to significant data breaches, financial losses, and erosion of trust in digital services.
Mitigation Recommendations
1. Harden WordPress installations by applying all security patches promptly, disabling unused plugins/themes, and enforcing strong authentication mechanisms such as MFA. 2. Conduct regular vulnerability assessments and penetration testing focused on web applications to identify and remediate exploitable weaknesses. 3. Monitor JavaScript execution and network traffic for unusual patterns, especially those involving dynamic payload downloads or connections to blockchain nodes and smart contracts. 4. Implement web application firewalls (WAFs) with updated signatures and behavioral detection capabilities to block malicious payload delivery attempts. 5. Scrutinize and restrict the use of third-party cloud services like Cloudflare Pages, ensuring only trusted content is served and monitoring for abuse. 6. Employ threat intelligence feeds to detect indicators related to UNC5142 infrastructure and malware hashes. 7. Educate web administrators and developers on secure coding practices and the risks of blockchain-based malware delivery. 8. Use endpoint detection and response (EDR) tools capable of detecting infostealer behaviors and anomalous process executions. 9. Establish incident response plans that include blockchain forensic capabilities to analyze smart contract abuse. 10. Collaborate with blockchain platform providers to report and mitigate malicious smart contracts leveraging EtherHiding techniques.
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware"]
- Adversary
- UNC5142
- Pulse Id
- 68f130fe56a14a2de8f391b4
- Threat Score
- null
Indicators of Compromise
Ip
| Value | Description | Copy |
|---|---|---|
ip80.64.30.238 | — | |
ip82.115.223.9 | — | |
ip83.217.208.130 | — | |
ip91.240.118.2 | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash7456f63a46cc318334a70159aa3c4291 | — | |
hashe94affb98148fc4e0cfb9a486bb37160 | — | |
hash3cf9cbca48ed9e36a0ccd17cf97f6e4b96c14a24 | — | |
hash53fd54f55c93f9bcca471cd0ccbabc3acbd3e4aa | — | |
hash8fba1667bef5eda433928b220886a830488549bd | — | |
hash9179dda8b285040bf381aabb8a1f4a1b8c37ed53 | — | |
hash091f9db54382708327f5bb1831a4626897b6710ffe11d835724be5c224a0cf83 | — | |
hash27105be1bdd9f15a1b1a2b0cc5de625e2ecd47fdeaed135321641eea86ad6cb0 | — | |
hash3023b0331baff73ff894087d1a425ea4b2746caf514ada624370318f27e29c2c | — | |
hash4b47b55ae448668e549ffc04e82aee41ac10e3c8b183012a105faf2360fc5ec1 | — | |
hash72d8fa46f402dcc4be78306d0535c9ace0eb9fabae59bd3ba3cc62a0bdf3db91 | — | |
hash88019011af71af986a64f68316e80f30d3f57186aa62c3cef5ed139eb49a6842 | — | |
hashbcbdb74f97092dfd68e7ec1d6770b6d1e1aae091f43bcebb0b7bce6c8188e310 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://83.217.208.130/xfiles/Ohio.mp4 | — | |
urlhttp://83.217.208.130/xfiles/VIDA.mp3 | — | |
urlhttp://83.217.208.130/xfiles/VIDA.mp4 | — | |
urlhttp://83.217.208.130/xfiles/trip.mp4 | — | |
urlhttp://83.217.208.130/xfiles/trip.psd | — | |
urlhttp://ads.green-pickle-jo.shop/1.m4a | — | |
urlhttp://ai.fdswgw.shop/one.mp4 | — | |
urlhttp://app.bytevista.cloud/wfree | — | |
urlhttp://betiv.fun/7456f63a46cc318334a70159aa3c4291.txt | — | |
urlhttp://black.hologramm.us/ | — | |
urlhttp://block.a-1-a1a.shop/drive.mp3 | — | |
urlhttp://bridge.tree-sock-rain.today/ | — | |
urlhttp://butanse.shop/ | — | |
urlhttp://bytes.microstorage.shop/ | — | |
urlhttp://captcha-cdn.com/verify.sh | — | |
urlhttp://captcha-verify-6r4x.com/verify.sh | — | |
urlhttp://def.ball-strike-up.shop/ | — | |
urlhttp://discover-travel-agency.pro/1.m4a | — | |
urlhttp://discover-travel-agency.pro/joke.m4a | — | |
urlhttp://discover-travel-agency.pro/walking.mp3 | — | |
urlhttp://dns-verify-me.pro/xfiles/train.mp4 | — | |
urlhttp://e.overallwobbly.ru/era-stc | — | |
urlhttp://entrinidad.cfd/1/verify.sh | — | |
urlhttp://human-verify-4r.pro/xfiles/human.cpp | — | |
urlhttp://human-verify-4r.pro/xfiles/verify.mp4 | — | |
urlhttp://human-verify.shop/xfiles/verify.mp4 | — | |
urlhttp://hur.bweqlkjr.shop/1a.m4a | — | |
urlhttp://hur.bweqlkjr.shop/m41.mp4 | — | |
urlhttp://items.kycc-camera.shop/ | — | |
urlhttp://jdiazmemory.com/4/verify.sh | — | |
urlhttp://kimbeech.cfd/cap/verify.sh | — | |
urlhttp://lammysecurity.com/4/verify.sh | — | |
urlhttp://lapkimeow.icu/check | — | |
urlhttp://lumichain.pro/ | — | |
urlhttp://message.zoo-ciry.shop/ | — | |
urlhttp://mnjk-jk.bsdfg-zmp-q-n.shop/1.mp4 | — | |
urlhttp://nbhg-v.iuksdfb-f.shop/ajax.mp3 | — | |
urlhttp://note1.nz7bn.pro/nnp.mp4 | — | |
urlhttp://ok.fish-cloud-jar.us/ | — | |
urlhttp://power.moon-river-coin.xyz/ | — | |
urlhttp://privatunis.cfd/1/verify.sh | — | |
urlhttp://recaptcha-manual.shop/kangarooing.m4a | — | |
urlhttp://recaptcha-verify-4h.pro/kangarooing.m4a | — | |
urlhttp://recaptcha-verify-4h.pro/xfiles/kangarooing.vsdx | — | |
urlhttp://recaptcha-verify-4h.pro/xfiles/verify.mp4 | — | |
urlhttp://rengular11.today/ | — | |
urlhttp://run.fox-chair-dust.xyz/ | — | |
urlhttp://salorttactical.top/2/verify.sh | — | |
urlhttp://sandbox.silver-map-generator.shop/ | — | |
urlhttp://sandbox.yunqof.shop/macan.mp3 | — | |
urlhttp://security-2k7q-check.com/1/verify.sh | — | |
urlhttp://security-2u6g-log.com/1/verify.sh | — | |
urlhttp://security-7f2c-run.com/2/verify.sh | — | |
urlhttp://security-9y5v-scan.com/3/verify.sh | — | |
urlhttp://security-9y5v-scan.com/7/verify.sh | — | |
urlhttp://security-a2k8-go.com/6/verify.sh | — | |
urlhttp://security-check-l2j4.com/verify.sh | — | |
urlhttp://security-check-u8a6.com/2/verify.sh | — | |
urlhttp://start.cleaning-room-device.shop/sha589.m4a | — | |
urlhttp://stat.bluetroniq.vip/ | — | |
urlhttp://tofukai.cfd/2/verify.sh | — | |
urlhttp://tumbl.design-x.xyz/glass.mp3 | — | |
urlhttp://xxx.retweet.shop/ | — | |
urlhttp://yob.yrwebsdf.shop/1a.m4a | — | |
urlhttp://yob.yrwebsdf.shop/3t.mp4 | — | |
urlhttps://browser-storage.com/update | — | |
urlhttps://saaadnesss.shop/check' | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainactiothreaz.com | — | |
domainbetiv.fun | — | |
domainblast-hubs.com | — | |
domainblastikcn.com | — | |
domainbreedertremnd.com | — | |
domainbrowser-storage.com | — | |
domainbutanse.shop | — | |
domaincaptcha-cdn.com | — | |
domaincaptcha-verify-6r4x.com | — | |
domaincxheerfulriver.pics | — | |
domaindecreaserid.world | — | |
domaindiscover-travel-agency.pro | — | |
domaindns-verify-me.pro | — | |
domaindsfljsdfjewf.info | — | |
domainentrinidad.cfd | — | |
domainfleebunga.sbs | — | |
domaingarulouscuto.com | — | |
domainhfdjmoedkjf.asia | — | |
domainhoyoverse.blog | — | |
domainhuman-verify-4r.pro | — | |
domainhuman-verify.shop | — | |
domainimportenptoc.com | — | |
domaininputrreparnt.com | — | |
domainjdiazmemory.com | — | |
domainkimbeech.cfd | — | |
domainlammysecurity.com | — | |
domainlapkimeow.icu | — | |
domainlumichain.pro | — | |
domainopbafindi.com | — | |
domainorange-service.xyz | — | |
domainpasteflawwed.world | — | |
domainpolovoiinspektor.shop | — | |
domainprivatunis.cfd | — | |
domainratatui.today | — | |
domainrebeldettern.com | — | |
domainrecaptcha-manual.shop | — | |
domainrecaptcha-verify-4h.pro | — | |
domainrengular11.today | — | |
domainsaaadnesss.shop | — | |
domainsalorttactical.top | — | |
domainsecurity-2k7q-check.com | — | |
domainsecurity-2u6g-log.com | — | |
domainsecurity-7f2c-run.com | — | |
domainsecurity-9y5v-scan.com | — | |
domainsecurity-a2k8-go.com | — | |
domainsecurity-check-l2j4.com | — | |
domainsecurity-check-u8a6.com | — | |
domainstchkr.rest | — | |
domainstormlegue.com | — | |
domaintechnavix.cloud | — | |
domaintlfiyat.shop | — | |
domaintofukai.cfd | — | |
domaintorpdidebar.com | — | |
domainvoicesharped.com | — | |
domainzenrichyourlife.tech | — | |
domainads.green-pickle-jo.shop | — | |
domainai.fdswgw.shop | — | |
domainblack.hologramm.us | — | |
domainblock.a-1-a1a.shop | — | |
domainbridge.tree-sock-rain.today | — | |
domainbytes.microstorage.shop | — | |
domaindef.ball-strike-up.shop | — | |
domaine.overallwobbly.ru | — | |
domaingoogleapis-n-cdn3s-server.willingcapablepatronage.shop | — | |
domainhur.bweqlkjr.shop | — | |
domainitems.kycc-camera.shop | — | |
domainkangla.klipxytozyi.shop | — | |
domainmessage.zoo-ciry.shop | — | |
domainmnjk-jk.bsdfg-zmp-q-n.shop | — | |
domainnbhg-v.iuksdfb-f.shop | — | |
domainnote1.nz7bn.pro | — | |
domainok.fish-cloud-jar.us | — | |
domainpower.moon-river-coin.xyz | — | |
domainrbk.scalingposturestrife.shop | — | |
domainrun.fox-chair-dust.xyz | — | |
domainsandbox.silver-map-generator.shop | — | |
domainsandbox.yunqof.shop | — | |
domainstart.cleaning-room-device.shop | — | |
domainstat.bluetroniq.vip | — | |
domaintext.cherry-pink.shop | — | |
domaintumbl.design-x.xyz | — | |
domainty.klipxytozyi.shop | — | |
domainw1.discoverconicalcrouton.shop | — | |
domainxxx.retweet.shop | — | |
domainyob.yrwebsdf.shop | — |
Threat ID: 68f163919f8a5dbaea0bfdd7
Added to database: 10/16/2025, 9:28:49 PM
Last enriched: 10/16/2025, 9:45:02 PM
Last updated: 10/17/2025, 10:58:46 PM
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
Malicious package with AdaptixC2 framework agent found in npm registry
MediumHidden links: why your website traffic is declining
MediumCAPI Backdoor: .NET Stealer Targeting Russian Auto-Commerce
MediumMalicious Perplexity Comet Browser Download Ads Push Password Stealer Via Google Search
MediumRansomware attacks and how victims respond
MediumActions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.