################################################################ # ThreatFox IOCs: recent domains - CSV format # # Last updated: 2026-09-04 08:16:18 UTC # # # # Terms Of Use: https://threatfox.abuse.ch/faq/#tos # # For questions please contact threatfox [at] abuse.ch # ################################################################ # # "first_seen_utc","ioc_id","ioc_value","ioc_type","threat_type","fk_malware","malware_alias","malware_printable","last_seen_utc","confidence_level","is_compromised","reference","tags","anonymous","reporter" "2026-09-04 08:16:18", "1894230", "lykelydy.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-04 08:13:36", "1894229", "xkmspju76w.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-04 08:00:00", "1894223", "avantgroup.az", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 08:00:00", "1894224", "hesenhuseyindeniz.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 07:44:00", "1894222", "00vn1.top", "domain", "botnet_cc", "unknown_rat", "None", "Unknown RAT", "", "100", "False", "https://bazaar.abuse.ch/sample/ed6585c0ce967cfeaf497b8f06c15591b00110073686c73bec7ff05abdead620/", "ConnectWise,RMM,ScreenConnect", "0", "abuse_ch" "2026-09-04 07:31:45", "1894220", "bws6mgq6.usen-flashburn.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 07:31:56", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-04 07:05:28", "1894217", "mrlimousine.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 06:56:24", "1894209", "n0mxdac6.enus-us-glycomute.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-04 06:54:49", "1894208", "qpf49lup.shop-gutlite.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-04 06:45:55", "1894207", "p2ta95ng.usen--puraboost.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-04 06:45:38", "1894206", "europeshallbesaved.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 06:44:29", "1894205", "usen--puraboost.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 06:44:45", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-09-04 06:42:51", "1894041", "mariadelivery.it", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "2026-09-04 08:00:00", "75", "True", "https://www.clickfixed.uk/intel/12014", "ClickFix", "0", "ClickFixer" "2026-09-04 06:42:44", "1894149", "clash-verge-upgrade.com", "domain", "botnet_cc", "unknown_rat", "None", "Unknown RAT", "", "75", "False", "None", "RAT", "1", "anonymous" "2026-09-04 06:41:34", "1894204", "cloudyrobots.online", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "", "ClickFix", "0", "abuse_ch" "2026-09-04 06:37:48", "1894202", "vepixesu.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-04 06:33:17", "1894201", "guqyvuqe.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-04 06:09:09", "1894195", "authwic.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-09-04 05:37:47", "1894190", "proreno.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:37:47", "1894191", "traforma.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:30:41", "1894189", "awilli-india.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:45", "1894188", "fatboysdeli.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:44", "1894187", "corpindianews.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:42", "1894186", "aubergedelatour.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:40", "1894183", "www.plb-consulting.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:40", "1894184", "dj-hakuei.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:40", "1894185", "donghomovado.vn", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:39", "1894182", "emberger-dc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:38", "1894181", "forgechurch.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:29:37", "1894180", "empathydisability.com.au", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:26:26", "1894179", "ar.govaresh-zanan.ir", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:26:25", "1894177", "ntu.social", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:26:25", "1894178", "apropos-text.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:24:49", "1894176", "papillon-schmuck.de", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-04 05:01:49", "1894170", "brightmorningday.top", "domain", "cc_skimming", "js.magecart", "None", "magecart", "", "100", "False", "None", "Magecart", "0", "threatcat_ch" "2026-09-04 05:00:52", "1894169", "4iszv16b5d.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-04 04:57:41", "1894168", "davulany.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-04 04:46:27", "1894167", "1trvapwl.usen-neurovera.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-04 04:44:00", "1894166", "usen-neurovera.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 04:45:05", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-09-04 04:31:39", "1894165", "fallow-willow-diogdaiyn.xyz", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-04 03:46:06", "1894157", "immersionzone.info", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-04 03:34:06", "1894155", "mytds1029380.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-04 03:23:36", "1894154", "ay8go7sf.usen-enerflow.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-04 03:20:52", "1894153", "usen-enerflow.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 03:21:01", "100", "True", "None", "4September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-04 02:44:00", "1894144", "u4llv3k5.usen-neurosharp.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-04 02:43:49", "1894143", "usen-neurosharp.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 02:44:29", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-09-04 02:25:46", "1894141", "xi3.sm188dvlv.mom", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-04 02:25:45", "1894139", "xi3.13balien.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-04 01:59:33", "1894133", "k4h6pwge.shop-heroup.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-04 01:55:45", "1894132", "k4gwqp86.go-flashburn.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-04 00:44:47", "1894044", "7242fdr7.us-en-nervesoothe.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-04 00:42:55", "1894042", "us-en-nervesoothe.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 00:43:55", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-09-03 23:11:15", "1894033", "p59wq39u.hero--up.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-03 22:43:41", "1894027", "ysrnccu6.us-en-morningcoffeeritual.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 22:35:46", "1894025", "gdo.sm188dvlv.mom", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-03 22:35:45", "1894023", "gdo.13balien.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-03 21:23:31", "1894014", "docssend.icu", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:23:31", "1894015", "mharsborsteel.com", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:21:36", "1894013", "www.technicalauthentications.live", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:20:02", "1894012", "panelcoreapp.xyz", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:19:11", "1894011", "workingrectorys.xyz", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:18:19", "1894009", "privatetoken.cc", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:17:33", "1894008", "ericphotography.cc", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:16:47", "1894007", "kliearthmover.com", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "2026-09-03 21:20:51", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:15:55", "1894006", "www.loqinmicofstloine.icu", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:14:53", "1894005", "hook-relay.xyz", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 21:13:54", "1894004", "sharepoint-document-verification.icu", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "kali365", "0", "varysz" "2026-09-03 20:53:48", "1894000", "ritec4yt.usa-us-glycofree.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-03 20:53:41", "1893999", "r0w5dkgm.usa-usa-lipovive.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-03 20:53:00", "1893998", "usa-usa-lipovive.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 20:53:07", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 20:52:41", "1893997", "usa-us-glycofree.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 20:53:19", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-09-03 20:42:31", "1893995", "eenqtouz.enus-heroup.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 20:17:38", "1893892", "emporiumwave245768.shop", "domain", "botnet_cc", "apk.coper", "ExobotCompact,Octo", "Coper", "", "75", "False", "https://bazaar.abuse.ch/sample/841e432a41b9625040704fd636d4fc3814a6d4193fa315cd78cfed9aa3991c04/", "Android,banker,Coper,Octo", "0", "tajapps" "2026-09-03 20:17:38", "1893893", "emporiumdelight987656.shop", "domain", "botnet_cc", "apk.coper", "ExobotCompact,Octo", "Coper", "", "75", "False", "https://bazaar.abuse.ch/sample/841e432a41b9625040704fd636d4fc3814a6d4193fa315cd78cfed9aa3991c04/", "Android,banker,Coper,Octo", "0", "tajapps" "2026-09-03 20:17:37", "1893894", "shoprise57899321.shop", "domain", "botnet_cc", "apk.coper", "ExobotCompact,Octo", "Coper", "", "75", "False", "https://bazaar.abuse.ch/sample/841e432a41b9625040704fd636d4fc3814a6d4193fa315cd78cfed9aa3991c04/", "Android,banker,Coper,Octo", "0", "tajapps" "2026-09-03 20:17:37", "1893895", "universevibe123459.shop", "domain", "botnet_cc", "apk.coper", "ExobotCompact,Octo", "Coper", "", "75", "False", "https://bazaar.abuse.ch/sample/841e432a41b9625040704fd636d4fc3814a6d4193fa315cd78cfed9aa3991c04/", "Android,banker,Coper,Octo", "0", "tajapps" "2026-09-03 20:17:36", "1893896", "worldfusion891056.shop", "domain", "botnet_cc", "apk.coper", "ExobotCompact,Octo", "Coper", "", "75", "False", "https://bazaar.abuse.ch/sample/841e432a41b9625040704fd636d4fc3814a6d4193fa315cd78cfed9aa3991c04/", "Android,banker,Coper,Octo", "0", "tajapps" "2026-09-03 20:17:33", "1893899", "fatimaelredaphoto.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "2026-09-04 05:29:41", "75", "True", "https://www.clickfixed.uk/intel/11871", "ClickFix", "0", "ClickFixer" "2026-09-03 20:17:32", "1893906", "guiglen.sbs", "domain", "payload_delivery", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "2026-09-04 08:10:42", "100", "True", "https://infosec.exchange/@monitorsg/117207736614207041", "KongTuke", "0", "monitorsg" "2026-09-03 20:17:29", "1893928", "sessionstoresys.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "80", "False", "None", "ClickFix,Etherhide", "0", "ViriBack" "2026-09-03 20:17:27", "1893932", "workerwing.net", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "80", "False", "None", "ClickFix,Etherhide", "0", "ViriBack" "2026-09-03 20:17:27", "1893933", "identityoneexpress.net", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "80", "False", "None", "ClickFix,Etherhide", "0", "ViriBack" "2026-09-03 20:02:40", "1893986", "mournguardian.com", "domain", "cc_skimming", "js.magecart", "None", "magecart", "2026-09-04 05:01:26", "100", "False", "None", "Magecart", "0", "threatcat_ch" "2026-09-03 19:26:03", "1893957", "barsuki8822.life", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-03 19:22:21", "1893956", "ilovusaverivy.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-03 19:06:25", "1893954", "cmcradio.cryptotradingagents.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 19:06:24", "1893953", "warxproduct.l.cd", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "90", "True", "None", "ClickFix,compromised", "1", "anonymous" "2026-09-03 19:01:37", "1893949", "pidor.catalogotrader.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,ErrTraffic,EtherHiding", "1", "anonymous" "2026-09-03 19:00:35", "1893948", "ogax2whe.usen-glucotrust-bites.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-03 18:44:12", "1893947", "aha719f1.gluccotrust--bites.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 18:05:00", "1893944", "uranbokachok.com", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "", "100", "False", "", "c2,ClickFix", "0", "varysz" "2026-09-03 16:42:10", "1893934", "h2i7u6w3.shop-nervealive.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 15:57:12", "1893921", "xaz2.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-03 15:55:13", "1893920", "uw4x5jzx.usa-us-flashburn.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-03 15:53:28", "1893919", "v2wiot8t.usa-trumptoken.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-03 15:52:26", "1893918", "usa-trumptoken.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 15:52:33", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 15:52:16", "1893917", "usa-us-flashburn.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 15:52:45", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-09-03 15:40:46", "1893915", "ram.sm188dvlv.mom", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-03 15:40:45", "1893913", "ram.13balien.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-03 15:09:36", "1893910", "stream.fernstead.cc", "domain", "botnet_cc", "win.acr_stealer", "None", "ACR Stealer", "", "100", "False", "", "ClearFake", "0", "threatcat_ch" "2026-09-03 14:52:34", "1893901", "zhcigj8z.www-glucotrust-bites.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-03 14:44:16", "1893900", "ebe5z0d5.en-us-en-heroup.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 13:49:36", "1893890", "gor-trendz.ink", "domain", "botnet_cc", "win.snappy_client", "SilabRAT", "SnappyClient", "", "100", "False", "https://bazaar.abuse.ch/sample/394b415859c18c3aab01d28745744544307ced89fc8176df2046b090414aa06d/", "SnappyClient", "0", "abuse_ch" "2026-09-03 13:45:47", "1893887", "copperlodestar.info", "domain", "botnet_cc", "js.smartapesg", "HANEYMANEY,ZPHP", "SmartApeSG", "", "100", "False", "", "SmartApeSG", "0", "varysz" "2026-09-03 13:40:50", "1893884", "walmagua.cc", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "100", "False", "https://bazaar.abuse.ch/sample/cbc81b4999b5f5dd87ab7cd67da6bce916c28c5f03ad8622c546dc8b5e624c1d/", "None", "0", "abuse_ch" "2026-09-03 13:38:52", "1893878", "www.seachoice.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:52", "1893879", "www.skskusy.pl", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:12", "1893876", "www.hitek.com.tr", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:12", "1893877", "www.matteobuccoli.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:11", "1893871", "www.baccoapetroio.it", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:11", "1893872", "www.cemaprod.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:11", "1893873", "www.cesib.org", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:11", "1893874", "www.eventonline.co.id", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:11", "1893875", "www.fideco.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:10", "1893868", "tuongdaconggiao.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:10", "1893869", "virtualheadoffice.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:10", "1893870", "worldherald.life", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:09", "1893864", "tnahub.store", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:09", "1893865", "tool-time.ch", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:09", "1893866", "topdogwaste.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:09", "1893867", "trubode.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:08", "1893862", "sub-r.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:08", "1893863", "tailieuxaydung.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:07", "1893858", "ronginjhuri.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:07", "1893859", "rubispaurbano.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:07", "1893860", "saudismc.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:07", "1893861", "serhatboya.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:06", "1893855", "raabenweib.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:06", "1893856", "rccgcrownofglory.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:38:06", "1893857", "robbiehaupt.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:17", "1893851", "palmgatesandgaragedoorrepair.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:17", "1893852", "pascualini.com.ar", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:17", "1893853", "peterfriedlander.tv", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:17", "1893854", "pnpacademy.in", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:16", "1893849", "nepes.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:16", "1893850", "optipureresearch.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:15", "1893847", "lyonimport.com.ar", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:15", "1893848", "mazagro-art.com.pl", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:14", "1893842", "kfouriadvogados.adv.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:14", "1893843", "kiosk.euroshopmago.pl", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:14", "1893844", "lesjardinsduchateauperdu.fr", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:14", "1893845", "llscotland.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:14", "1893846", "losmejoresboletos.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:13", "1893839", "justrust.me", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:13", "1893840", "k-b-b.fr", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:13", "1893841", "keralafolkloreakademy.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 22:44:33", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:12", "1893836", "hud2.com.vn", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:12", "1893837", "huecitytours.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:12", "1893838", "ilkizyuva.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:37:11", "1893835", "galipyigit.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-03 13:34:58", "1893833", "stoppingpi82.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-03 13:34:58", "1893834", "vailora231.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-03 13:34:57", "1893831", "bizzypiu45.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-03 13:34:57", "1893832", "elizium999.digital", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-03 13:34:56", "1893830", "barsuki8822.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-03 13:31:01", "1893829", "studioinvictus.shop", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "75", "True", "", "ClickFix", "0", "varysz" "2026-09-03 13:31:00", "1893828", "getstartedtt.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "75", "True", "", "ClickFix", "0", "varysz" "2026-09-03 13:22:28", "1893827", "machine628.baby", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-09-03 13:16:57", "1893826", "per-fumum-ex.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 13:16:56", "1893825", "suisse.remedialab.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 12:42:42", "1893821", "pq6ub2tn.pura--boost.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 12:28:29", "1893818", "www.arcieriterranoaolbia.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 12:15:19", "1893816", "lovezramexar.info", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 19:19:31", "90", "False", "None", "ClearFake,ClickFix,ErrTraffic,EtherHiding", "1", "anonymous" "2026-09-03 12:07:27", "1893815", "bizzypiu45.life", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-03 11:50:18", "1893810", "msi-lausanne.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 11:50:18", "1893811", "swisswake.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 11:50:17", "1893808", "www.playshops.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 11:50:17", "1893809", "gerbli.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 11:50:14", "1893807", "suryacolectiva.nl", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 11:13:03", "1893801", "cagiky.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 11:05:16", "1893800", "usen-gutlite.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 22:02:12", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 10:53:27", "1893799", "7lqwvctv.usa-us-beastforce.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-03 10:52:55", "1893798", "usen-glycofree.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 21:42:40", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 10:52:42", "1893797", "usa-us-beastforce.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 10:52:49", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 10:52:32", "1893796", "o4bkhohp.usa--thebrainsong.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-03 10:52:30", "1893795", "usa--thebrainsong.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 10:52:37", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 10:51:19", "1893794", "usa-smartwaterbox.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 11:32:03", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 10:51:06", "1893793", "us-denta-vive.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 07:19:00", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 10:48:45", "1893792", "47jt59gp.us-en-us-heroup.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 10:48:19", "1893791", "omoyr4k2.usa-biodentix.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-03 10:47:29", "1893790", "fingerprint-veri.info", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-03 10:45:45", "1893788", "s77.sm188dvlv.mom", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-03 10:40:45", "1893786", "s77.13balien.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-03 10:19:12", "1893785", "try-prostafense.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 10:19:19", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 10:09:26", "1893780", "try-cardioslim.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 10:09:33", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 09:55:55", "1893779", "taxbizguru.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 09:55:54", "1893778", "nextlevelparks.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 09:49:56", "1893777", "thadadev.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 13:38:08", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 09:49:54", "1893776", "www.ellengromann-texte.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 09:48:58", "1893775", "0ccb70sc.thevictorytoken.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-03 09:45:56", "1893769", "thevictorytoken.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 09:46:03", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 09:39:39", "1893763", "t5n2mgno.cdn-jbgroup.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 09:37:29", "1893762", "dy1h1rmc.thetrumplapelpin.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-03 09:36:37", "1893761", "thetrumplapelpin.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 09:36:44", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 09:31:36", "1893760", "mwqhf37093.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 09:10:21", "1893754", "boydmodels.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 09:10:21", "1893755", "nexogen.lk", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 09:02:55", "1893748", "hot.sm188dvlv.mom", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-09-03 09:37:14", "100", "False", "", "Vidar", "0", "crep1x" "2026-09-03 09:02:55", "1893749", "gen.sm188dvlv.lat", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-09-03 09:02:55", "1893750", "m5p.sm188dvlv.lol", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-09-03 08:52:27", "1893739", "nazilaeshghi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:52:26", "1893738", "bricol-oc.fr", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:52:25", "1893736", "www.everythingbuddy.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:52:25", "1893737", "blueprintexecutives.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:52:23", "1893734", "thinhlemedia.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:52:23", "1893735", "ayanelectricians.co.uk", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:52:22", "1893733", "renovedesign.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:51:31", "1893732", "slyv87qw.try-burnblend.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-03 08:49:36", "1893731", "try-burnblend.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 08:49:43", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 08:29:51", "1893729", "go-glpro.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 08:29:57", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 08:29:38", "1893728", "trumplapelpin.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 08:29:44", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 08:21:34", "1893726", "shop-levium.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 08:21:40", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 08:20:19", "1893724", "trumplapelpin.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 08:20:28", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 08:18:55", "1893723", "go-flashburn.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 01:53:46", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 08:15:28", "1893720", "result-lengkap.datacambodia.domains", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:15:28", "1893721", "mail.ybo.ewq.mybluehost.me", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 09:50:01", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:15:28", "1893722", "pacharagems.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 13:37:17", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:15:27", "1893719", "rolandsjoinery.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:15:26", "1893717", "primadomfrance.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:15:26", "1893718", "rzn.pgm.mybluehost.me", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-03 08:15:24", "1893716", "pumpfunaaexposed.pages.dev", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "90", "True", "None", "ClickFix,compromised", "1", "anonymous" "2026-09-03 08:10:39", "1893714", "trumplapelpin.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 08:10:46", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 08:09:18", "1893713", "enus-us-glycomute.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 06:53:51", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 07:53:07", "1893707", "gowinu.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 07:46:50", "1893706", "tosulepa.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 07:41:20", "1893704", "yrfely7l.shop-lipovive.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 07:24:55", "1893678", "gold.albaikmenuonline.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-03 07:10:24", "1893676", "gold.albaikmenuonline.com", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,ClickFix,EtherHiding", "0", "penislandrocket" "2026-09-03 06:33:10", "1893674", "lzphy97221.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 06:25:43", "1893673", "bqumy43555.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 05:52:10", "1893669", "linkinmasgocf.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "75", "False", "", "clickfix", "1", "anonymous" "2026-09-03 05:44:12", "1893667", "faceit-anti-cheat.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "", "ClickFix", "0", "abuse_ch" "2026-09-03 05:44:12", "1893668", "faceit-cdn.org", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "", "ClickFix", "0", "abuse_ch" "2026-09-03 05:44:11", "1893666", "captcha-web.cc", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "", "ClickFix", "0", "abuse_ch" "2026-09-03 05:41:33", "1893665", "8hqon4lx.en-us-theeloncod.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 05:40:31", "1893583", "ualbiotech.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:59", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-03 05:40:28", "1893584", "vandanashivamovie.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:22", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-03 05:40:28", "1893585", "david.advancecreative.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-03 05:40:27", "1893586", "anwrealestate.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:20", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-03 05:40:26", "1893587", "portaleducoas.org", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-03 05:40:02", "1893588", "bmrentcars.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-03 05:40:01", "1893589", "elkon.gr", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:59", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-03 05:39:41", "1893483", "fpw.sm188dvlv.mom", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-09-03 09:02:55", "100", "False", "", "Vidar", "0", "siglesignon" "2026-09-03 05:39:40", "1893484", "cle.sm188dvlv.lol", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-09-03 09:02:55", "100", "False", "", "Vidar", "0", "siglesignon" "2026-09-03 05:39:32", "1893605", "panel-api.myezwebhost.com", "domain", "botnet_cc", "js.fakeupdates", "FakeUpdate,GhoLoader,SocGholish", "FAKEUPDATES", "", "100", "True", "https://infosec.exchange/@monitorsg/117203733054850172", "SocGholish", "0", "monitorsg" "2026-09-03 05:39:31", "1893610", "bhagwatibiscuits.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:58:39", "50", "True", "", "ClearFake,ClickFix", "0", "skocherhan" "2026-09-03 05:39:30", "1893612", "bishopelectricalllc.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClearFake,ClickFix", "0", "skocherhan" "2026-09-03 05:39:29", "1893611", "katadata.co.id", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClearFake,ClickFix", "0", "skocherhan" "2026-09-03 05:39:27", "1893613", "prospectmanager.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClearFake,ClickFix", "0", "skocherhan" "2026-09-03 05:39:25", "1893614", "applekidsschool.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClearFake,ClickFix", "0", "skocherhan" "2026-09-03 05:39:25", "1893615", "atlantasbestconcrete.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:58", "50", "True", "", "ClearFake,ClickFix", "0", "skocherhan" "2026-09-03 05:39:21", "1893636", "cli-desktop.com", "domain", "payload_delivery", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "joelkoz" "2026-09-03 05:39:21", "1893637", "fern-plume.com", "domain", "payload_delivery", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "joelkoz" "2026-09-03 05:39:20", "1893638", "node-slate.com", "domain", "payload_delivery", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "joelkoz" "2026-09-03 05:39:19", "1893639", "jadeleap15.com", "domain", "payload_delivery", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "joelkoz" "2026-09-03 05:39:18", "1893640", "loop-lumen.com", "domain", "payload_delivery", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "joelkoz" "2026-09-03 05:39:03", "1893241", "v-lan.asia", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "50", "False", "", "None", "0", "g0njxa" "2026-09-03 05:39:00", "1893237", "registration.v-panel.asia", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-03 05:38:53", "1893230", "saaverra.sbs", "domain", "payload_delivery", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "2026-09-04 03:11:40", "100", "True", "None", "KongTuke", "0", "monitorsg" "2026-09-03 04:51:09", "1893664", "nodupoqi.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 04:48:21", "1893663", "qr71m000.thevictorytoken.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-03 04:45:27", "1893662", "thevictorytoken.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 04:45:36", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 04:39:17", "1893661", "p1ds5d6i.trumptokan.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-03 04:39:04", "1893660", "9e763bw7.theloncode.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-03 04:37:41", "1893659", "trumptokan.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 04:38:47", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 04:36:12", "1893658", "theloncode.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 04:36:18", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 03:39:49", "1893656", "3hw0w4v6.usa-dentilock.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 03:36:21", "1893655", "usa-dentilock.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 03:36:28", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 03:20:36", "1893654", "fujipaje.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 03:13:43", "1893653", "jonelate.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 01:50:06", "1893651", "shop-heroup.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 01:54:02", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 01:48:41", "1893650", "shop-gutlite.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-04 06:54:05", "100", "True", "None", "3September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-03 01:39:53", "1893647", "qilydobu.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 01:37:52", "1893646", "rpmjgjea.usa-denta-vive.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-03 01:35:42", "1893645", "usa-denta-vive.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 01:35:48", "100", "True", "None", "3September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-03 01:35:07", "1893644", "tu9b1t8eay.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-03 00:28:53", "1893633", "gr2xw9cu.shop-neuro-sharp.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-03 00:02:05", "1893629", "dyvagiba.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 23:55:25", "1893628", "7706supposed.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 23:46:19", "1893625", "qh3sff5j.thetrumptoken.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-02 23:45:23", "1893624", "thetrumptoken.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 23:45:29", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 23:37:16", "1893622", "6x2x5hvx.syndentix.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-02 23:37:04", "1893621", "au6zb9l1.usa-dentalprime.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-02 23:36:03", "1893620", "syndentix.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 23:36:10", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 23:34:44", "1893619", "usa-dentalprime.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 23:35:51", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 23:15:45", "1893617", "hot.13balien.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-09-03 09:37:13", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-02 22:39:09", "1893608", "registeredagentsingeorgia.com", "domain", "botnet_cc", "win.latrodectus", "BLACKWIDOW,IceNova,Latrodectus,Lotus", "Latrodectus", "", "100", "False", "", "Latrodectus", "0", "varysz" "2026-09-02 22:24:59", "1893607", "zinury.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 22:23:11", "1893606", "2343medieval.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 21:53:09", "1893604", "speakingfepi21.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:34:58", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-02 21:53:08", "1893600", "apparatinpi22.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:34:56", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-02 21:53:08", "1893601", "bladehostpi.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:34:57", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-02 21:53:08", "1893602", "longslimpi.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:34:57", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-02 21:53:08", "1893603", "millionpi66.website", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:34:58", "100", "False", "", "c2,ClickFix,Mac", "0", "varysz" "2026-09-02 21:52:23", "1893598", "dogkeryallnatural.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:36:15", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 21:52:23", "1893599", "einladungsversand.digital", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:36:15", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 21:52:22", "1893595", "cska-dance.ru", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:36:14", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 21:52:22", "1893596", "cuongthinhsantro.vn", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:36:14", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 21:52:22", "1893597", "cyberku.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:36:14", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 21:52:21", "1893593", "brno-byty.cz", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:36:13", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 21:52:21", "1893594", "castingcoiffure.lu", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:38:11", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 21:52:20", "1893592", "amonbeachresort.tsangroup.vn", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:36:11", "100", "True", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 21:36:32", "1893591", "lc19dq2c.usa-cardioslim.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-02 21:34:58", "1893590", "usa-cardioslim.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 21:35:06", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 20:53:16", "1893578", "technoproject.it", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:56", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:16", "1893579", "trattoria-laurus.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:57", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:16", "1893580", "thegoodmarket.com.uy", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:16", "1893581", "peopleserveinc.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:16", "1893582", "solutionlogin.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:20", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:14", "1893575", "laptopgo.co.id", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:19", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:14", "1893576", "ricevimentialkamar.it", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:14", "1893577", "web-stakecasino.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:23", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893563", "simospartyprint.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 10:12:13", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893564", "alarabiadoors.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:55", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893565", "alholol-almobtakara.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 10:13:30", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893566", "vertixtech.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:50:00", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893567", "tarwifoods.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 10:06:08", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893568", "bariel.id", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:58:39", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893569", "tcbibby.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893570", "directions.training", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893571", "granoco.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 11:28:32", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893572", "pupshaven.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 11:28:32", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893573", "amazonia4.org", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:57", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:13", "1893574", "lincolnlendinggroup.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893553", "kacstonerecords.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:19", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893554", "forlagetkompass.se", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:57", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893555", "agingenieria.com.pe", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893556", "parcelpacky.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:57", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893557", "aksi-tajuk.absolute-water.app", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 12:15:29", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893558", "amishfurniturefactory.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893559", "harryfernandezf.forgetfulwizard.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893560", "kewaunee.in", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893561", "grupodata.es", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:12", "1893562", "hoh-homecare.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:23", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:11", "1893549", "staging.elevateconsultinghub.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 11:50:16", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:11", "1893550", "visitingnegev.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:11", "1893551", "kala-systems.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 11:50:16", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:11", "1893552", "purebrookkitchens.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:56", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893537", "bookerteeenterprises.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:55:54", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893538", "rhuyn.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 17:56:20", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893539", "sna247supportservices.org", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:19", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893540", "trackwaysforchange.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:55", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893541", "mabuyi.co.za", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 11:50:16", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893542", "optimized.net.au", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:17", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893543", "archpowered.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:18", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893544", "athlometrics.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:18", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893545", "clbz.nl", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893546", "bestybookkeepers.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:54", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893547", "mail.sporium.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:10", "1893548", "academiacalasanscamargo.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:50:00", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893528", "nutricaocomjo.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893529", "myvisualstory.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893530", "suitsgreen.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893531", "loginkerala.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:21", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893532", "strandraeuber-ditzum.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:20", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893533", "st-fjfi.cz", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:19", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893534", "stg-hiktool-hkstaging.kinsta.cloud", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:18", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893535", "watch.siratbd.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:58", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:09", "1893536", "error404band.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:55", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893518", "romehomeimprovement.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893519", "parrotsolar.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893520", "blog.sagarworld.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893521", "africa-on-air.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893522", "pubblixx.info", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893523", "weplay.id", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893524", "davidelombardiotorino.it", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:49:58", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893525", "kindercoachingflore.nl", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:55:53", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893526", "metaottawa.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:08", "1893527", "gabariteiros.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:22", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:07", "1893512", "slimeuniversity.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 08:52:25", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:07", "1893513", "bigrockcreekwi.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:07", "1893514", "fortunamar.pax.io", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:07", "1893515", "theinscribermag.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:07", "1893516", "factspakistan.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-09-03 09:10:21", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:07", "1893517", "sylvianitlhrservices.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:53:06", "1893511", "xecotec.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "50", "True", "", "ClickFix,ErrTraffic,LENAI", "0", "skocherhan" "2026-09-02 20:51:23", "1893510", "mroio94396.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 20:43:27", "1893509", "koxicy.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 20:18:39", "1893507", "0n9dsmrx.shop-neurovera.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-02 19:34:45", "1893486", "3v9isrkp.usa-cardioslim.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-02 19:10:36", "1893485", "zefoqoqa.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 19:05:04", "1893482", "nacylera.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 19:02:40", "1893481", "399suitable.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 19:01:19", "1893480", "anamfxbot.ir", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-02 18:45:28", "1893479", "6fx37ipf.thetrumptoken.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-02 18:44:59", "1893478", "thetrumptoken.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 18:45:08", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 18:38:35", "1893477", "b3mmtzy5.syndantix.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-02 18:35:51", "1893476", "syndantix.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 18:35:57", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 17:35:43", "1893470", "x2hreeo4.usa-bloodarmor.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-02 17:33:33", "1893468", "usa-bloodarmor.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 10:10:57", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 17:28:17", "1893466", "9ue80i63mp.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 17:20:46", "1893464", "cuqatida.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 16:53:54", "1893462", "io.honeysucklefolio.co", "domain", "botnet_cc", "js.smartapesg", "HANEYMANEY,ZPHP", "SmartApeSG", "", "100", "False", "", "SmartApeSG", "0", "varysz" "2026-09-02 16:43:49", "1893460", "buysypi831.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:34:57", "100", "False", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 16:43:49", "1893461", "compresspi9123.life", "domain", "botnet_cc", "js.iclickfix", "None", "IClickFix", "2026-09-03 13:34:57", "100", "False", "", "ClickFix,Mac", "0", "varysz" "2026-09-02 16:39:30", "1893457", "lasvegasweddingreception.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:30", "1893458", "charlottedefenseattorney.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:30", "1893459", "trufflecatering.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893428", "denverpediatricchiropractor.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893429", "dramshopliabilityattorney.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893430", "wolfmoving.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893431", "syracusefertilitycenter.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893432", "zanderrealestate.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893433", "hawaiifencecompany.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893434", "atlantaairporttaxiservice.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893435", "jobureau.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893436", "dallasmobileautomechanic.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893437", "mintnt.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893438", "restoremental.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893439", "polyvideos.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893440", "truheating.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893441", "floridavacationvillarental.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893442", "charlottesvilleinteriordesign.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893443", "401trading.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893444", "plasmaticsystems.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893445", "homeinspectionsdelaware.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893446", "darkmauve.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893447", "dixonshvac.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893448", "investigatemiami.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893449", "investigatoraustin.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893450", "fencecompanycharleston.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893451", "paintboothinstalling.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893452", "thevenueapartments.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893453", "headshotdfw.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893454", "homeinspectoralaska.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893455", "languageschoolai.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:29", "1893456", "lasvegaslaminateflooring.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893402", "5x5web.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893403", "roteagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893404", "ruenagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893405", "rvieragent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893406", "3plfast.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893407", "alabamarecoverycenter.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893408", "americanskydive.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893409", "arizonahomesellers.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893410", "ashevilleweddingfilms.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893411", "buywx.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893412", "cincycarpetcleaning.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893413", "blackcarserviceslax.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893414", "southtexashvac.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893415", "centralflgaragedoors.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893416", "atlanticwoodworking.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893417", "charlestonlawncompany.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893418", "buynewgymequipment.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893419", "hybridcustomhomes.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893420", "bravoslandscaping.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893421", "cabinrentalsnc.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893422", "californiasmallbusinesslaw.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893423", "dallasirrigationservices.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893424", "coloradoconstructionsupply.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893425", "dfwemergencydentist.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893426", "direito-digital.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:28", "1893427", "dogtrainersgeorgia.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893377", "silveradolandscape.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893378", "flip-cart.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893379", "kylesplumbing.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893380", "proxyviper.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893381", "premierrentalpurchase.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893382", "centralfloridapowerwash.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893383", "criminallawyerpr.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893384", "irvineinteriordesigner.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893385", "pricasino.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893386", "sdlasik.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893387", "oregoninteriors.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893388", "spotlessridesdetailing.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893389", "robertjonesrealty.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893390", "touristprogram.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893391", "trailblazehealth.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893392", "sdpsychic.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893393", "sanfranciscoinsulation.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893394", "pruagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893395", "alabamalimoservice.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893396", "scottsdalevending.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893397", "qeuryagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893398", "yoauction.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893399", "qusetagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893400", "flheadshot.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:27", "1893401", "raelagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893350", "homeinspectionnaperville.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893351", "bcrealestateagency.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893352", "beachjiujitsu.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893353", "vegasmanageditservices.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893354", "floridakitchencabinet.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893355", "intopython.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893356", "garagedoorskentucky.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893357", "aquaticpoolsandspas.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893358", "genomicsforge.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893359", "lvvacationrentals.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893360", "lifecoachrochester.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893361", "hawaiiwindowtinting.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893362", "fredscarpetcleaning.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893363", "dylantreeservice.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893364", "oepnagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893365", "legacybuilderscolorado.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893366", "moldinspectiondayton.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893367", "atlsaagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893368", "nameisfame.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893369", "floridapsychicmedium.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893370", "pestcontrolamarillo.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893371", "beaocnagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893372", "napavalleymentalhealth.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893373", "newjerseypetsitter.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893374", "itsystemsexpert.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893375", "ohdentalimplants.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:26", "1893376", "jerryshvac.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893326", "seattlewrongfuldeathlawyer.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893327", "ricksjunk.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893328", "shareyourprompt.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893329", "detroitconcretecontractor.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893330", "truckrepairlasvegas.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893331", "wolfwraps.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893332", "charlestonwaterheater.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893333", "kidsjumpandplay.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893334", "virginiaoverheaddoor.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893335", "waterdamagerepairflorida.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893336", "aidevmaster.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893337", "alluringsites.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893338", "modernhomeai.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893339", "e-agentics.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893340", "electricdredger.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893341", "e-renewable.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893342", "bestbuydomain.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893343", "garagedoorstexas.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893344", "firealarmflorida.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893345", "denverplumbingandwaterheater.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893346", "utahhardwoodflooring.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893347", "swisshomesforsale.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893348", "elitefenceanddeck.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:25", "1893349", "dubaivehiclemart.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893299", "utahplumbingandheating.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893300", "vacationrentalvirginia.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893301", "swiftfixgaragedoors.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893302", "texascommercialpainting.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893303", "kirkcharlie.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893304", "kitchenbathremodels.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893305", "accesscovidtest.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893306", "glimemragent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893307", "accesscovidtests.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893308", "glwoagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893309", "goelagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893310", "grnadagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893311", "atxpressurewashing.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893312", "gylphagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893313", "belldredgingpump.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893314", "realestateagentsd.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893315", "coloradoaffordablelawyer.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893316", "haertagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893317", "hoepagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893318", "briskinternet.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893319", "riversideconcretecontractors.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893320", "ashevilleroofingcontractor.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893321", "louisianaroofrepair.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893322", "luxuryswisshomes.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893323", "majordubai.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893324", "sullyphotos.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:24", "1893325", "beachhoteldestin.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893272", "injurylawsocal.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893273", "lalandscapelighting.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893274", "dualverify.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893275", "inqix.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893276", "longbeachmartialarts.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893277", "miamidadenotary.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893278", "robscarpetcleaning.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893279", "livetux.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893280", "loqira.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893281", "miamiresidentialroofing.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893282", "prmieagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893283", "proetctagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893284", "scottsdalemobilewindowtinting.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893285", "massachusettsyoga.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893286", "phoenixvideoagency.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893287", "prptoagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893288", "oklahomawarehousing.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893289", "floridawinetours.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893290", "spokanetrailersales.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893291", "miamipcsupport.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893292", "thedenverattorney.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893293", "toledotreeservices.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893294", "top50business.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893295", "healthcareqai.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893296", "nolageneralcontractor.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893297", "horizonmanagedservices.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:23", "1893298", "nolatreeservice.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893247", "daxivo.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893248", "jaxivo.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893249", "pevrix.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893250", "realrim.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893251", "xavierclothing.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893252", "dremaagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893253", "ecnoagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893254", "envestassetmanagement.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893255", "flmaeagent.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893256", "olympiapetemergency.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893257", "orlandodoorandglass.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893258", "papartybus.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893259", "web54zoom.us", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893260", "sanibellslandre.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893261", "1441bet.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893262", "plethorawallet.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893263", "apptux.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893264", "charlotteawning.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893265", "croclandscapes.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893266", "energedge.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893267", "buylabgrowndiamond.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893268", "deltatransmission.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893269", "heartycenter.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893270", "jacksonvillemma.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:22", "1893271", "hivona.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:21", "1893244", "aivalero.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:21", "1893245", "appvax.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:39:21", "1893246", "atlantaofficiants.com", "domain", "botnet_cc", "osx.macsync", "None", "MacSync", "", "100", "False", "", "None", "0", "g0njxa" "2026-09-02 16:21:19", "1893235", "brnug49883.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 16:16:06", "1893234", "tbjutiwjzc.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 16:11:18", "1893233", "1cecube.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-02 16:06:53", "1893228", "ndjin7pw.cdn-jbgroup.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-02 16:01:17", "1893225", "club-72.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 20:53:07", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-02 15:36:25", "1893222", "wicug18w.usa-blinzador.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-02 15:32:45", "1893220", "usa-blinzador.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 10:29:47", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 14:52:36", "1893207", "k-2ventures.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "75", "True", "https://www.clickfixed.uk/intel/11665", "ClickFix", "0", "ClickFixer" "2026-09-02 14:52:35", "1893208", "advd-api.horecaculinarystudio.com", "domain", "botnet_cc", "js.fakeupdates", "FakeUpdate,GhoLoader,SocGholish", "FAKEUPDATES", "", "100", "True", "https://infosec.exchange/@monitorsg/117201856884419719", "SocGholish", "0", "monitorsg" "2026-09-02 14:41:17", "1893213", "mjlnd07826.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 14:35:43", "1893212", "bulutase.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 13:49:26", "1893197", "up9yrveg.en-trump-token.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-02 13:37:10", "1893193", "lwphjmpa.www-glucotrust-bites.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous" "2026-09-02 13:35:45", "1893191", "fpw.13balien.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-09-03 09:02:55", "100", "True", "None", "vidar", "0", "crep1x" "2026-09-02 13:33:25", "1893190", "ubdxpzyl.usa-biodentix.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-02 13:32:41", "1893189", "usa-biodentix.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 10:39:20", "100", "True", "None", "2September2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-09-02 13:10:37", "1893188", "barbootlegger.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-02 13:04:18", "1893178", "gate.albaikmenuonline.com", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,ClickFix,EtherHiding", "0", "penislandrocket" "2026-09-02 12:54:03", "1893182", "kynequ.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 12:52:01", "1893181", "xorylefy.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 12:48:49", "1893180", "relais-montagnard.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-02 12:37:10", "1893179", "gate.albaikmenuonline.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-09-02 11:58:09", "1893173", "65slj6l4.shop-aquapeace.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous" "2026-09-02 11:57:46", "1893172", "taylormacpherson.co.uk", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 20:53:07", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-02 11:37:17", "1893169", "bv0rhljc.en-us-theeloncod.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-02 11:35:19", "1893167", "seasonmber.duckdns.org", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/99b21e095edbd224133b38342285047518a0ce656c94dc28c90ec809d6ddff52/", "remcos", "0", "abuse_ch" "2026-09-02 11:35:19", "1893168", "seasonmberbk.duckdns.org", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/99b21e095edbd224133b38342285047518a0ce656c94dc28c90ec809d6ddff52/", "remcos", "0", "abuse_ch" "2026-09-02 11:14:40", "1893165", "trumpgoldenbadge.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-03 08:01:09", "100", "True", "None", "2September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-02 11:12:57", "1893164", "fk0ds5tz4n.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 11:08:42", "1893163", "marthenacertain.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 10:57:40", "1893162", "visionaryhomesandinvestments.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 20:53:07", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-02 10:56:19", "1893161", "thevictorytoken.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 23:12:21", "100", "True", "None", "2September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-02 10:47:39", "1893160", "shootartphotografie.ch", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "True", "None", "compromised,EtherHide", "1", "anonymous" "2026-09-02 10:47:06", "1893159", "saas-stash.beer", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 11:53:00", "90", "False", "None", "ClearFake,ClickFix,ErrTraffic,EtherHiding", "1", "anonymous" "2026-09-02 09:49:21", "1893155", "glycomutee.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-09-02 10:45:40", "100", "True", "None", "2September2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-09-02 09:33:41", "1893138", "renellorange.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 09:33:39", "1893137", "xk282qui.shop-lipovive.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-09-02 09:25:36", "1893136", "qmmtr00590.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 08:59:38", "1893071", "hadoja.workers.dev", "domain", "botnet_cc", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon" "2026-09-02 08:45:55", "1893068", "228fsijc.therodeoroundup.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-09-02 08:45:30", "1893067", "goldenbeigesurfers.live", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/d780677e97da00b2b90849741720c1a02e758356630b63242a18074775c69e1c/", "remcos", "0", "abuse_ch" # Number of entries: 652