################################################################ # ThreatFox IOCs: recent domains - CSV format # # Last updated: 2026-07-21 17:19:09 UTC # # # # Terms Of Use: https://threatfox.abuse.ch/faq/#tos # # For questions please contact threatfox [at] abuse.ch # ################################################################ # # "first_seen_utc","ioc_id","ioc_value","ioc_type","threat_type","fk_malware","malware_alias","malware_printable","last_seen_utc","confidence_level","is_compromised","reference","tags","anonymous","reporter" "2026-07-21 17:19:09", "1854998", "hhqzk.stevestowingsatx.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 17:18:37", "1854997", "stevestowingsatx.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 17:18:44", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 17:06:08", "1854996", "ivox.polarstartire.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 17:05:18", "1854995", "cbtlecmkc.nextbahis.one", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0xa770,windows", "1", "anonymous" "2026-07-21 16:36:12", "1854989", "t2yl06y1.letstalkrocks.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 16:35:40", "1854988", "letstalkrocks.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 16:36:27", "100", "True", "None", "21July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-21 16:26:25", "1854986", "deltahostgate2.verdalya.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-21 16:24:10", "1854985", "jguzg.stashngrab.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 16:22:29", "1854984", "stashngrab.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 16:22:53", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 16:06:46", "1854983", "twcw.playantwatch.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 15:22:44", "1854977", "hsdav.stable-virtual-camera.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 15:22:02", "1854975", "stable-virtual-camera.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 15:22:48", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 15:11:24", "1854974", "ironlogicway5.florenth.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-21 15:05:51", "1854973", "nhos.pikachuplush.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 14:40:04", "1854953", "hur.luckyturbo88.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-21 17:27:17", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-21 14:37:25", "1854952", "r7e0hc30.legend-capital-group.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 14:35:04", "1854950", "hur.aww88.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-21 17:27:05", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-21 14:34:56", "1854949", "legend-capital-group.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 14:35:31", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 14:26:47", "1854946", "ybsve.springhillcommons.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 14:21:28", "1854945", "springhillcommons.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 14:21:40", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 14:17:52", "1854944", "udsik.springfieldsummerhoops.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 14:16:27", "1854943", "springfieldsummerhoops.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 14:17:13", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 14:13:52", "1854942", "nrqbf.spencershorttexas.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 14:12:49", "1854941", "spencershorttexas.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 14:12:57", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 14:09:26", "1854940", "cppeh.spacedecorideas.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 14:08:45", "1854939", "spacedecorideas.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 14:04:26", "1854933", "mvjx.phtaxiservices.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 13:54:48", "1854913", "api.googlevv.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "75", "False", "", "None", "0", "GovCERT_CH" "2026-07-21 13:54:47", "1854914", "analyzer01.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "75", "False", "", "None", "0", "GovCERT_CH" "2026-07-21 13:54:46", "1854925", "moorlandatlas.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "75", "False", "https://www.virustotal.com/gui/domain/moorlandatlas.com", "clickfix,curl,hetzner,loader,mshta", "0", "Lenny3BO" "2026-07-21 13:38:29", "1854931", "w3jxkd42.jardins-do-mar.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-21 13:36:21", "1854930", "pmzvrv9c.ezgarageautorepairtx.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-21 13:33:49", "1854929", "ezgarageautorepairtx.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 13:33:56", "100", "True", "None", "21July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-21 13:30:11", "1854928", "kori1903.anondns.net", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "100", "False", "", "ClearFake,ScreenConnect", "0", "threatcat_ch" "2026-07-21 13:14:18", "1854924", "jqtzbyimn.hrmotorsspringville.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0xa770,windows", "1", "anonymous" "2026-07-21 13:13:22", "1854921", "hrmotorsspringville.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 13:13:29", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 13:13:01", "1854920", "kdlff.riggsjacksboro.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 13:08:01", "1854919", "riggsjacksboro.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 13:09:04", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 13:07:30", "1854918", "izhx.phimmoichilla.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 12:36:58", "1854912", "6t7fjqk7.laurelcrownpartners.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 12:34:26", "1854911", "laurelcrownpartners.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 12:34:44", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 12:08:16", "1854909", "eumlu.ridgerenovation.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 12:07:45", "1854908", "ridgerenovation.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 12:07:50", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 12:05:50", "1854907", "wwmf.patxisdublin.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 12:00:36", "1854901", "ordereltacofeliz.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 12:01:08", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 11:26:24", "1854898", "embermeshnode.florenth.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-21 11:07:33", "1854897", "qrilb.rickybobbystowing.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 11:07:12", "1854896", "rickybobbystowing.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 11:07:42", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 11:00:39", "1854889", "uxwc.orangefarmersmarket.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 10:59:52", "1854888", "orangefarmersmarket.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 11:00:08", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 10:40:42", "1854887", "contabili.balanteo.shop", "domain", "botnet_cc", "win.asyncrat", "None", "AsyncRAT", "", "75", "False", "https://bazaar.abuse.ch/sample/3565a7a2bb632357c35f6ca9e98eb083e1505526f0ab0e4d88df216299540069/", "asyncrat", "0", "abuse_ch" "2026-07-21 10:36:33", "1854886", "oyawba10.site-asli-bedon-filter-1xbet.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 10:17:34", "1854884", "lufry.mabelsnursery.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 10:15:49", "1854883", "mabelsnursery.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 10:15:54", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 10:00:09", "1854877", "ayhd.opulentbeautybarllc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 09:59:22", "1854876", "opulentbeautybarllc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 09:59:39", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 09:58:44", "1854875", "hbsgb.lunabybodyshaping.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 09:58:10", "1854874", "lunabybodyshaping.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 09:58:27", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 09:37:00", "1854870", "alkociferblat.cc", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-07-21 09:02:37", "1854863", "twhhp.lucymflowers.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 09:01:54", "1854862", "cyyf.nurtured-in-nature.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 08:58:49", "1854861", "nurtured-in-nature.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 08:58:52", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 08:57:34", "1854860", "lucymflowers.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 08:57:41", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 08:36:36", "1854859", "87jcg6w8.everestpointnorthglenn.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-21 08:35:47", "1854858", "zbklcsro.jadoou.lat", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-21 08:35:36", "1854857", "v23ewcsy.calculadoracomisiones.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 08:34:02", "1854856", "drrobertoiturralde.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 08:35:06", "100", "True", "None", "21July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-21 08:33:52", "1854855", "everestpointnorthglenn.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 08:33:59", "100", "True", "None", "21July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-21 08:28:40", "1854853", "cjdl.nspowdercoatingnj.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 08:24:36", "1854852", "nspowdercoatingnj.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 08:25:03", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 08:22:55", "1854851", "mhuhx.longhornlodgemo.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 08:22:51", "1854850", "xbzh.kafekarachi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 08:22:34", "1854849", "longhornlodgemo.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 08:22:40", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 07:28:53", "1854787", "gbgl.kafekarachi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 07:26:33", "1854786", "qbmuv.loganlooneyresume.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 07:21:23", "1854785", "loganlooneyresume.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 07:22:03", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 07:20:04", "1854780", "ets.luckyturbo88.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-21 14:27:20", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-21 07:13:23", "1854779", "tmnpc.lnlsealcoating.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 07:08:07", "1854777", "lnlsealcoating.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 07:08:08", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 07:00:07", "1854772", "ets.aww88.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-21 14:27:09", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-21 06:56:06", "1854771", "markdl.pro", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-07-21 06:52:05", "1854768", "ironphantomcore.top", "domain", "cc_skimming", "js.magecart", "None", "magecart", "", "100", "False", "", "Magecart", "0", "threatcat_ch" "2026-07-21 06:52:05", "1854769", "voidhunterkeep.top", "domain", "cc_skimming", "js.magecart", "None", "magecart", "", "100", "False", "", "Magecart", "0", "threatcat_ch" "2026-07-21 06:36:08", "1854764", "7wzfqmf9.behtarin-site-shartbandi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 06:31:40", "1854763", "ynwe.jetourmexico.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 06:30:47", "1854762", "mqljf.newcoservicemower.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 06:25:58", "1854761", "newcoservicemower.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 06:26:21", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 06:14:37", "1854760", "tourtrade.shop", "domain", "botnet_cc", "win.phantom_stealer", "None", "Phantom Stealer", "", "100", "False", "https://bazaar.abuse.ch/sample/2cd6897845961d94d058970266728a7abb4d6fdaff48bb295acdb912dfac9f89/", "PhantomStealer", "0", "abuse_ch" "2026-07-21 06:06:39", "1854757", "anyqwp6fce.localto.net", "domain", "botnet_cc", "win.sliver", "None", "Sliver", "", "100", "False", "https://bazaar.abuse.ch/sample/5666f35c1033e019aa4d31dc7c123e39777909e2833e14135f9a3f3642551059/", "Sliver", "0", "abuse_ch" "2026-07-21 05:59:06", "1854752", "lifeisabouthavingfun448.duckdns.org", "domain", "botnet_cc", "elf.bashlite", "gayfgt,Gafgyt,qbot,torlus,lizkebab", "Bashlite", "", "100", "False", "https://bazaar.abuse.ch/sample/1cf3a473824ecd73dd246db96a9a11a3b094cf1052a085f86fa5327f550eecdf/", "Gafgyt", "0", "abuse_ch" "2026-07-21 05:42:24", "1854734", "wormfear.xyz", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "OffLoader", "0", "abuse_ch" "2026-07-21 05:36:54", "1854732", "monitorondomainwintgt.store", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "100", "False", "", "None", "0", "abuse_ch" "2026-07-21 05:28:01", "1854730", "ewmc.jenslittlerugrats.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 05:27:18", "1854729", "jpsym.mystic-brews.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 05:25:19", "1854728", "mystic-brews.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 05:26:00", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 05:21:58", "1854567", "ritchie.click", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:58", "1854568", "meduurst.space", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:57", "1854569", "monteiro.click", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:56", "1854570", "bitista.icu", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:55", "1854571", "thibahlt.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:52", "1854572", "leconto.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:52", "1854573", "carreiro.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:51", "1854574", "henreques.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:50", "1854575", "fraitas.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:49", "1854576", "azevedo.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:49", "1854577", "schester.beer", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:48", "1854578", "abernaahy.sbs", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:47", "1854579", "riviere.sbs", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:43", "1854580", "ackeamann.xyz", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:42", "1854582", "lombaidi.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:41", "1854581", "robests.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:40", "1854583", "reindardt.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:39", "1854584", "schuttc.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:38", "1854585", "bogisibh.xyz", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:37", "1854586", "ledesla.cfd", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:36", "1854587", "uolguin.cfd", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:34", "1854588", "olovier.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:34", "1854589", "chauvet.club", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:32", "1854590", "gautter.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:31", "1854591", "riihard.top", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:31", "1854592", "nonrueden.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:30", "1854593", "northcombe.org", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:29", "1854594", "omnivectis.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:26", "1854595", "willimsen.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:26", "1854596", "ssntana.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:24", "1854597", "fundivox.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:23", "1854598", "exoosito.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:22", "1854599", "oelgado.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:22", "1854600", "nitzschi.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:21", "1854601", "vtcircuits.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:20", "1854602", "satserfield.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:20", "1854603", "quilborne.org", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:19", "1854604", "quiglgy.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:18", "1854605", "kovkcek.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:17", "1854606", "gccsinc.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:16", "1854607", "barsows.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:15", "1854608", "ethervane.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:15", "1854609", "raventhorp.org", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:14", "1854610", "bradtkr.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:13", "1854611", "dialectum.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:13", "1854612", "oakington.org", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:12", "1854613", "quorumix.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:11", "1854614", "saxonfield.org", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:11", "1854615", "sigmatauethifarma.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:10", "1854616", "hegmaen.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:09", "1854617", "orantow.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:08", "1854618", "gileert.xyz", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:07", "1854619", "bartach.xyz", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:06", "1854620", "almontm.xyz", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:03", "1854621", "moielli.xyz", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:02", "1854622", "corraia.icu", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:21:00", "1854623", "henriqueq.xyz", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:59", "1854624", "bbvalues.uk", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:57", "1854625", "treviro.icu", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:56", "1854626", "eichmnnn.icu", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:55", "1854627", "gerrirsen.icu", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:55", "1854628", "diranda.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:54", "1854629", "loureiru.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:52", "1854630", "bernardi.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:51", "1854631", "marqueq.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:50", "1854632", "abernaehy.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:49", "1854633", "keneedy.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:48", "1854634", "reynoldy.lol", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:48", "1854635", "heethcote.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:46", "1854636", "okunevk.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:45", "1854637", "dground.org", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:44", "1854638", "meharsons.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:43", "1854639", "leusceke.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:42", "1854640", "zgsjyxzx.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:42", "1854641", "luthel.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:41", "1854642", "jnlysj.com", "domain", "botnet_cc", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "50", "False", "", "KongTuke", "0", "skocherhan" "2026-07-21 05:20:25", "1854534", "testewin.com", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "75", "True", "https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/", "BananaRAT,banking-trojan,BL-Networks,brazil,cloudflare-tunnel,powershell", "0", "DENNISAROSS" "2026-07-21 05:20:16", "1854548", "hometwfrbas.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "70", "True", "None", "BL-Networks,cross-platform,DGA-style-domain,homebrew-lure,JAR,java,payload-delivery", "0", "DENNISAROSS" "2026-07-21 05:19:53", "1854528", "logintrust5845.lol", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 05:19:52", "1854527", "syshash4392.top", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 05:19:51", "1854526", "authservice6020.com", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 05:19:50", "1854525", "portalbyte8345.lol", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 05:19:49", "1854524", "webtask6566.top", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 05:19:48", "1854523", "apibyte4811.com", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 05:19:47", "1854522", "statpass3183.lol", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 05:19:45", "1854521", "1629bqt9p34elwv.top", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 05:19:44", "1854520", "basehex1267.top", "domain", "botnet_cc", "js.mints_loader", "None", "MintsLoader", "", "75", "False", "https://tria.ge/260720-w22dqsc13x/behavioral1", "clickfix,MINTSLOADER", "0", "Overkill1984zzz" "2026-07-21 04:43:39", "1854723", "bopyq.myhillcountrygrass.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 04:38:22", "1854722", "myhillcountrygrass.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 04:38:28", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 04:35:14", "1854721", "hvao.jbgroup21.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 04:32:37", "1854720", "1s3hqwvr.varzeshlife.ir", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 04:15:31", "1854719", "byrio.muscle-up-yavne.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 04:12:19", "1854718", "muscle-up-yavne.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 04:12:39", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 04:04:31", "1854714", "ndpyt.mechanic-on-site.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 03:59:16", "1854713", "mechanic-on-site.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 03:59:54", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 03:42:54", "1854704", "avfzq.maia-bentley.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 03:38:08", "1854698", "ewyjl357.flashhomebuyerskc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-21 03:37:50", "1854696", "maia-bentley.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 03:38:39", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 03:36:06", "1854695", "iahg2idr.evansunitedspringcarnivalsherman.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-21 03:34:06", "1854692", "flashhomebuyerskc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 03:34:13", "100", "True", "None", "21July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-21 03:33:56", "1854691", "drburgymicrobiome.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 03:34:02", "100", "True", "None", "21July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-21 03:32:52", "1854689", "evansunitedspringcarnivalsherman.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 03:33:55", "100", "True", "None", "21July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-21 03:31:23", "1854688", "gytm.onjabet1.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 02:42:23", "1854682", "foivs.highkickstkd.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 02:29:58", "1854677", "xhtn.nextbahis.one", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 02:28:27", "1854676", "luy6lvmh.site-takhtenard-sharti-betland.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 01:32:46", "1854662", "ikkqh.dermexcel.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 01:31:39", "1854661", "dermexcel.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 01:31:46", "100", "True", "None", "21July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-21 01:30:50", "1854660", "jilc.kaltourusa.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 01:28:47", "1854659", "kaltourusa.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 01:29:29", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 01:23:35", "1854657", "cstee.diamonddumpsterrental.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 01:21:13", "1854656", "diamonddumpsterrental.net", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 01:21:54", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-21 00:33:28", "1854651", "xdox.groeschelcompany.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-21 00:32:48", "1854650", "dgctf.concretewestgj.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-21 00:26:02", "1854649", "yeo0jmkq.kimsnailsalonmadison.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-21 00:25:35", "1854648", "kimsnailsalonmadison.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 00:25:44", "100", "True", "None", "21July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 23:41:25", "1854566", "ovzdi.jetbet.download", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 23:28:03", "1854565", "gjwc.kalientestore.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 23:27:31", "1854564", "kalientestore.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 23:27:42", "100", "True", "None", "20July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-20 22:37:24", "1854558", "mlmgp.jenslittlerugrats.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 22:37:09", "1854557", "dwvygj31.dermatologycongress.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 22:35:40", "1854556", "jenslittlerugrats.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 05:26:06", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 22:35:09", "1854555", "h51ee0ex.emeraldualzone.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 22:33:21", "1854554", "designfarmarchitects.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 22:33:28", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 22:28:07", "1854553", "4gfsvs7l.jennyrussianbluepalace.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 22:27:40", "1854552", "sutf.kafekarachi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 17:34:44", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 22:25:10", "1854551", "jennyrussianbluepalace.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 22:25:40", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 21:40:27", "1854546", "wakgo.jbgroup21.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 21:27:10", "1854545", "zztz.jetourmexico.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 20:37:24", "1854529", "txvii.hazaratbet.bet", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 20:29:43", "1854519", "ttvsj7o9.jdexteriorcleaning.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 20:28:46", "1854518", "atlasgridflow.florenth.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 20:27:02", "1854517", "xkzh.highkickstkd.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 20:25:05", "1854515", "foh.luckyturbo88.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-21 06:27:21", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-20 20:25:04", "1854513", "foh.aww88.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-21 06:27:09", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-20 20:24:31", "1854512", "jdexteriorcleaning.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 20:25:03", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 20:13:45", "1854511", "macro3siteview.florenth.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 19:43:45", "1854499", "lunarwaveunit.grovessa.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 19:35:40", "1854494", "vuwvp.drdavidzweiback.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 19:30:58", "1854493", "klca.hieliao-app.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 19:24:10", "1854492", "iemb.hansikaenterprises.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 19:11:59", "1854471", "img2.mekebibsolomonlaw.com", "domain", "botnet_cc", "js.fakeupdates", "FakeUpdate,GhoLoader,SocGholish", "FAKEUPDATES", "", "100", "True", "https://infosec.exchange/@monitorsg/116953642300360994", "SocGholish", "0", "monitorsg" "2026-07-20 19:11:58", "1854474", "hajar-tricks.com", "domain", "payload_delivery", "win.5t_downloader", "None", "5.t Downloader", "2026-07-21 01:56:09", "100", "False", "", "None", "1", "anonymous" "2026-07-20 18:34:49", "1854476", "cunts.colg1.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 18:25:53", "1854475", "jnhygwu4.gulfbreezervrentals.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 18:24:07", "1854473", "gulfbreezervrentals.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 18:24:38", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 18:13:43", "1854472", "zvni.frizzhairforecast.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 18:04:09", "1854469", "syqmn.calirayalake.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 17:33:37", "1854466", "z52rumys.customhomebuildersplainfield.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 17:32:58", "1854465", "47ytdzjs.economywindowsparts.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 17:23:45", "1854464", "gravitfluxbox.grovessa.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 17:04:03", "1854458", "kzsf.concretewestgj.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 17:02:32", "1854457", "tjhsq.onjabet1.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 17:02:13", "1854456", "concretewestgj.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 00:32:22", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 16:48:44", "1854455", "urbanhostgate.grovessa.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 16:33:44", "1854454", "smartmeshsys2.petalune.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 16:27:02", "1854453", "2zm9lhlg.groeschelcompany.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 16:23:34", "1854452", "groeschelcompany.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 00:28:57", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 16:04:46", "1854448", "zpbn.comptonanimalrescue.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 16:04:29", "1854447", "lxlwn.nextbahis.one", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 16:04:03", "1854446", "comptonanimalrescue.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 16:04:34", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 16:03:18", "1854445", "glmm.colg1.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 16:02:55", "1854444", "lcare.mrslopezsings.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 15:55:19", "1854428", "nodemetrics9095.com", "domain", "payload_delivery", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "", "100", "True", "https://infosec.exchange/@monitorsg/116952942977891438", "KongTuke", "0", "monitorsg" "2026-07-20 15:54:16", "1854443", "wctvn.mrslopezsings.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 15:29:47", "1854432", "lvcrn.monicarobles.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 15:24:46", "1854431", "monicarobles.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 08:32:35", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 15:22:52", "1854430", "drsvt.nextbahis.poker", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 15:07:18", "1854425", "axoo.colg1.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 15:03:54", "1854419", "colg1.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 00:31:12", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 14:47:31", "1854417", "xhbgt.nextbahis.blog", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 14:32:53", "1854415", "aeiyi.jetbet.download", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 14:26:00", "1854414", "pjjuosk1.fredcoplumbingpros.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 14:25:42", "1854413", "energy4665.duckdns.org", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/356106324c797ba967a2a8cde2156e866fe008332046747866efa82a99e62083/", "remcos", "0", "abuse_ch" "2026-07-20 14:25:04", "1854411", "dif.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-20 19:27:20", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-20 14:14:47", "1854390", "aurorapavilion.top", "domain", "payload_delivery", "js.smartapesg", "HANEYMANEY,ZPHP", "SmartApeSG", "2026-07-20 14:08:57", "100", "True", "None", "SmartApeSG", "0", "monitorsg" "2026-07-20 14:14:46", "1854404", "meduurst.space", "domain", "payload_delivery", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "2026-07-20 15:11:32", "100", "True", "None", "KongTuke", "0", "monitorsg" "2026-07-20 14:10:04", "1854408", "dif.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-20 19:27:09", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-20 14:08:34", "1854407", "igsx.closedfistllc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 14:04:14", "1854399", "aruhq.jbgroup21.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 13:43:43", "1854398", "vastlogicweb.petalune.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 13:28:43", "1854396", "stellar5bit.petalune.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 13:22:21", "1854395", "clouderfaster.cc", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch" "2026-07-20 13:15:19", "1854394", "wbpypinui.generososbakerycafe.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0xa770,windows", "1", "anonymous" "2026-07-20 13:12:22", "1854392", "generososbakerycafe.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 13:12:29", "100", "True", "None", "20July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-20 13:03:30", "1854383", "cglp.cleantruckchecksac.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 13:02:52", "1854382", "embvx.hazaratbet.bet", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 12:43:42", "1854380", "grandnode3unit.solavern.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 12:43:42", "1854381", "freetasksite8.petalune.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 12:34:02", "1854379", "a6du2gsx.fit2leadconference.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 12:33:16", "1854378", "hag0wqv7.estrelamardedetizadora.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 12:33:13", "1854377", "fit2leadconference.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 12:33:17", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 12:31:46", "1854376", "estrelamardedetizadora.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 12:32:05", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 12:26:20", "1854375", "qaqatrf8.dermatologycongress.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 12:26:13", "1854374", "bcmej6hr.goodlifelakerentals.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 12:23:30", "1854373", "2gfxwchj.emeraldualzone.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 12:22:55", "1854372", "dermatologycongress.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 22:34:36", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 12:22:38", "1854371", "goodlifelakerentals.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 12:23:11", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 12:21:41", "1854370", "emeraldualzone.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 22:33:19", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 12:16:23", "1854368", "bhrbc90m.fredcoplumbingpros.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 12:14:23", "1854365", "xgu7k53h.economywindowsparts.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 12:13:27", "1854364", "fredcoplumbingpros.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 14:23:34", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 12:13:02", "1854363", "ea168jci.customhomebuildersplainfield.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 12:12:51", "1854362", "economywindowsparts.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 17:32:34", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 12:11:38", "1854361", "customhomebuildersplainfield.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 17:33:51", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 12:10:52", "1854360", "kwgn9wkj.cupprimosouth.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 12:10:23", "1854359", "cupprimosouth.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 12:10:30", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 12:07:31", "1854358", "vrdh.calirayalake.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 12:03:11", "1854353", "yywem.drdavidzweiback.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 11:56:29", "1854352", "8iuwoa4l.of-tencent.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 11:55:05", "1854350", "viv.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-20 13:27:20", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-20 11:55:04", "1854348", "viv.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-20 13:27:08", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-20 11:48:25", "1854347", "kkid.hightidesuffolk.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 11:46:01", "1854346", "xcavl.crossonerecords.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 11:44:59", "1854345", "hightidesuffolk.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 11:45:14", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 11:44:28", "1854344", "crossonerecords.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 11:45:08", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 11:43:54", "1854343", "54e20j57.mrslopezsings.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 11:42:31", "1854342", "y0fui15e.corgiwarehouse.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 11:42:18", "1854341", "mrslopezsings.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 16:02:03", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 11:41:30", "1854339", "corgiwarehouse.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 13:37:16", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 11:34:27", "1854338", "20ntquqt.varzeshlife.ir", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 11:33:09", "1854337", "1eriimge.consultingsolutionsjp.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 11:31:28", "1854336", "consultingsolutionsjp.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 11:31:39", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 11:23:46", "1854335", "uz1hqtn3.phtaxiservices.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 11:22:46", "1854289", "bjastqph.chrisbrownallegiantstadium.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 11:21:35", "1854252", "chrisbrownallegiantstadium.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 11:21:38", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 11:13:02", "1854251", "g2o19aql.charmedanddangerousplush.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 11:12:55", "1854250", "mevd0fjv.phimmoichilla.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 11:11:40", "1854249", "charmedanddangerousplush.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 11:11:47", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 11:01:36", "1854243", "biirwl32.patxisdublin.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 11:00:43", "1854242", "tq6ay9c3.broadwaylotterytickets.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 10:59:27", "1854241", "broadwaylotterytickets.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 10:59:36", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 10:51:25", "1854239", "okv4iaii.contempoconstructiontx.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 10:50:55", "1854238", "fgsnlppf.jadoou.lat", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 10:50:40", "1854237", "contempoconstructiontx.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 10:50:49", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 10:45:28", "1854227", "tgbft.countertops-dfw.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 10:45:15", "1854226", "giwl.highkickstkd.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 10:44:35", "1854224", "highkickstkd.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 02:37:40", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 10:44:04", "1854223", "countertops-dfw.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 10:44:07", "100", "True", "None", "20July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-20 10:40:11", "1854222", "3efofny3.cielohillsevents.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 10:39:29", "1854221", "cielohillsevents.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 10:39:33", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 10:33:43", "1854220", "hpnohznb.site-takhtenard-sharti-betland.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 10:33:37", "1854219", "u9p8kb56.crvbl.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 10:32:43", "1854218", "wnq8bmsb.derbi.promo", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 10:30:25", "1854217", "crvbl.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 10:30:32", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 10:23:17", "1854215", "f9e2ff2h.site-asli-bedon-filter-1xbet.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 10:03:41", "1854205", "apexstorm6link.solavern.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 10:03:41", "1854206", "neogateway9hub.solavern.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 09:49:15", "1854204", "ddsr.hieliao-app.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 09:48:41", "1854203", "lightsiteview1.solavern.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 09:48:18", "1854202", "cnxst.jardins-do-mar.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 09:44:05", "1854194", "hieliao-app.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 19:26:05", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 09:43:25", "1854189", "jardins-do-mar.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 13:37:22", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 09:22:10", "1854187", "ryr4q9kj.playantwatch.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 09:18:41", "1854186", "vividmeshflow.solavern.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 08:58:40", "1854176", "boldlogicgate4.mistbriar.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 08:45:44", "1854175", "cyki.hayleymarienorman.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 08:45:20", "1854174", "jsthk.jademckenzieco.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 08:43:40", "1854173", "swift7tasknet.mistbriar.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 08:43:34", "1854172", "hayleymarienorman.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 08:44:02", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 08:42:52", "1854171", "jademckenzieco.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 08:42:57", "100", "True", "None", "20July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-20 08:22:05", "1854170", "twyd6y14.elizabethspizzadenton.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 08:07:54", "1854169", "01ejjpa2.behtarin-site-shartbandi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 07:51:24", "1854137", "sei.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:24", "1854138", "okx.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:24", "1854139", "ylp.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:24", "1854140", "mgg.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:24", "1854141", "wvg.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:24", "1854142", "fwb.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:24", "1854143", "h1r.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:24", "1854144", "sei.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:24", "1854145", "okx.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:23", "1854132", "ylp.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:23", "1854133", "mgg.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:23", "1854134", "wvg.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:23", "1854135", "fwb.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:51:23", "1854136", "h1r.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "", "Vidar", "0", "crep1x" "2026-07-20 07:47:46", "1854097", "pkspm.informatik-ai.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 07:43:53", "1854096", "todn.hansikaenterprises.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 07:43:04", "1854095", "hansikaenterprises.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 19:21:48", "100", "True", "None", "20July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-20 07:42:24", "1854094", "informatik-ai.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 07:42:51", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 07:35:05", "1854092", "kmd.loloxsm188.top", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-20 11:27:26", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-20 07:35:04", "1854090", "kmd.brslot.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-20 11:27:14", "100", "True", "None", "vidar", "0", "crep1x" "2026-07-20 06:45:07", "1854084", "oqtr.haleywoodportfolio.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 06:44:46", "1854083", "tztgw.impactpromotionsclt.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 06:42:33", "1854082", "haleywoodportfolio.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 06:43:12", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 06:41:52", "1854081", "impactpromotionsclt.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 06:41:57", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 06:38:39", "1854080", "primeglow2unit.mistbriar.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 06:28:34", "1853963", "bognervopi.icu", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "75", "False", "https://urlscan.io/result/019f780a-dfa5-7038-a6b7-f3cac68c2e4f/", "ClickFix", "0", "darses" "2026-07-20 06:28:31", "1853976", "nvms9000.online", "domain", "payload_delivery", "elf.mirai", "Katana", "Mirai", "", "100", "False", "", "Mirai,nc", "0", "botnetkiller" "2026-07-20 06:23:38", "1854079", "signalwestport.mistbriar.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 06:21:16", "1854078", "t13ecldw.calculadoracomisiones.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 06:03:38", "1854073", "proxyfastzone.lunavera.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 05:53:38", "1854071", "brightnode9sys.lunavera.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 05:46:39", "1854070", "llttu.hurtigegevinster.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 05:45:16", "1854069", "rbnz.hairbyniki.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 05:42:00", "1854068", "hairbyniki.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 05:42:25", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 05:41:15", "1854067", "hurtigegevinster.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 05:41:23", "100", "True", "None", "20July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-20 05:38:38", "1854066", "trendscanview.lunavera.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 05:07:52", "1854063", "ksuqx.cnbgladespring.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 05:05:20", "1854062", "cnbgladespring.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 05:05:28", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 05:01:51", "1854058", "dduf.bolesfarms.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 04:57:28", "1854057", "ldgcg.closedfistllc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 04:56:10", "1854056", "closedfistllc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 14:04:01", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 04:31:53", "1854054", "xbwtz.cleantruckchecksac.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 04:29:29", "1854053", "cleantruckchecksac.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 13:02:45", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 04:24:09", "1854052", "dnrlgtwo.frizzhairforecast.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-20 04:13:08", "1854051", "alkh.jbgroup21.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 03:28:37", "1854044", "marblewavegate.thorniva.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 03:28:37", "1854045", "silica4path.lunavera.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 03:23:07", "1854043", "hrykp.varzeshlife.ir", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 03:13:37", "1854042", "pylonstaticbase.thorniva.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 03:06:28", "1854041", "auyc.pikachuplush.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 03:04:30", "1854036", "pikachuplush.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 15:03:31", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 03:04:30", "1854037", "fby6y3nd.illuigiitaliancuisine.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-20 03:03:37", "1854035", "oceanicmesh7.thorniva.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 03:02:52", "1854034", "illuigiitaliancuisine.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 03:03:55", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 02:20:48", "1854033", "g1wgxqj5.nextbahis.one", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 02:20:37", "1854032", "hnhdl.hazaratbet.bet", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 02:10:37", "1854031", "clinkscalesdrugssc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 02:11:02", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 02:09:06", "1854030", "gofq.phtaxiservices.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 02:04:21", "1854025", "phtaxiservices.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 14:03:06", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-20 01:20:31", "1854024", "uxlcj.fontanayoga.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 01:18:45", "1854023", "ftvfx.faux-paws.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 01:18:36", "1854021", "canyonsyncbox.thorniva.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 01:18:36", "1854022", "vertex2urban.thorniva.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 01:03:39", "1853992", "vqwj.phimmoichilla.org", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 13:02:32", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 00:58:36", "1853991", "basalt9logic.thorniva.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 00:43:35", "1853990", "quartz5prism.veloria.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 00:20:40", "1853989", "dbomd.famscargo.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-20 00:10:47", "1853988", "ijm1e9p4.chrisbrownstlouis.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-20 00:09:57", "1853987", "chrisbrownstlouis.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-20 00:10:08", "100", "True", "None", "20July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-20 00:08:35", "1853985", "sonicpathhub.veloria.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-20 00:03:22", "1853979", "dtzu.patxisdublin.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-20 00:02:47", "1853978", "patxisdublin.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 12:02:21", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 23:23:10", "1853969", "8g7kgrp5.frisbeeburgerllc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-19 23:17:51", "1853968", "imrmd.drdavidzweiback.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 22:35:43", "1853962", "moszp.jetbet.download", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 22:27:50", "1853961", "edtbi.jetbet.download", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 22:22:34", "1853960", "zwhun.hazaratbet.bet", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 22:10:30", "1853959", "wxfwe0h3.chrisbrowndetroit.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-19 22:09:34", "1853958", "chrisbrowndetroit.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 22:10:06", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 22:04:42", "1853951", "wz43qign.houseofhakka.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xfb64,macos", "1", "anonymous" "2026-07-19 22:03:22", "1853950", "houseofhakka.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 22:03:29", "100", "True", "None", "19July2026,ClearFake,Commandline,MacOS", "0", "Gi7w0rm" "2026-07-19 21:48:57", "1853947", "qpduk.hazaratbet.bet", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 21:48:34", "1853946", "vectorpointbit.veloria.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-19 21:33:34", "1853945", "silicon8host.veloria.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-19 21:08:28", "1853930", "alpha4gateweb.glenmora.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-19 20:48:49", "1853926", "yvryz.gepco-energy.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 20:43:39", "1853925", "yferx.gepco-energy.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 20:41:58", "1853924", "xxklt.gamehazarat.bet", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 20:39:00", "1853923", "cucumber-oslo.cc", "domain", "botnet_cc", "unknown_stealer", "None", "Unknown Stealer", "", "100", "False", "https://bazaar.abuse.ch/sample/7502ed3956c621d9442e51343a9d9fd22fb080d1a9edcffc1386901ebb4da9ec/", "NWHStealer", "0", "abuse_ch" "2026-07-19 20:38:28", "1853922", "cyberflux9unit.glenmora.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-19 20:37:16", "1853921", "atibr.gamehazarat.bet", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 20:36:26", "1853920", "konr.domirunway.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-19 20:28:45", "1853919", "oqjvp.gamehazarat.bet", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 20:18:31", "1853918", "etaru.oasis-active.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 20:17:22", "1853917", "oasis-active.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 20:18:00", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 20:16:48", "1853916", "canss.mountoliveccc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 20:15:31", "1853915", "mountoliveccc.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 20:15:45", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 20:14:56", "1853914", "uwaho.midiowagrowth.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 20:12:53", "1853913", "midiowagrowth.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 20:13:22", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 20:10:46", "1853732", "unixcheats.shop", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "", "None", "0", "burger" "2026-07-19 20:10:45", "1853734", "frolen.life", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "https://bazaar.abuse.ch/sample/76d750e2ddfed6f984d95ab0419a085e21f124924c4ab64be5732a1d93719299", "None", "0", "burger" "2026-07-19 20:10:43", "1853736", "rgb.arizonafamilylawfirm.com", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-07-19 12:28:04", "100", "False", "https://bazaar.abuse.ch/sample/76d750e2ddfed6f984d95ab0419a085e21f124924c4ab64be5732a1d93719299", "c2,vidar", "0", "burger" "2026-07-19 20:10:19", "1853858", "babydiapersinturkey.com", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "75", "False", "", "c2,gate", "0", "varysz" "2026-07-19 20:10:16", "1853859", "bappytechlab.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:15", "1853860", "blocuriizolatetermic.primariapetrosani.ro", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:14", "1853861", "casadesignsrl.it", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:11", "1853862", "cc-roofingco.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:11", "1853863", "corambiente.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:10", "1853864", "dailyinterior.co.uk", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:09", "1853865", "daoyiyuan.cn", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:08", "1853866", "datakepri.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:08", "1853867", "euregio-camper.de", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:06", "1853868", "guiasantosdumont.com.br", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:06", "1853869", "instantfixservices.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:05", "1853870", "lagrandefm.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:04", "1853871", "lucianasalomao.com.br", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:03", "1853872", "mazradioaurora.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:03", "1853873", "mobilitate.primariapetrosani.ro", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:00", "1853874", "moroneyaccountants.ie", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:10:00", "1853875", "mrinterior.co.uk", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:59", "1853876", "nr-7releases.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:58", "1853877", "radiozona94fm.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:57", "1853878", "reelwalestudio.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:57", "1853879", "rolems.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:56", "1853881", "rumahlift.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:55", "1853880", "roofing-clearwater.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:53", "1853882", "salariadvogados.com.br", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:52", "1853883", "soccerpunter.org", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:51", "1853884", "toufafashion.com", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:09:50", "1853885", "yourhomeguide.co.uk", "domain", "payload_delivery", "win.vidar", "None", "Vidar", "", "100", "True", "", "ClickFix,compromised,etherhiding,Polygon,Vidar,WordPress", "0", "varysz" "2026-07-19 20:04:37", "1853908", "w8sxay63.varzeshlife.ir", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" "2026-07-19 19:56:59", "1853906", "ivclr.mango-sushi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 19:56:25", "1853905", "ikyu.domirunway.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-19 19:40:22", "1853897", "fbbzh.mango-sushi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 19:39:43", "1853896", "mango-sushi.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 19:55:59", "100", "True", "None", "19July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-19 19:29:43", "1853894", "litsotravels.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 19:29:53", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 19:19:43", "1853893", "koin99.link", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 19:20:14", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 19:14:32", "1853892", "istudiosgl.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 19:14:48", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 19:10:56", "1853891", "cydm.domirunway.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-19 19:09:30", "1853890", "domirunway.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 20:36:44", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 19:08:21", "1853889", "divoraworld.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 19:09:05", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 18:33:27", "1853857", "zenithlogicbase.glenmora.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-19 18:21:45", "1853855", "fsjkul62.onjabet1.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x76c7,macos", "1", "anonymous" "2026-07-19 18:15:41", "1853854", "bwwxd.polarstartire.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x4679,windows", "1", "anonymous" "2026-07-19 18:13:49", "1853852", "polarstartire.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-21 17:04:43", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 18:12:55", "1853851", "wnbl.divanailsachse.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,win-0x0cd5,windows", "1", "anonymous" "2026-07-19 18:08:27", "1853850", "kelforge6ix.immer-weeping.garden", "domain", "botnet_cc", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous" "2026-07-19 18:07:48", "1853848", "divanailsachse.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "2026-07-19 18:07:50", "100", "True", "None", "19July2026,ClearFake,Commandline,DomainShadowing,Windows", "0", "Gi7w0rm" "2026-07-19 18:07:48", "1853849", "divanailsachse.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch" "2026-07-19 18:05:11", "1853847", "umq3dj7m.tampabayspin.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous" # Number of entries: 508