################################################################
# ThreatFox IOCs: recent domains - CSV format                  #
# Last updated: 2026-10-19 23:12:27 UTC                        #
#                                                              #
# Terms Of Use: https://threatfox.abuse.ch/faq/#tos            #
# For questions please contact threatfox [at] abuse.ch         #
################################################################
#
# "first_seen_utc","ioc_id","ioc_value","ioc_type","threat_type","fk_malware","malware_alias","malware_printable","last_seen_utc","confidence_level","is_compromised","reference","tags","anonymous","reporter"
"2026-10-19 23:12:27", "1974755", "kuo4g8zc.bociljepe.cc", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-19 22:52:18", "1974741", "c4ut95w4.bociljp.online", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 22:49:50", "1974738", "vgijt61ux8.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 22:34:31", "1974725", "fruit-overall.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding,EtherHidingMagecart", "1", "anonymous"
"2026-10-19 22:34:31", "1974726", "decoyanswer.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding,EtherHidingMagecart", "1", "anonymous"
"2026-10-19 22:34:31", "1974727", "egg-crusade.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding,EtherHidingMagecart", "1", "anonymous"
"2026-10-19 22:05:49", "1974712", "o.9qoi.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 22:05:48", "1974708", "jm.88kfc.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-19 22:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 22:05:48", "1974710", "y4.8g8g.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 21:46:14", "1974697", "bopice.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 21:32:55", "1974691", "092248035181.atmpu0038.highway.a1.net", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 20:33:28", "1974654", "5e5am0xh.lanternglow.cc", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 20:29:20", "1974618", "dosur98665.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 20:29:18", "1974617", "lanternglow.cc", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-19 20:27:24", "1974615", "honeytrail.cc", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-19 19:51:30", "1974594", "kihcaneu.kakekmain.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-19 19:34:10", "1974567", "rarejisa.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 19:20:32", "1974560", "zipoj1hh.blinkhorizon.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-19 19:05:48", "1974550", "mf.9qoi.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 18:24:04", "1974533", "fuhakafe.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 18:10:07", "1974526", "qmyxmc8z.activeloop.cc", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 18:05:48", "1974521", "sn.88idr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-19 18:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 18:05:48", "1974523", "l.88qr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 18:04:43", "1974520", "activeloop.cc", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-19 17:32:21", "1974494", "lorijuku.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 16:47:00", "1974458", "imaweirdo.my", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "100", "False", "https://bazaar.abuse.ch/sample/4cae4c533e96cfa71e62966c8fa6339e1188629d2f0cfe86e040e733e10450e1/", "dead-drop,dht,elf,protokol", "0", "wristhulk"
"2026-10-19 16:47:00", "1974459", "paranoidjuice.info", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "100", "False", "https://bazaar.abuse.ch/sample/4cae4c533e96cfa71e62966c8fa6339e1188629d2f0cfe86e040e733e10450e1/", "dead-drop,dht,elf,protokol", "0", "wristhulk"
"2026-10-19 16:46:59", "1974460", "smithsonn-s.top", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "100", "False", "https://bazaar.abuse.ch/sample/4cae4c533e96cfa71e62966c8fa6339e1188629d2f0cfe86e040e733e10450e1/", "dead-drop,dht,elf,protokol", "0", "wristhulk"
"2026-10-19 16:46:59", "1974461", "howtodisappearcompletely.zip", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "100", "False", "https://bazaar.abuse.ch/sample/4cae4c533e96cfa71e62966c8fa6339e1188629d2f0cfe86e040e733e10450e1/", "dead-drop,dht,elf,protokol", "0", "wristhulk"
"2026-10-19 16:28:28", "1974451", "lpjlb51212.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 16:05:48", "1974435", "h.9qoi.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 15:51:14", "1974426", "atc5j2vt.coletteloire.rest", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 15:47:32", "1974423", "anvil-laii-r7tc2.pro", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "", "ClickFix,Mac", "0", "varysz"
"2026-10-19 15:40:18", "1974413", "k778a40y.berrythebear.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-19 15:36:09", "1974411", "pakebyda.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 15:12:30", "1974396", "audit.bitfetch.cc", "domain", "botnet_cc", "win.acr_stealer", "None", "ACR Stealer", "", "100", "False", "", "ClearFake", "0", "threatcat_ch"
"2026-10-19 15:04:41", "1974393", "zrmbta5x.coletteloire.rest", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 14:55:36", "1974388", "msnbot-40-77-167-58.search.msn.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 14:53:48", "1974385", "xvksxinh.coletteloire.rest", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 14:53:35", "1974384", "l35ypax8.dlcore.cc", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-19 14:52:39", "1974383", "check3wdsorobot.cc", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-19 14:53:11", "100", "False", "None", "ClickFix", "0", "threatcat_ch"
"2026-10-19 14:33:29", "1974378", "zsql3k3u.coletteloire.rest", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 14:29:54", "1974375", "4tmeijljqs.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 14:17:28", "1974372", "0aylp390.coletteloire.rest", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 14:05:48", "1974364", "jz.88idr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-19 14:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 14:05:48", "1974366", "xl.88qr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 13:55:25", "1974338", "ppilipp.lol", "domain", "payload_delivery", "js.kongtuke", "TAG-124,js.LandUpdate808", "KongTuke", "2026-10-19 14:39:39", "100", "False", "None", "KongTuke", "0", "monitorsg"
"2026-10-19 13:55:24", "1974343", "deushack.org", "domain", "payload_delivery", "win.donut_injector", "Donut", "donut_injector", "", "100", "False", "", "None", "0", "rifteyy"
"2026-10-19 13:51:03", "1974350", "a6b22d76dd.scan.leakix.org", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 13:50:56", "1974349", "d5904e1cdf.scan.leakix.org", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 13:50:47", "1974347", "b781e0bb13.scan.leakix.org", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 13:50:36", "1974346", "ca7e79b6df.scan.leakix.org", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 13:43:28", "1974341", "caffe-img.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-19 13:47:43", "100", "False", "None", "ClickFix", "0", "threatcat_ch"
"2026-10-19 13:40:02", "1974337", "815krissie.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 13:37:41", "1974335", "caffe-store-like.beer", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-19 13:47:56", "100", "False", "None", "ClickFix", "0", "threatcat_ch"
"2026-10-19 13:25:03", "1974330", "groverudder12.com", "domain", "payload_delivery", "osx.amos", "Atomic macOS Stealer", "AMOS", "", "100", "False", "https://www.virustotal.com/gui/file/08e7c04e22c51313e5095f2db39e11fcc59adf56a63481ae92d8730e2788edc7", "AMOS,ClickFix,Foxveil,macOS", "0", "c4ffeine"
"2026-10-19 13:14:38", "1974321", "cloud-browse.codes", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch"
"2026-10-19 13:10:22", "1974319", "REMBXP.TOP", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/84cd8bf6fa43ffc59f3fb3046933be0c650ef063a106b92b020580b51bdc9288/", "remcos", "0", "abuse_ch"
"2026-10-19 13:10:21", "1974317", "xxx.sytes.net", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/84cd8bf6fa43ffc59f3fb3046933be0c650ef063a106b92b020580b51bdc9288/", "remcos", "0", "abuse_ch"
"2026-10-19 13:10:21", "1974318", "pm44.gotdns.ch", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/84cd8bf6fa43ffc59f3fb3046933be0c650ef063a106b92b020580b51bdc9288/", "remcos", "0", "abuse_ch"
"2026-10-19 13:06:08", "1974316", "wifihgu.duckdns.org", "domain", "botnet_cc", "elf.moobot", "None", "MooBot", "", "100", "False", "https://bazaar.abuse.ch/sample/dc92065072ed7815c08f402351c3619c71345005aed0781abb9981559a6291c8/", "MooBot", "0", "abuse_ch"
"2026-10-19 13:05:48", "1974312", "ou.9kio.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 13:01:51", "1974269", "cdn.img.76e1e5fa.PNAlumni.dgitd.anchorbolnorth.com", "domain", "botnet_cc", "win.cobalt_strike", "Agentemis,BEACON,CobaltStrike,cobeacon", "Cobalt Strike", "", "100", "False", "https://app.any.run/tasks/7fe90473-d0aa-439d-b0b4-18aa3019f8a4", "None", "1", "anonymous"
"2026-10-19 13:01:49", "1974270", "upi.log.30ca777733df8aa6e4404bd8beadb65c36105e9346e15819152e9ecc4.fd746f6f221867dd6d504e00569cc108bbf5c5e0daf7628d26285775.86174a0a1dc3dd1625fc62e486572c26425c95ffef342f6dddb5ffe0.1b1f3f2edc.7605f6.pnalumni.dgitd.anchorbolnorth.com", "domain", "botnet_cc", "win.cobalt_strike", "Agentemis,BEACON,CobaltStrike,cobeacon", "Cobalt Strike", "", "100", "False", "https://app.any.run/tasks/7fe90473-d0aa-439d-b0b4-18aa3019f8a4", "None", "1", "anonymous"
"2026-10-19 13:01:47", "1974293", "calciteperistyle.info", "domain", "payload_delivery", "js.smartapesg", "HANEYMANEY,ZPHP", "SmartApeSG", "2026-10-19 12:40:42", "100", "False", "None", "SmartApeSG", "0", "monitorsg"
"2026-10-19 13:00:24", "1974305", "slotwallet777.co", "domain", "botnet_cc", "win.asyncrat", "None", "AsyncRAT", "", "75", "False", "https://bazaar.abuse.ch/sample/fc255863ceab40f2510ddf29801e583015505861777f1c5d7e72ec164920f075/", "asyncrat", "0", "abuse_ch"
"2026-10-19 12:45:57", "1974297", "qhqkc41j.coletteloire.rest", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x68dc,macos", "1", "anonymous"
"2026-10-19 12:29:18", "1974287", "comewivy.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 12:11:02", "1974274", "coletteloire.rest", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-19 12:03:05", "1974271", "checkgwfwtg465.art", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-19 14:52:39", "100", "False", "None", "ClickFix", "0", "threatcat_ch"
"2026-10-19 11:57:17", "1974207", "amm-frosty.lol", "domain", "botnet_cc", "unknown_stealer", "None", "Unknown Stealer", "", "100", "False", "https://www.virustotal.com/gui/file/8f9b2ee97e673d73876abbc952ac533f881749baba69d07a493c3f66d802fae0/behavior", "c2", "0", "Kejult"
"2026-10-19 11:57:17", "1974208", "forge-ember.pw", "domain", "botnet_cc", "unknown_stealer", "None", "Unknown Stealer", "", "100", "False", "https://www.virustotal.com/gui/file/8f9b2ee97e673d73876abbc952ac533f881749baba69d07a493c3f66d802fae0/behavior", "c2", "0", "Kejult"
"2026-10-19 11:57:17", "1974209", "huhowabisi.net", "domain", "botnet_cc", "unknown_stealer", "None", "Unknown Stealer", "", "100", "False", "https://www.virustotal.com/gui/file/8f9b2ee97e673d73876abbc952ac533f881749baba69d07a493c3f66d802fae0/behavior", "c2", "0", "Kejult"
"2026-10-19 11:37:11", "1974248", "ghrp886ec8.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 11:15:44", "1974241", "0pu7spir.bebaskanlah.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-19 10:51:49", "1974233", "1ehymkfr.cloudload.cc", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-19 10:49:29", "1974230", "secdarvin2026.icu", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous"
"2026-10-19 10:32:50", "1974224", "fuchsia1826.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 09:59:29", "1974210", "3a297305.clarins-sale2025.online", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous"
"2026-10-19 09:38:16", "1974176", "xywaso.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 09:24:31", "1974171", "bismarckchiropractor.com", "domain", "payload_delivery", "osx.macsync", "None", "MacSync", "", "100", "False", "https://www.virustotal.com/gui/file/b05f89e41ee8a6613461bdd57362772258f7fd8383a5d013a7965f3fd8f08eb0", "ClickFix,macOS,MacSync", "0", "c4ffeine"
"2026-10-19 09:23:56", "1974168", "model.bytedrop.cc", "domain", "botnet_cc", "win.acr_stealer", "None", "ACR Stealer", "", "100", "False", "", "ClearFake", "0", "threatcat_ch"
"2026-10-19 09:14:29", "1974167", "spscryspy.com", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "90", "False", "None", "ZigClipper", "1", "anonymous"
"2026-10-19 08:37:20", "1974159", "pijaqypi.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 08:20:05", "1974152", "google-proxy-66-249-88-66.google.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 07:50:26", "1973976", "dns.bagsrad.com", "domain", "botnet_cc", "win.quasar_rat", "CinaRAT,QuasarRAT,Yggdrasil", "Quasar RAT", "", "75", "False", "https://bazaar.abuse.ch/sample/ab95aaad2d69b0d587edd35cad42e3c13012a43ecd614da6b50a632c4d25a8ad/", "quasar", "0", "abuse_ch"
"2026-10-19 07:50:26", "1973977", "cnd.bagsrad.com", "domain", "botnet_cc", "win.quasar_rat", "CinaRAT,QuasarRAT,Yggdrasil", "Quasar RAT", "", "75", "False", "https://bazaar.abuse.ch/sample/ab95aaad2d69b0d587edd35cad42e3c13012a43ecd614da6b50a632c4d25a8ad/", "quasar", "0", "abuse_ch"
"2026-10-19 07:43:45", "1973975", "kisudi.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 07:30:15", "1973974", "cinecluster.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-19 06:51:19", "1973963", "5kpuhypo.blinderai.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-19 06:37:27", "1973958", "zvg9pesses.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 06:35:02", "1973955", "j9jsia3y.bociljp.info", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-19 06:21:04", "1972781", "nexus-panel.in", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,ghostx-panel,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:21:04", "1972782", "ghostx-panel-default-rtdb.firebaseio.com", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,ghostx-panel,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:21:03", "1972783", "ghostx-panel.firebasestorage.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,ghostx-panel,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:21:03", "1972784", "myuse-60542-default-rtdb.asia-southeast1.firebasedatabase.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,ghostx-panel,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:21:03", "1972785", "myuse-60542.firebasestorage.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,ghostx-panel,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:21:02", "1972786", "mparivahan.hs.vc", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,ghostx-panel,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:53", "1973185", "mparivahan772.s.gy", "domain", "payload_delivery", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:41", "1973471", "gitview.sbs", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "85", "False", "None", "apix,fake-git", "0", "Darkfibr"
"2026-10-19 06:20:40", "1973470", "gitsl.xyz", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "85", "False", "None", "apix,fake-git", "0", "Darkfibr"
"2026-10-19 06:20:39", "1973473", "gitrm.sbs", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "85", "False", "None", "apix,fake-git", "0", "Darkfibr"
"2026-10-19 06:20:38", "1973472", "viewgit.sbs", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "85", "False", "None", "apix,fake-git", "0", "Darkfibr"
"2026-10-19 06:20:38", "1973474", "gitrm.cfd", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "85", "False", "None", "apix,fake-git", "0", "Darkfibr"
"2026-10-19 06:20:30", "1973490", "wtf.btwpayme.top", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "85", "False", "None", "elf,irc,k4_irc_bot", "0", "Darkfibr"
"2026-10-19 06:20:30", "1973491", "x.btwpayme.top", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "80", "False", "None", "elf,irc,k4_irc_bot", "0", "Darkfibr"
"2026-10-19 06:20:25", "1973531", "nova-client.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "80", "False", "None", "jar,loader,minecraft", "0", "Darkfibr"
"2026-10-19 06:20:25", "1973532", "donutclients.st", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "80", "False", "None", "jar,loader,minecraft", "0", "Darkfibr"
"2026-10-19 06:20:25", "1973533", "floppaclient.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "80", "False", "None", "jar,loader,minecraft", "0", "Darkfibr"
"2026-10-19 06:20:24", "1973534", "cheetoclient.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "80", "False", "None", "jar,loader,minecraft", "0", "Darkfibr"
"2026-10-19 06:20:21", "1973588", "nsx1-7f7aa-default-rtdb.asia-southeast1.firebasedatabase.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:20", "1973589", "nsx1-7f7aa.firebasestorage.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:19", "1973615", "mparivahansms-default-rtdb.asia-southeast1.firebasedatabase.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:18", "1973616", "mparivahansms.firebasestorage.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:18", "1973617", "hdfc-bank-8ab58-default-rtdb.firebaseio.com", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:18", "1973618", "hdfc-bank-8ab58.firebasestorage.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:17", "1973619", "panel-sms.firebasestorage.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:17", "1973620", "andromeda-d389d.firebasestorage.app", "domain", "botnet_cc", "apk.smsspy", "None", "SMSspy", "", "100", "False", "None", "android,GhostBat,mparivahan,veltrix", "0", "murph"
"2026-10-19 06:20:10", "1973895", "kjhg.lol", "domain", "botnet_cc", "win.hermes", "None", "Hermes", "", "100", "False", "", "abe-bypass,clickfix,com-hijacking,hermes,hermes-stealer,infostealer", "0", "iocmonster"
"2026-10-19 06:20:09", "1973896", "kjhg.shop", "domain", "botnet_cc", "win.hermes", "None", "Hermes", "", "100", "False", "", "abe-bypass,clickfix,com-hijacking,hermes,hermes-stealer,infostealer", "0", "iocmonster"
"2026-10-19 06:05:48", "1973917", "qo.88idr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-19 06:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 06:05:48", "1973919", "wc.88qr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 06:05:25", "1973916", "www.jennywilliamlogisticsbackup2.com", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/b44d8553cf97dfde3046e3c55e73bb68e7666c057bdd89f2c6528f7f8269deae/", "remcos", "0", "abuse_ch"
"2026-10-19 06:05:24", "1973913", "www.jennywilliamlogistics.com", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/b44d8553cf97dfde3046e3c55e73bb68e7666c057bdd89f2c6528f7f8269deae/", "remcos", "0", "abuse_ch"
"2026-10-19 06:05:24", "1973914", "www.jennywilliamlogisticsbackup.com", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/b44d8553cf97dfde3046e3c55e73bb68e7666c057bdd89f2c6528f7f8269deae/", "remcos", "0", "abuse_ch"
"2026-10-19 06:05:24", "1973915", "www.jennywilliamlogisticsbackup1.com", "domain", "botnet_cc", "win.remcos", "RemcosRAT,Remvio,Socmer", "Remcos", "", "75", "False", "https://bazaar.abuse.ch/sample/b44d8553cf97dfde3046e3c55e73bb68e7666c057bdd89f2c6528f7f8269deae/", "remcos", "0", "abuse_ch"
"2026-10-19 05:46:48", "1973893", "monthlybrittani.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 04:34:57", "1973869", "zudufuso.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 04:10:48", "1973861", "j.9kio.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 03:45:13", "1973851", "heqosyco.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 03:15:33", "1973835", "70.93.154.34.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 02:49:52", "1973825", "chineseadoptee.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-19 02:39:01", "1973822", "mfc7lcz8.bociljp.id", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-19 02:38:16", "1973821", "q9ke10zjfu.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 02:16:30", "1973814", "s0106b85e715d725e.cg.shawcable.net", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 02:05:48", "1973806", "j7.88idr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-19 02:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 02:05:48", "1973808", "f.88qr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-19 01:49:28", "1973791", "zen-ignore-tree-include.xyz", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,ErrTraffic,EtherHiding", "1", "anonymous"
"2026-10-19 01:48:57", "1973790", "xasysoru.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 01:19:28", "1973773", "zttrych.icu", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous"
"2026-10-19 00:54:27", "1973759", "a2bfc593.cerridwen.shop", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous"
"2026-10-19 00:43:41", "1973747", "1049j0vwsn.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-19 00:32:03", "1973742", "143.99.14.34.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-19 00:29:07", "1973740", "cerridwen.shop", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 23:52:14", "1973725", "dyhuvemy.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 23:28:23", "1973718", "leafdraft18.com", "domain", "payload_delivery", "osx.amos", "Atomic macOS Stealer", "AMOS", "", "100", "False", "https://www.virustotal.com/gui/file/b5d4aba0fe4004e851756d0329f0c165db2c1667c7c73516e0f1537c9afd3298", "AMOS,ClickFix,Foxveil,macOS", "0", "c4ffeine"
"2026-10-18 22:51:17", "1973696", "wolibo.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 22:43:14", "1973693", "xx5m70m0.beyonce.id", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-18 22:27:14", "1973689", "bankruptcyrhodeisland.com", "domain", "payload_delivery", "osx.macsync", "None", "MacSync", "", "100", "False", "https://www.virustotal.com/gui/file/61f8e4e3e263934a04d18e29fd5edaa0840b1a8137b649e8241e5bae013f200d", "ClickFix,macOS,MacSync", "0", "c4ffeine"
"2026-10-18 22:08:45", "1973676", "caveresorts.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 22:05:47", "1973673", "e.88idr.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-18 22:05:47", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-18 21:59:39", "1973670", "hefewafa.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 21:00:33", "1973651", "cacote.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 20:59:27", "1973650", "efesg5.space", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous"
"2026-10-18 20:56:49", "1973649", "qujexele.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 20:37:24", "1973643", "proxy-us-east003-cip12.ahrefs.net", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 20:03:56", "1973630", "cyqafagi.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 19:21:07", "1973573", "227.73.178.34.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 19:05:48", "1973562", "o7.9kio.org", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-18 18:51:35", "1973553", "melisandra11.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 18:40:02", "1973549", "bulkcompressimages.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 18:21:06", "1973524", "ezn9tfkz.bewiseimmunize.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-18 18:05:48", "1973515", "t7.88idn.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-18 18:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-18 17:58:30", "1973500", "de67y1vlab.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 17:57:11", "1973499", "rogocinu.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 16:48:55", "1973414", "melodicviolante.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 16:19:37", "1973399", "bonecaambalabu.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 16:07:30", "1973308", "vvrs-info.be", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:30", "1973309", "xetaai.io", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:30", "1973310", "xftdc.cn", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:30", "1973311", "zdorovyeglaz.ru", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973291", "aestech.al", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973292", "akarhotel.com.tr", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973293", "btpwa.org", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973294", "cwsasoccer.org", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973295", "elektronbv.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973296", "finamiza.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973297", "holzideen.org", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973298", "ingridalmeida.adv.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973299", "loampsi.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973300", "lotvend.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973301", "mrcz.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973302", "nilehotel.co.ug", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973303", "simbaenergy.co.ke", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973304", "sureshakittur.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973305", "tab-consultancy.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973306", "taxiharnosand.se", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 16:07:29", "1973307", "virzicarburanti.it", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "100", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:56:38", "1973196", "1sx7oyl6t4.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 15:30:01", "1973175", "wellness.punkthotel.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:01", "1973176", "wkaikido.pl", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:01", "1973177", "wmartasia.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:01", "1973178", "xn----9sbbkhii6amcahr0b.xn--p1ai", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:01", "1973179", "xn--centroholisticoaucena-h4b.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:01", "1973180", "ymvc.ie", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973145", "sequimed.net", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973146", "sfsp.adv.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973147", "skmetallica.ru", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973148", "snskcompany.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973149", "sophiezirafa.cz", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973150", "standart-stroy.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973151", "sterrevdberg.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973152", "suginsa.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973153", "sungreenorganics.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973154", "tangomagdalena.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973155", "taruvatika.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973156", "tbmesquire.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973157", "techwire-ua.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973158", "tgs888v7b.net", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973159", "thehyttamarket.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973160", "thevrdimension.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973161", "threei.co.za", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973162", "tinlanhtayninh.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973163", "tokyo-shinsotsu.jp", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973164", "totaltblank.dk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973165", "touslesregimes.fr", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973166", "trudy-agin.ru", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973167", "truelabs.in", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973168", "unaster.com.tw", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973169", "ung-videre.dk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973170", "unitedgulfsahab.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973171", "vasikotras.hu", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973172", "vipbet789-z.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973173", "vuphongrestaurant.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:30:00", "1973174", "wadirumhappytourandcamp.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973113", "mumuworkshop.site", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973114", "myuniversetravel.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973115", "nagoagencia.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973116", "nasirullah.org", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973117", "neumaticosmarsili.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973118", "nickarnett.net", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973119", "nitab.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973120", "omo11-12.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973121", "open88.tv", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973122", "operationalsurgical.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973123", "paxmilenium.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973124", "personalloanshub.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973125", "petroleumtube.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973126", "pft-plastinnov.fr", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973127", "pixopainting.com.au", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973128", "polcasarosa.it", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973129", "polygonalnonsense.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973130", "poprazzi.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973131", "powderskiartistry.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973132", "powerbikes.it", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973133", "prishay.co.il", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973134", "proexsa.cl", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973135", "radiosantateresa.it", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973136", "rallypass.hu", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973137", "rbarcia.pt", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973138", "residencialbarreto.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973139", "restaurant-polite.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973140", "restaurant.punkthotel.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973141", "rlr.it", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973142", "rmbatiment.fr", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973143", "robattini.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:59", "1973144", "seeandboss.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973082", "inr18650.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973083", "joyforce-tech.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973084", "jpeletricidade.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973085", "k10kplastik.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973086", "kdobox.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973087", "keithkloor.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973088", "kimia.fkip.unila.ac.id", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973089", "kovok.at", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973090", "lalerya.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973091", "lambayecano.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973092", "lapiscina.tv", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973093", "leowebdesign.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973094", "liifa.co.za", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973095", "lukasspricht.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973096", "maiditcleanfl.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973097", "mangxop.info", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973098", "manuelstuerkat.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973099", "martakaras.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973100", "mccorklerealestategroup.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973101", "mechtild-tellmann.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973102", "meetmorse.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973103", "megadress.at", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973104", "mehmetcancan.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973105", "melekcollection.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973106", "mesh-stoffe.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973107", "methanogon.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973108", "mgcal.in", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973109", "mineniches.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973110", "morganaorvokki.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973111", "mountainviewframing-design.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:58", "1973112", "msml.co.ke", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973051", "duocphamquocte.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973052", "eaioc.shop", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973053", "ecom.pk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973054", "emineozmete.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973055", "epworld.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973056", "equidream.be", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973057", "eshop.tiles-kupelne.sk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973058", "espacoluzenergia.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973059", "evenstor.in", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973060", "fest-thailand.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973061", "fibraimpresa.it", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973062", "findmyperfecthome.co.uk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973063", "finelinecard.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973064", "gasthof.punkthotel.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973065", "gateless-gate.info", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973066", "gb69s.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973067", "gdrludica.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973068", "gfbuilding.co.uk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973069", "gibertpaul.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973070", "gitctech.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973071", "gloriadiosconstruction.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973072", "gm4u.co.uk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973073", "go2fuzzy.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973074", "graphicalinsights.co.za", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973075", "gulfexgroup.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973076", "hacopt.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973077", "hail.hu", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973078", "hbo77slot.net", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973079", "idealgestaoeseguranca.com.br", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973080", "iglesiacasademisericordia.org", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:57", "1973081", "imrcllp.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973019", "anti-hornhaut.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973020", "aptekabc.ru", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973021", "arsenalnow.co", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973022", "atodu.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973023", "avardrone.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973024", "bcdevelopment.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973025", "birdbeauty.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973026", "blancora.kz", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973027", "blog.clanfamily.de", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973028", "blossomcreation.in", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973029", "boloin.shop", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973030", "captaintec.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973031", "cdrklaw.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973032", "centreoptic.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973033", "chapalote69.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973034", "chetnastailors.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973035", "cinquequarti.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973036", "cjbookmarks.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973037", "cleanveins.org", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973038", "cloudespacios.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973039", "cmsvn.vn", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973040", "confessionscoffee24.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973041", "consegna-express.it", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973042", "cordonbleu.ci", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973043", "dailyhealthtips.blog", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973044", "danabagroup.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973045", "dar-alyasmin.net", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973046", "desaprendiendodigital.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973047", "dezabau.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973048", "disnely1234.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973049", "distiraevents.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:56", "1973050", "drchristos.gr", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973006", "1015fest.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973007", "10mand.dk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973008", "126260.xyz", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973009", "4x4sport.nl", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973010", "9uh.ru", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973011", "adawwa.lk", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973012", "adrenalinedesign.ca", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973013", "adumax.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973014", "aestheticphotopresetsstore.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973015", "agropol.ar", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973016", "aimano.nl", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973017", "ananthmulgund.com", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:29:55", "1973018", "annesophie-montpied.fr", "domain", "payload_delivery", "unknown_loader", "None", "Unknown Loader", "", "75", "True", "", "etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:26:34", "1973004", "vine-linen.com", "domain", "payload_delivery", "osx.amos", "Atomic macOS Stealer", "AMOS", "", "100", "False", "https://www.virustotal.com/gui/file/85fce9826974549c2dd4c92a3207cf2543e10676ad2dfad7c8ea429f616cdf21", "AMOS,ClickFix,Foxveil,macOS", "0", "c4ffeine"
"2026-10-18 15:26:34", "1973005", "nova-49.com", "domain", "botnet_cc", "osx.amos", "Atomic macOS Stealer", "AMOS", "", "100", "False", "https://www.virustotal.com/gui/file/85fce9826974549c2dd4c92a3207cf2543e10676ad2dfad7c8ea429f616cdf21", "AMOS,ClickFix,Foxveil,macOS", "0", "c4ffeine"
"2026-10-18 15:25:50", "1972989", "visadubai.com.vn", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972990", "warpfins.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972991", "webfischerei.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972992", "weddart.it", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972993", "winwincookware.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972994", "woraset-partners.co.th", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972995", "xinlin.tw", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972996", "xocdiapro.co", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972997", "yumweb.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:17", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972998", "zenithcomputers.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:17", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:50", "1972999", "zmops.io", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:17", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972966", "sandandgarden.com.mx", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972967", "sapir-eng.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972968", "sexstories.beauty", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972969", "skydomedesigns.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972970", "socolive.cash", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972971", "somachurch.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972972", "squamishadventure.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972973", "standardnewsworld.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972974", "stiltzfranchise.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972975", "strappete.it", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972976", "sutienda.es", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972977", "techcrumz.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972978", "temdetudoecommerce.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972979", "thefencecompanyonline.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972980", "thegurubarber.com.au", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972981", "theonedigital.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972982", "tuasesorcontable.com.co", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972983", "ufa365.academy", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972984", "ufakick.group", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972985", "umbilicals.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972986", "unipicase.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972987", "v2.bulwarrestauracja.pl", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:49", "1972988", "viralcag.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972939", "naturaclinics.com.au", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972940", "ngob.co.za", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972941", "nurmas.com.tr", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972942", "nwfc.io", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972943", "okxxx.cam", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972944", "parkcitydentalspa.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972946", "passeiosinesqueciveis.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972947", "peoplefortheplanet.world", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972948", "photographicmemories.uk.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972949", "pickabagelnyc.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972950", "piscinachivasso.it", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972951", "pofcolombia.com.co", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972952", "ponte.tv", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972953", "prefirobh.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972954", "produtecnicaagro.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972955", "qualicost.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972956", "quickwech.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972957", "raiz.ai", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972958", "raptors.pt", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972959", "reketepizza.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972960", "restaurantespelomundo.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972961", "roadracerx.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972962", "rosales20bar.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972963", "rtpibetslot4.co", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972964", "sachablack.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:48", "1972965", "sachablackbooks.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972912", "infraas.in", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972913", "ingazfawry.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972914", "intechpol.pl", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972915", "ironemic.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972916", "izmirtaskaplama.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972917", "joto-hp.jp", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972918", "kurashitalia.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972919", "lamiradadelotroediciones.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972920", "lansystem.hu", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972921", "leo88vn.vip", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972922", "lightmagazines.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972923", "limpiezaeventos.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972924", "linkclick.link", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972925", "liveliferadiantly.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972926", "loloops.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972927", "loolconsulting.it", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972928", "lottovip.lease", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972929", "luiseduardo.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972930", "machinegame.com.tw", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972931", "magicartsmaua.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972932", "megacricketworld.me", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972933", "meritoriumsolutions.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972934", "mhe.engineering", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972935", "milestonedentalassisting.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972936", "mindyoursmallbusiness.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972937", "modernfarmhousedecorideas.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:47", "1972938", "moncler-outletjackets.us.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972884", "eazyhob.store", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972885", "edwardlopezfotografia.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972886", "encodelp.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972887", "energybf.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972888", "energyecohub.com.au", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972889", "envidesign.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972890", "epiccircle.in", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972891", "evidance.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972892", "ezhealthyhabits.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972893", "fairgame.gg", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972894", "fashionfee.nl", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972895", "fcaes.com.mx", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972896", "fcs.com.ua", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972897", "filandoarte.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972898", "fitzgeraldsva.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972899", "flashaquecedores.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972900", "flizzyy.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972901", "franceinsider.fr", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972902", "gameignition.io", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972903", "gentacart.my.id", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972904", "guncelbetvoygiris.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972905", "hairandbeauty-lounge.at", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972906", "harlemtransportes.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972907", "hgwc.in", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972908", "i1-social.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972909", "iberian-trade.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972910", "ilconsigliere.com.au", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:46", "1972911", "immer-unter-strom.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:16", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972854", "bursacnc.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972855", "caecvehicle.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972856", "cambusa.eu", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972857", "canhonamlong.com.vn", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972858", "canhtienfarm.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972859", "casaleo-shop.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972860", "chaloupecka.cz", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972861", "champinu.in", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972862", "chinaimportswa.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972863", "classicdigitalindia.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972864", "clevedonmanwithvan.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972865", "clos3t.io", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972866", "constructionsmarttek.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972867", "cookinletproperty.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972868", "credencemanagement.co.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972869", "crestwaterdental.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972870", "cricketscore.art", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972871", "csspuertorico.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972872", "ctvenki.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972873", "dailyheadline.us", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972874", "darwencatholic.org.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972875", "derma-care.uk", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972876", "designsister.com.au", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972877", "dobrodelnik.bg", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972878", "doktorszekelyagnes.hu", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972879", "domiciliation-auto-entrepreneur.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972880", "drlogan.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972881", "drnidhiagrawal.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972882", "drperformance.com.br", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:45", "1972883", "dtf-one.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972827", "1022studio.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972828", "5a71.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972829", "adelheid-gloeser.fr", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972830", "ahmaar.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972831", "airconditioncapetown.co.za", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972832", "ajtscleaning.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972833", "alcoholth.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972834", "algaeworld.org", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972835", "aniimad.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972836", "anyonecanread.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972837", "asdal.io", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972838", "atvrentalssedona.net", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972839", "audiokitpro.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972840", "auditoriarecords.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972841", "aureoforpet.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972842", "authendigital.io", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972843", "baymar.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972844", "befestigungen24.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972845", "bettinahuang.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972846", "bishopsbowlfishery.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972847", "bizheadline.us", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972848", "blog.amoozaa.ir", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972849", "brancaccioc.com", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972850", "breezz.io", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972851", "bucharestfashionfilm.ro", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972852", "burberry-handbagsoutlet.com.co", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:25:44", "1972853", "burnout-und-sucht.de", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "2026-10-18 15:31:15", "100", "True", "", "ClickFix,etherhiding,Polygon", "0", "varysz"
"2026-10-18 15:05:57", "1972823", "msnbot-52-167-144-188.search.msn.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 14:54:57", "1972813", "maqovi.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 14:22:22", "1972797", "3p3m51o8.bociljepe.xyz", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-18 14:22:14", "1972796", "q2xcpigj.betweentwospaces.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-18 14:05:48", "1972778", "gd.88idn.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-18 14:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-18 13:59:12", "1972770", "bocillanang.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 13:57:38", "1972769", "mykunego.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 13:49:05", "1972761", "ray-id-v3.com", "domain", "botnet_cc", "win.amadey", "None", "Amadey", "", "100", "False", "", "None", "1", "anonymous"
"2026-10-18 13:29:25", "1972746", "sky.dolcefantasia.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,ErrTraffic,EtherHiding", "1", "anonymous"
"2026-10-18 13:15:48", "1972740", "t.99rtp.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-18 13:14:22", "1972734", "cdn-edge-updates.hostcloud-eu.net", "domain", "botnet_cc", "elf.mirai", "Katana", "Mirai", "", "100", "False", "https://bazaar.abuse.ch/sample/dcdfb5866c594ee0f92149fed4efcc2b243bf4da1f747a3b2e0b680fdd483df8/", "mirai", "0", "NDA0E"
"2026-10-18 13:14:22", "1972735", "beacon.systemd-notify-service.co", "domain", "botnet_cc", "elf.mirai", "Katana", "Mirai", "", "100", "False", "https://bazaar.abuse.ch/sample/dcdfb5866c594ee0f92149fed4efcc2b243bf4da1f747a3b2e0b680fdd483df8/", "mirai", "0", "NDA0E"
"2026-10-18 13:14:22", "1972736", "mgmt-panel.serverstats-daemon.com", "domain", "botnet_cc", "elf.mirai", "Katana", "Mirai", "", "100", "False", "https://bazaar.abuse.ch/sample/dcdfb5866c594ee0f92149fed4efcc2b243bf4da1f747a3b2e0b680fdd483df8/", "mirai", "0", "NDA0E"
"2026-10-18 13:14:22", "1972737", "hostcloud-eu.net", "domain", "botnet_cc", "elf.mirai", "Katana", "Mirai", "", "100", "False", "https://bazaar.abuse.ch/sample/dcdfb5866c594ee0f92149fed4efcc2b243bf4da1f747a3b2e0b680fdd483df8/", "mirai", "0", "NDA0E"
"2026-10-18 13:14:22", "1972738", "systemd-notify-service.co", "domain", "botnet_cc", "elf.mirai", "Katana", "Mirai", "", "100", "False", "https://bazaar.abuse.ch/sample/dcdfb5866c594ee0f92149fed4efcc2b243bf4da1f747a3b2e0b680fdd483df8/", "mirai", "0", "NDA0E"
"2026-10-18 13:14:22", "1972739", "serverstats-daemon.com", "domain", "botnet_cc", "elf.mirai", "Katana", "Mirai", "", "100", "False", "https://bazaar.abuse.ch/sample/dcdfb5866c594ee0f92149fed4efcc2b243bf4da1f747a3b2e0b680fdd483df8/", "mirai", "0", "NDA0E"
"2026-10-18 13:06:09", "1972725", "33841-28554.dchost.com", "domain", "payload_delivery", "win.guidloader", "None", "GUIDLOADER", "", "90", "False", "None", "dchost,guloader", "0", "Darkfibr"
"2026-10-18 12:07:09", "1972689", "mapledesk.cfd", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "OffLoader", "0", "abuse_ch"
"2026-10-18 12:05:33", "1972687", "compassbase.cfd", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "OffLoader", "0", "abuse_ch"
"2026-10-18 12:02:41", "1972680", "wubezizo.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 11:59:25", "1972678", "9d2a8bbd.bociljp.xyz", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "90", "False", "None", "ClearFake,ClickFix,EtherHiding", "1", "anonymous"
"2026-10-18 11:46:46", "1972660", "paneact.xyz", "domain", "botnet_cc", "unknown_loader", "None", "Unknown Loader", "", "100", "False", "", "OffLoader", "0", "abuse_ch"
"2026-10-18 11:38:50", "1972658", "bociljp.xyz", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 11:29:22", "1972627", "bociljp.us.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 10:59:16", "1972612", "hureneqo.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 10:28:48", "1972602", "frame97.com", "domain", "payload_delivery", "osx.amos", "Atomic macOS Stealer", "AMOS", "", "100", "False", "https://www.virustotal.com/gui/file/2b66b4b8780569cd63159360fbc53761d6ba15c7635c977976d55c77d1d93079", "AMOS,ClickFix,Foxveil,macOS", "0", "c4ffeine"
"2026-10-18 10:28:15", "1972577", "ota.proxystream.st", "domain", "botnet_cc", "elf.xmrig", "None", "XMRIG", "2026-10-18 10:00:25", "95", "True", "None", "codec-cache,cve-2026-96656,elf,miner,plex", "0", "a3igner"
"2026-10-18 10:28:13", "1972584", "9win.cyou", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "", "100", "False", "https://www.virustotal.com/gui/file/8ad8e7b22405a2368fe8b4a71c85311ed6846a159c911d6d068bd06e6c29ec6d/behavior", "c2,vidar", "0", "Kejult"
"2026-10-18 10:10:17", "1972592", "tjt7bjni.bociljepe.info", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-18 10:05:48", "1972589", "if.88idn.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-18 10:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-18 10:04:26", "1972585", "npugr18830.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 10:02:34", "1972582", "2ayvag06.berrythebear.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-18 09:09:01", "1972527", "bociljp.store", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 08:59:32", "1972446", "bociljp.site", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 08:39:27", "1972436", "85.185.221.35.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 08:08:30", "1972421", "grplo2aob1.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 07:05:12", "1972397", "xawipo.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 06:39:03", "1972360", "bociljp.online", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 06:34:30", "1972354", "54.5.200.35.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 06:25:44", "1972292", "genesis-hub.cc", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "https://winslow1984.com/books/threat-intelligence/page/hey-you-hacked-a-hacker-are-you-ready-for-my-revenge", "None", "0", "abuse_ch"
"2026-10-18 06:25:43", "1972289", "shells.su", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "https://winslow1984.com/books/threat-intelligence/page/hey-you-hacked-a-hacker-are-you-ready-for-my-revenge", "None", "0", "abuse_ch"
"2026-10-18 06:25:43", "1972290", "gitbase.su", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "https://winslow1984.com/books/threat-intelligence/page/hey-you-hacked-a-hacker-are-you-ready-for-my-revenge", "None", "0", "abuse_ch"
"2026-10-18 06:25:43", "1972291", "verificator.cc", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "100", "False", "https://winslow1984.com/books/threat-intelligence/page/hey-you-hacked-a-hacker-are-you-ready-for-my-revenge", "None", "0", "abuse_ch"
"2026-10-18 06:14:40", "1972285", "7w3h1e8nfj.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 06:10:55", "1971716", "funtar.vercel.app", "domain", "botnet_cc", "unknown_rat", "None", "Unknown RAT", "", "100", "False", "https://bazaar.abuse.ch/sample/7c997959c5f233b07bed777d6477ad2cee3c316447dd4bff3ed77f952211d70d/", "etherhiding,funrat,MaksRAT,minecraft,PussyRAT,TON", "0", "Daydream"
"2026-10-18 06:10:55", "1971717", "funrat.cam", "domain", "botnet_cc", "unknown_rat", "None", "Unknown RAT", "", "100", "False", "https://bazaar.abuse.ch/sample/5d123596bdc088235282a1eea5431bac06440d7dded87a8ea6e8af2ac4707144/", "etherhiding,funrat,MaksRAT,minecraft,PussyRAT,TON", "0", "Daydream"
"2026-10-18 06:10:54", "1971718", "hitsfolder.click", "domain", "botnet_cc", "unknown_rat", "None", "Unknown RAT", "", "100", "False", "https://bazaar.abuse.ch/sample/5d123596bdc088235282a1eea5431bac06440d7dded87a8ea6e8af2ac4707144/", "etherhiding,funrat,MaksRAT,minecraft,PussyRAT,TON", "0", "Daydream"
"2026-10-18 06:10:32", "1971697", "youshouldvecomeover.lol", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "75", "False", "https://www.virustotal.com/gui/file/4d05b7ecd6db6ed76e6e5597f4e8a3f36ac3b55dd16874977b4b0db365291e6c", "auditpolcore,dll-sideloading,OVH", "0", "mikemich"
"2026-10-18 06:10:31", "1971698", "tooyoungtoholdon.world", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "75", "False", "https://www.virustotal.com/gui/file/4d05b7ecd6db6ed76e6e5597f4e8a3f36ac3b55dd16874977b4b0db365291e6c", "auditpolcore,dll-sideloading,OVH", "0", "mikemich"
"2026-10-18 06:10:31", "1971699", "cdn.youshouldvecomeover.lol", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "75", "False", "https://www.virustotal.com/gui/file/4d05b7ecd6db6ed76e6e5597f4e8a3f36ac3b55dd16874977b4b0db365291e6c", "auditpolcore,dll-sideloading,OVH", "0", "mikemich"
"2026-10-18 06:10:30", "1971700", "cdn.tooyoungtoholdon.world", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "75", "False", "https://www.virustotal.com/gui/file/4d05b7ecd6db6ed76e6e5597f4e8a3f36ac3b55dd16874977b4b0db365291e6c", "auditpolcore,dll-sideloading,OVH", "0", "mikemich"
"2026-10-18 06:10:26", "1971775", "maximalmaxing.com", "domain", "botnet_cc", "win.cloudhaze", "zenith", "CLOUDHAZE", "", "75", "False", "https://www.virustotal.com/gui/domain/maximalmaxing.com/relations", "None", "0", "paigeFault"
"2026-10-18 06:10:13", "1972020", "www.divinex.to", "domain", "payload_delivery", "win.warden_stealer", "None", "WARDENStealer", "", "100", "False", "https://bazaar.abuse.ch/sample/5d025ebb863503212582370793259517992800c729c3a25f1d452e161b6c5bf4/", "DIVINEX,DvnX,WardenStealer,YapStealer", "0", "Daydream"
"2026-10-18 06:10:12", "1972017", "warrette.quest", "domain", "botnet_cc", "win.warden_stealer", "None", "WARDENStealer", "", "100", "False", "https://bazaar.abuse.ch/sample/315e87a089566ffdeeb7df30152bb00001e3dd496f55fa0f2c0b7b72b5be38c6/", "DvnX,WardenStealer,YapStealer", "0", "Daydream"
"2026-10-18 06:10:12", "1972018", "olingri.skin", "domain", "botnet_cc", "win.warden_stealer", "None", "WARDENStealer", "", "100", "False", "https://bazaar.abuse.ch/sample/adf75ee42b2de8321da9260725792634c912cf682301a4e405873242555be33e/", "DvnX,WardenStealer,YapStealer", "0", "Daydream"
"2026-10-18 06:10:12", "1972019", "divinex.to", "domain", "payload_delivery", "win.warden_stealer", "None", "WARDENStealer", "", "100", "False", "https://bazaar.abuse.ch/sample/5d025ebb863503212582370793259517992800c729c3a25f1d452e161b6c5bf4/", "DIVINEX,DvnX,WardenStealer,YapStealer", "0", "Daydream"
"2026-10-18 06:10:11", "1972016", "falaheeh.mom", "domain", "botnet_cc", "win.warden_stealer", "None", "WARDENStealer", "", "100", "False", "https://bazaar.abuse.ch/sample/315e87a089566ffdeeb7df30152bb00001e3dd496f55fa0f2c0b7b72b5be38c6/", "DvnX,WardenStealer,YapStealer", "0", "Daydream"
"2026-10-18 06:10:10", "1971869", "api.recapcha.fun", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "75", "False", "None", "ClickFix,ContagiousInterview,DPRK,fake-recruitment", "0", "shmulc"
"2026-10-18 06:10:09", "1972015", "ricarle.homes", "domain", "botnet_cc", "win.warden_stealer", "None", "WARDENStealer", "", "100", "False", "https://bazaar.abuse.ch/sample/315e87a089566ffdeeb7df30152bb00001e3dd496f55fa0f2c0b7b72b5be38c6/", "DvnX,WardenStealer,YapStealer", "0", "Daydream"
"2026-10-18 06:10:07", "1971868", "tokenmetrics.org", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "75", "False", "None", "ClickFix,ContagiousInterview,DPRK,fake-recruitment", "0", "shmulc"
"2026-10-18 06:10:04", "1971817", "mops.to", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "75", "False", "None", "loader,RuntimeBroker,websocket", "0", "wristhulk"
"2026-10-18 06:10:01", "1972036", "minefox.lol", "domain", "payload_delivery", "unknown", "None", "Unknown malware", "", "75", "False", "https://urlhaus.abuse.ch/url/3951406/", "ddos,elf,garble,golang,minefox", "0", "wristhulk"
"2026-10-18 06:06:46", "1972280", "gfisoda.biz", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "100", "False", "", "ClickFix", "1", "anonymous"
"2026-10-18 06:06:46", "1972281", "joknsdfgjojipogfdfgsjksf.icu", "domain", "botnet_cc", "unknown", "None", "Unknown malware", "", "100", "False", "", "ClickFix", "1", "anonymous"
"2026-10-18 06:05:48", "1972277", "e.88idn.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-18 06:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-18 05:43:53", "1972263", "ijj4ciid.blinkhorizon.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0x0f14,macos", "1", "anonymous"
"2026-10-18 05:43:44", "1972262", "ljpjw6ws.bebaskanlah.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-18 05:07:24", "1972254", "qijyxidi.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 04:15:25", "1972238", "bihykyto.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 04:09:29", "1972234", "verifing-server.codes", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch"
"2026-10-18 04:09:21", "1972233", "travelley.health", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 03:59:25", "1972228", "web-optimizer.us", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 03:44:37", "1972222", "142.64.109.136.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 03:06:43", "1972214", "deanna5.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 02:45:15", "1972204", "92.202.241.35.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 02:25:39", "1972198", "e8alb83nqp.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 02:22:35", "1972196", "auth-code.nvc-info.beer", "domain", "payload_delivery", "js.iclickfix", "None", "IClickFix", "", "100", "False", "None", "ClickFix", "0", "threatcat_ch"
"2026-10-18 02:05:48", "1972190", "yuw.88idn.net", "domain", "botnet_cc", "win.vidar", "None", "Vidar", "2026-10-18 02:05:48", "100", "True", "None", "vidar", "0", "crep1x"
"2026-10-18 01:38:59", "1972178", "allert-tech.com", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake", "0", "threatcat_ch"
"2026-10-18 01:20:12", "1972166", "copofaci.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 00:59:51", "1972161", "71.159.199.104.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 00:58:37", "1972160", "111.240.107.136.bc.googleusercontent.com", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "GIF,PHP,webshell,WordPress,wp-admin", "0", "xscon"
"2026-10-18 00:28:48", "1972137", "genniferclinical.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
"2026-10-18 00:16:53", "1972128", "6cnxgj35.cyclingjordan.co", "domain", "payload_delivery", "js.clearfake", "None", "ClearFake", "", "100", "False", "None", "ClearFake,mac-0xdcf2,macos", "1", "anonymous"
"2026-10-17 23:22:32", "1972109", "lolati.workers.dev", "domain", "payload_delivery", "php.shin_webshell", "None", "php.shin_webshell", "", "50", "True", "None", "Cloudflare,GIF,PHP,webshell,WordPress,workers.dev,wp-admin", "0", "xscon"
# Number of entries: 623