{
    "1808229": [
        {
            "ioc_value": "https://bik.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-07 16:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1808228": [
        {
            "ioc_value": "bik.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-07 16:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1808226": [
        {
            "ioc_value": "onto.relativepulp.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.acr_stealer",
            "malware_alias": null,
            "malware_printable": "ACR Stealer",
            "first_seen_utc": "2026-05-07 15:55:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/2a1c39c2d5b9c43e1cf0e4dbebc17b9699a41e73cad28eceed3e3a0a4f72374f/",
            "tags": "ACRStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808217": [
        {
            "ioc_value": "ssntana.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-07 15:53:03",
            "last_seen_utc": "2026-05-07 15:11:07",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116533690101629975",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808216": [
        {
            "ioc_value": "https://ssntana.com/file.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-07 15:53:02",
            "last_seen_utc": "2026-05-07 15:11:06",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116533690101629975",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808218": [
        {
            "ioc_value": "https://ssntana.com/t",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-07 15:53:01",
            "last_seen_utc": "2026-05-07 15:11:08",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116533690101629975",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808220": [
        {
            "ioc_value": "https://ssntana.com/g",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-07 15:53:01",
            "last_seen_utc": "2026-05-07 15:11:09",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116533690101629975",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808221": [
        {
            "ioc_value": "https://ssntana.com/c",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-07 15:53:00",
            "last_seen_utc": "2026-05-07 15:11:10",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116533690101629975",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808222": [
        {
            "ioc_value": "secure.nzlifecoaching.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2026-05-07 15:53:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116533694348747917",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808223": [
        {
            "ioc_value": "142.93.142.120:25001",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "apk.kimwolf",
            "malware_alias": null,
            "malware_printable": "Kimwolf",
            "first_seen_utc": "2026-05-07 15:52:59",
            "last_seen_utc": "2026-05-07 16:05:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "c2,Kimwolf",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1808225": [
        {
            "ioc_value": "https://fourdigs.cyou",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-07 14:50:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/c4b97ad48a32136e6259536e2cd079e1cbc1492efec6d19db9d205005c74ba10/",
            "tags": "lumma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808224": [
        {
            "ioc_value": "whynotebanarot.xyz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_webinject",
            "malware_alias": null,
            "malware_printable": "Unknown Webinject",
            "first_seen_utc": "2026-05-07 14:43:19",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ErrTraffic",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808219": [
        {
            "ioc_value": "unhoq4.arch-vivarium.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 14:10:00",
            "last_seen_utc": "2026-05-07 14:10:59",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808215": [
        {
            "ioc_value": "lettercinema.vexon6ar.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 14:07:46",
            "last_seen_utc": "2026-05-07 14:08:59",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808214": [
        {
            "ioc_value": "https://honceybl.cyou",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-07 14:05:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/5840591c76ca4e6a9ed455a682022821029e7287c5d9aef81217d1c42d869b20/",
            "tags": "lumma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808213": [
        {
            "ioc_value": "https://balvlqts.cyou",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-07 14:05:33",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/17df57b9e3925e6367228e7b08f2119dc6df374acf1f1fefc5d843940000f775/",
            "tags": "lumma",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808212": [
        {
            "ioc_value": "genesun.arch-vivarium.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 14:03:19",
            "last_seen_utc": "2026-05-07 14:03:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808211": [
        {
            "ioc_value": "204.10.160.250:7007",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2026-05-07 14:01:20",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/9587ce36a1e86a913af1ec84aa2e04292e4bc7d469856d4b34eeb5aeea315ddc/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808210": [
        {
            "ioc_value": "parcboo.vexon6ar.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 14:01:12",
            "last_seen_utc": "2026-05-07 14:02:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808209": [
        {
            "ioc_value": "cwpjb6yk.arch-vivarium.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:56:51",
            "last_seen_utc": "2026-05-07 13:57:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808208": [
        {
            "ioc_value": "rapid-forge.vexon6ar.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:54:39",
            "last_seen_utc": "2026-05-07 13:55:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808207": [
        {
            "ioc_value": "neuralcra.arch-vivarium.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:50:18",
            "last_seen_utc": "2026-05-07 13:51:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808206": [
        {
            "ioc_value": "moledynam.vexon6ar.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:49:05",
            "last_seen_utc": "2026-05-07 13:49:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808205": [
        {
            "ioc_value": "dawn3-spool.fixionmunici9al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:43:32",
            "last_seen_utc": "2026-05-07 13:44:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808204": [
        {
            "ioc_value": "onpyo.vexon6ar.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:41:48",
            "last_seen_utc": "2026-05-07 13:46:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808203": [
        {
            "ioc_value": "xs2f.fixionmunici9al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:36:51",
            "last_seen_utc": "2026-05-07 13:37:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808202": [
        {
            "ioc_value": "xwpw.vexon6ar.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:34:39",
            "last_seen_utc": "2026-05-07 13:35:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808201": [
        {
            "ioc_value": "1ce6-route.fixionmunici9al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:30:16",
            "last_seen_utc": "2026-05-07 13:30:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808200": [
        {
            "ioc_value": "thre-thic.pav1mirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:28:05",
            "last_seen_utc": "2026-05-07 13:28:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808199": [
        {
            "ioc_value": "18nnbu.fixionmunici9al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:23:32",
            "last_seen_utc": "2026-05-07 13:23:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808198": [
        {
            "ioc_value": "listenermacro.pav1mirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:21:57",
            "last_seen_utc": "2026-05-07 13:22:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808197": [
        {
            "ioc_value": "1llume-sync.fixionmunici9al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:17:07",
            "last_seen_utc": "2026-05-07 13:17:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808196": [
        {
            "ioc_value": "hvr071.pav1mirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:14:57",
            "last_seen_utc": "2026-05-07 13:15:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808195": [
        {
            "ioc_value": "birc6-trail.fixionmunici9al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:10:02",
            "last_seen_utc": "2026-05-07 13:10:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808194": [
        {
            "ioc_value": "launch-point.pav1mirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:08:21",
            "last_seen_utc": "2026-05-07 13:09:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808193": [
        {
            "ioc_value": "supplyvau.fixionmunici9al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:03:36",
            "last_seen_utc": "2026-05-07 13:04:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808192": [
        {
            "ioc_value": "solarvine.pav1mirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 13:01:49",
            "last_seen_utc": "2026-05-07 13:04:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808191": [
        {
            "ioc_value": "shellengi.pastor-publicist.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:57:21",
            "last_seen_utc": "2026-05-07 13:00:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808190": [
        {
            "ioc_value": "h1ll-switch.pav1mirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:52:48",
            "last_seen_utc": "2026-05-07 12:53:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808189": [
        {
            "ioc_value": "casual-hinge.pastor-publicist.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:48:04",
            "last_seen_utc": "2026-05-07 12:48:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808188": [
        {
            "ioc_value": "irngvd.pav1mirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:46:07",
            "last_seen_utc": "2026-05-07 12:46:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808187": [
        {
            "ioc_value": "rgd2.pastor-publicist.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:41:53",
            "last_seen_utc": "2026-05-07 12:42:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808186": [
        {
            "ioc_value": "a3vrjnwj.xamir9el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:40:00",
            "last_seen_utc": "2026-05-07 12:40:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808185": [
        {
            "ioc_value": "talmark5ix.pastor-publicist.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:35:04",
            "last_seen_utc": "2026-05-07 12:35:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808184": [
        {
            "ioc_value": "image-mesh.xamir9el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:32:53",
            "last_seen_utc": "2026-05-07 12:34:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808183": [
        {
            "ioc_value": "4mnyykj.pastor-publicist.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:28:34",
            "last_seen_utc": "2026-05-07 12:29:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808182": [
        {
            "ioc_value": "jizeeb.xamir9el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:27:05",
            "last_seen_utc": "2026-05-07 12:28:05",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808181": [
        {
            "ioc_value": "1oc44-span.pastor-publicist.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:22:15",
            "last_seen_utc": "2026-05-07 12:22:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808180": [
        {
            "ioc_value": "1oc4l-node.xamir9el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:20:11",
            "last_seen_utc": "2026-05-07 12:21:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808179": [
        {
            "ioc_value": "shore-leaf.pastor-publicist.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:15:51",
            "last_seen_utc": "2026-05-07 12:16:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808178": [
        {
            "ioc_value": "dynmesh5et.xamir9el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:13:38",
            "last_seen_utc": "2026-05-07 12:13:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808177": [
        {
            "ioc_value": "doma.fastexitnow.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:09:18",
            "last_seen_utc": "2026-05-07 12:13:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808176": [
        {
            "ioc_value": "wg1wa8.xamir9el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:07:02",
            "last_seen_utc": "2026-05-07 12:09:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808175": [
        {
            "ioc_value": "mixblo.xamir9el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:04:47",
            "last_seen_utc": "2026-05-07 12:05:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808174": [
        {
            "ioc_value": "true.fastexitnow.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 12:02:45",
            "last_seen_utc": "2026-05-07 12:02:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808173": [
        {
            "ioc_value": "outerlaunch.tavro4xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:58:14",
            "last_seen_utc": "2026-05-07 12:02:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808172": [
        {
            "ioc_value": "un1o-loop.tavro4xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:50:45",
            "last_seen_utc": "2026-05-07 11:51:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808171": [
        {
            "ioc_value": "asts.datarunkey.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:47:26",
            "last_seen_utc": "2026-05-07 11:47:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808170": [
        {
            "ioc_value": "sketchbasic.tavro4xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:44:15",
            "last_seen_utc": "2026-05-07 11:45:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808106": [
        {
            "ioc_value": "https://round-cherry-4418.hellohiall.workers.dev",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 11:41:37",
            "last_seen_utc": null,
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://www.cryptika.com/cloudz-rat-abuses-microsoft-phone-link-to-steal-sms-otps-and-mobile-notifications/",
            "tags": "CloudZ RAT",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1808151": [
        {
            "ioc_value": "https://dyuthiengineering.com/d.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808152": [
        {
            "ioc_value": "dyuthiengineering.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808153": [
        {
            "ioc_value": "https://openrelayzone.top/rate/rate-effect.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:36",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808154": [
        {
            "ioc_value": "openrelayzone.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:36",
            "last_seen_utc": "2026-05-07 11:09:54",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808155": [
        {
            "ioc_value": "https://openrelayzone.top/rate/principal-client.php",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808156": [
        {
            "ioc_value": "https://openrelayzone.top/rate/api-template.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808157": [
        {
            "ioc_value": "http://178.156.241.213",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808158": [
        {
            "ioc_value": "http://5.78.87.19",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808159": [
        {
            "ioc_value": "https://advancedpatternlab.com/yup",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808160": [
        {
            "ioc_value": "advancedpatternlab.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-07 11:41:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116532981200720939",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1808169": [
        {
            "ioc_value": "abh.openlinksys.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:40:26",
            "last_seen_utc": "2026-05-07 11:41:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808168": [
        {
            "ioc_value": "5107vvgb.tavro4xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:37:40",
            "last_seen_utc": "2026-05-07 11:39:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808167": [
        {
            "ioc_value": "tal-linea.tavro4xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:31:12",
            "last_seen_utc": "2026-05-07 11:31:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808166": [
        {
            "ioc_value": "https://vbv.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-07 11:30:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1808165": [
        {
            "ioc_value": "vbv.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-07 11:30:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1808164": [
        {
            "ioc_value": "69zhzd.tavro4xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:24:53",
            "last_seen_utc": "2026-05-07 11:25:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808162": [
        {
            "ioc_value": "rich-endpo.tavro4xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:18:17",
            "last_seen_utc": "2026-05-07 11:18:59",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808161": [
        {
            "ioc_value": "rl035mt.7zorelax.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:12:05",
            "last_seen_utc": "2026-05-07 11:12:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808150": [
        {
            "ioc_value": "neo-anch0r.7zorelax.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:05:17",
            "last_seen_utc": "2026-05-07 11:06:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808149": [
        {
            "ioc_value": "gitlabh.openlinksys.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 11:05:04",
            "last_seen_utc": "2026-05-07 11:07:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808148": [
        {
            "ioc_value": "agmdojf.7zorelax.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:57:40",
            "last_seen_utc": "2026-05-07 10:58:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808147": [
        {
            "ioc_value": "apiopss.openlinksys.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:56:42",
            "last_seen_utc": "2026-05-07 10:56:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808146": [
        {
            "ioc_value": "4rray-dock.7zorelax.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:51:17",
            "last_seen_utc": "2026-05-07 10:51:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808145": [
        {
            "ioc_value": "logbins.openlinksys.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:49:47",
            "last_seen_utc": "2026-05-07 10:54:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808144": [
        {
            "ioc_value": "pipelin-reach.7zorelax.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:44:48",
            "last_seen_utc": "2026-05-07 10:45:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808143": [
        {
            "ioc_value": "94.154.35.160:12345",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2026-05-07 10:44:22",
            "last_seen_utc": "2026-05-07 15:44:21",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "DCRat,drb-ra,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808142": [
        {
            "ioc_value": "83.147.38.94:2030",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "elf.evilginx",
            "malware_alias": null,
            "malware_printable": "Evilginx",
            "first_seen_utc": "2026-05-07 10:44:18",
            "last_seen_utc": "2026-05-07 15:44:16",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,Evilginx,EvilGoPhish",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808141": [
        {
            "ioc_value": "66.85.27.30:7443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 10:44:15",
            "last_seen_utc": "2026-05-07 15:44:14",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,Mythic",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808140": [
        {
            "ioc_value": "5.101.81.81:9323",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-07 10:44:07",
            "last_seen_utc": "2026-05-07 15:44:07",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808139": [
        {
            "ioc_value": "203.159.90.139:2404",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-07 10:43:34",
            "last_seen_utc": "2026-05-07 15:43:34",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808138": [
        {
            "ioc_value": "104.167.199.243:7443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 10:43:04",
            "last_seen_utc": "2026-05-07 15:43:05",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,Mythic",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808137": [
        {
            "ioc_value": "appsrch.openlinksys.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:42:43",
            "last_seen_utc": "2026-05-07 10:45:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808136": [
        {
            "ioc_value": "jwosviuw.7zorelax.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:38:24",
            "last_seen_utc": "2026-05-07 10:39:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808135": [
        {
            "ioc_value": "webdocs.openlinksys.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:33:56",
            "last_seen_utc": "2026-05-07 10:34:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808134": [
        {
            "ioc_value": "filte-path.7zorelax.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:31:22",
            "last_seen_utc": "2026-05-07 10:31:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808133": [
        {
            "ioc_value": "syskeys.openlinksys.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:25:59",
            "last_seen_utc": "2026-05-07 10:26:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808132": [
        {
            "ioc_value": "wornod.qen2virex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:24:49",
            "last_seen_utc": "2026-05-07 10:25:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808131": [
        {
            "ioc_value": "netmans.datarunkey.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:19:27",
            "last_seen_utc": "2026-05-07 10:19:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808130": [
        {
            "ioc_value": "steadymeasure.qen2virex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:18:20",
            "last_seen_utc": "2026-05-07 10:19:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808129": [
        {
            "ioc_value": "tcpcons.datarunkey.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:11:51",
            "last_seen_utc": "2026-05-07 10:13:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808128": [
        {
            "ioc_value": "sandman.qen2virex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:07:32",
            "last_seen_utc": "2026-05-07 10:08:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808127": [
        {
            "ioc_value": "sshpros.datarunkey.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:05:40",
            "last_seen_utc": "2026-05-07 10:06:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808126": [
        {
            "ioc_value": "silverlinegereedschap.nl",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2026-05-07 10:05:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/884f2bd859993831630eaabc84cce99724c18c400f8be768d04c346ba9561474/",
            "tags": "nanocore",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808125": [
        {
            "ioc_value": "oixkxhga.qen2virex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 10:00:56",
            "last_seen_utc": "2026-05-07 10:01:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808124": [
        {
            "ioc_value": "vmlists.datarunkey.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:58:37",
            "last_seen_utc": "2026-05-07 09:59:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808123": [
        {
            "ioc_value": "75aohwq.qen2virex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:55:07",
            "last_seen_utc": "2026-05-07 09:55:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808122": [
        {
            "ioc_value": "usrgrps.datarunkey.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:50:14",
            "last_seen_utc": "2026-05-07 09:50:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808121": [
        {
            "ioc_value": "3ohr8brt.qen2virex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:46:29",
            "last_seen_utc": "2026-05-07 09:46:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808120": [
        {
            "ioc_value": "optwebs.datarunkey.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:43:27",
            "last_seen_utc": "2026-05-07 09:45:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808119": [
        {
            "ioc_value": "fmnnyp.qen2virex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:40:02",
            "last_seen_utc": "2026-05-07 09:43:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808118": [
        {
            "ioc_value": "proxyss.linkdevbase.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:36:49",
            "last_seen_utc": "2026-05-07 09:41:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808117": [
        {
            "ioc_value": "ciabjdb.mav8loren.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:31:28",
            "last_seen_utc": "2026-05-07 09:32:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808116": [
        {
            "ioc_value": "lanhops.linkdevbase.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:30:01",
            "last_seen_utc": "2026-05-07 09:30:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808115": [
        {
            "ioc_value": "go1d8-core.mav8loren.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:24:28",
            "last_seen_utc": "2026-05-07 09:25:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808114": [
        {
            "ioc_value": "subclis.linkdevbase.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:23:42",
            "last_seen_utc": "2026-05-07 09:24:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808113": [
        {
            "ioc_value": "arkdraor.mav8loren.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:18:09",
            "last_seen_utc": "2026-05-07 09:18:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808112": [
        {
            "ioc_value": "gt5kq695.die-reformer.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:17:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808111": [
        {
            "ioc_value": "ya15z70c.die-reformer.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:17:26",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808110": [
        {
            "ioc_value": "a62fkli6.die-reformer.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:17:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808109": [
        {
            "ioc_value": "bitkits.linkdevbase.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:16:38",
            "last_seen_utc": "2026-05-07 09:18:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808108": [
        {
            "ioc_value": "ultra-narr0.mav8loren.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:11:09",
            "last_seen_utc": "2026-05-07 09:12:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808107": [
        {
            "ioc_value": "envsets.linkdevbase.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:06:09",
            "last_seen_utc": "2026-05-07 09:06:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808105": [
        {
            "ioc_value": "m0del9-spool.mav8loren.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:00:14",
            "last_seen_utc": "2026-05-07 09:00:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808103": [
        {
            "ioc_value": "doclabs.linkdevbase.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:00:05",
            "last_seen_utc": "2026-05-07 09:00:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808104": [
        {
            "ioc_value": "doclabs.linkdevbase.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 09:00:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808102": [
        {
            "ioc_value": "30vw.mav8loren.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:53:26",
            "last_seen_utc": "2026-05-07 08:54:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808101": [
        {
            "ioc_value": "syncits.softworkapi.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:53:21",
            "last_seen_utc": "2026-05-07 08:53:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808100": [
        {
            "ioc_value": "roughvocal.mav8loren.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:47:08",
            "last_seen_utc": "2026-05-07 08:47:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808099": [
        {
            "ioc_value": "ioflows.softworkapi.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:46:15",
            "last_seen_utc": "2026-05-07 08:47:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808098": [
        {
            "ioc_value": "5t4g3-port.3toravix.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:39:41",
            "last_seen_utc": "2026-05-07 08:40:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808097": [
        {
            "ioc_value": "taskids.softworkapi.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:39:24",
            "last_seen_utc": "2026-05-07 08:42:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808096": [
        {
            "ioc_value": "lum-valeon.3toravix.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:31:06",
            "last_seen_utc": "2026-05-07 08:31:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808095": [
        {
            "ioc_value": "comwebs.softworkapi.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:30:43",
            "last_seen_utc": "2026-05-07 08:30:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808094": [
        {
            "ioc_value": "trackeglacie.3toravix.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:24:11",
            "last_seen_utc": "2026-05-07 08:24:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808093": [
        {
            "ioc_value": "refid-xs.softworkapi.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:23:30",
            "last_seen_utc": "2026-05-07 08:24:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808092": [
        {
            "ioc_value": "railmix.3toravix.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:17:25",
            "last_seen_utc": "2026-05-07 08:17:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808091": [
        {
            "ioc_value": "autboxs.softworkapi.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:17:18",
            "last_seen_utc": "2026-05-07 08:17:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808090": [
        {
            "ioc_value": "snowvolt.3toravix.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:11:11",
            "last_seen_utc": "2026-05-07 08:11:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808089": [
        {
            "ioc_value": "domregs.fastexitnow.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:10:04",
            "last_seen_utc": "2026-05-07 08:11:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808088": [
        {
            "ioc_value": "50cia8-route.3toravix.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:04:21",
            "last_seen_utc": "2026-05-07 08:04:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808087": [
        {
            "ioc_value": "pwrlogs.fastexitnow.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 08:03:30",
            "last_seen_utc": "2026-05-07 08:06:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808086": [
        {
            "ioc_value": "tlbwfid.3toravix.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:57:20",
            "last_seen_utc": "2026-05-07 07:57:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808085": [
        {
            "ioc_value": "extnets.fastexitnow.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:54:50",
            "last_seen_utc": "2026-05-07 07:55:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808084": [
        {
            "ioc_value": "gitlabh.fatovism-r2ccoon.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:51:22",
            "last_seen_utc": "2026-05-07 07:52:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808083": [
        {
            "ioc_value": "pkgruns.fastexitnow.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:50:26",
            "last_seen_utc": "2026-05-07 07:50:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808082": [
        {
            "ioc_value": "apiopss.fatovism-r2ccoon.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:44:18",
            "last_seen_utc": "2026-05-07 07:45:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808081": [
        {
            "ioc_value": "modbuss.fastexitnow.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:43:17",
            "last_seen_utc": "2026-05-07 07:43:19",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808078": [
        {
            "ioc_value": "ohn.stainedunstitch.work",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.snappy_client",
            "malware_alias": null,
            "malware_printable": "SnappyClient",
            "first_seen_utc": "2026-05-07 07:42:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/2abbb3f0b3b681365323f0cb088b06258d52d621779aac0bd505abdfed99b201/",
            "tags": "SnappyClient",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808079": [
        {
            "ioc_value": "ootid.srv-auth-dlt-msh.in.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.snappy_client",
            "malware_alias": null,
            "malware_printable": "SnappyClient",
            "first_seen_utc": "2026-05-07 07:42:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/2abbb3f0b3b681365323f0cb088b06258d52d621779aac0bd505abdfed99b201/",
            "tags": "SnappyClient",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808080": [
        {
            "ioc_value": "sash.thirstyschnapps.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.snappy_client",
            "malware_alias": null,
            "malware_printable": "SnappyClient",
            "first_seen_utc": "2026-05-07 07:42:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/2abbb3f0b3b681365323f0cb088b06258d52d621779aac0bd505abdfed99b201/",
            "tags": "SnappyClient",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808077": [
        {
            "ioc_value": "logbins.fatovism-r2ccoon.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:37:53",
            "last_seen_utc": "2026-05-07 07:41:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808076": [
        {
            "ioc_value": "27.124.5.95:886",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2026-05-07 07:37:08",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/ae3ff26fadd67b2c3659c8f0d591edc60bef7cea7d0c915219d567e73c1a745b/",
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808075": [
        {
            "ioc_value": "srcgets.fastexitnow.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:36:44",
            "last_seen_utc": "2026-05-07 07:37:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808074": [
        {
            "ioc_value": "43.199.58.243:8880",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2026-05-07 07:36:30",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/c537ef13a8db150c25e246dda1807e3b36396d4f41a54e3b12d87b57610ff10d/",
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808073": [
        {
            "ioc_value": "cccflknorgnsd.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2026-05-07 07:36:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/c537ef13a8db150c25e246dda1807e3b36396d4f41a54e3b12d87b57610ff10d/",
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808072": [
        {
            "ioc_value": "18.163.249.4:8880",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2026-05-07 07:35:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/cb9b0c1a89b969394804a3fa26db283a75f0e6db4c171544b6056f076ddbf886/",
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808071": [
        {
            "ioc_value": "gimtjks.cn",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2026-05-07 07:34:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/cb9b0c1a89b969394804a3fa26db283a75f0e6db4c171544b6056f076ddbf886/",
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808069": [
        {
            "ioc_value": "hwd.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-07 07:30:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1808070": [
        {
            "ioc_value": "https://hwd.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-07 07:30:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1808068": [
        {
            "ioc_value": "appsrch.fatovism-r2ccoon.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:30:21",
            "last_seen_utc": "2026-05-07 07:33:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808067": [
        {
            "ioc_value": "uidmaps.cloudtaskgo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:30:15",
            "last_seen_utc": "2026-05-07 07:31:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808066": [
        {
            "ioc_value": "http://45.150.66.241/TRANCE",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:25:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808065": [
        {
            "ioc_value": "http://45.150.66.241/NITRO",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:25:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808064": [
        {
            "ioc_value": "http://45.150.66.241/KLOP",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:25:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808063": [
        {
            "ioc_value": "http://45.150.66.241/GETWELL",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:24:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808062": [
        {
            "ioc_value": "http://45.150.66.241/Junilew",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:24:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808061": [
        {
            "ioc_value": "http://45.150.66.241/Hikudip",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:23:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808060": [
        {
            "ioc_value": "ftpsrvs.cloudtaskgo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:23:44",
            "last_seen_utc": "2026-05-07 07:25:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808059": [
        {
            "ioc_value": "http://45.150.66.241/Cucowu",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:23:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808058": [
        {
            "ioc_value": "http://45.150.66.241/Doheku",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:23:04",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808057": [
        {
            "ioc_value": "https://vortexlogicgate.digital/script.sh",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:22:28",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808056": [
        {
            "ioc_value": "webdocs.fatovism-r2ccoon.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:21:17",
            "last_seen_utc": "2026-05-07 07:21:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807920": [
        {
            "ioc_value": "https://s4frlcnoplw.com/d",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-07 07:19:46",
            "last_seen_utc": "2026-05-07 02:11:41",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116529787073941285",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807921": [
        {
            "ioc_value": "s4frlcnoplw.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-07 07:19:46",
            "last_seen_utc": "2026-05-07 02:11:42",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116529787073941285",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807945": [
        {
            "ioc_value": "https://jimbos.com/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.iclickfix",
            "malware_alias": null,
            "malware_printable": "IClickFix",
            "first_seen_utc": "2026-05-07 07:19:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "GeNer8"
        }
    ],
    "1807968": [
        {
            "ioc_value": "https://bgu-uniq.co.il/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:19:45",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/bgu-uniq.co.il",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807978": [
        {
            "ioc_value": "https://coloringonly.com/es/lionel-messi/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:19:44",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/coloringonly.com",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1808055": [
        {
            "ioc_value": "vortexlogicgate.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 07:18:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808054": [
        {
            "ioc_value": "libsyss.cloudtaskgo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:15:27",
            "last_seen_utc": "2026-05-07 07:15:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808053": [
        {
            "ioc_value": "syskeys.fatovism-r2ccoon.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:14:30",
            "last_seen_utc": "2026-05-07 07:15:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808051": [
        {
            "ioc_value": "jobadms.cloudtaskgo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:08:22",
            "last_seen_utc": "2026-05-07 07:08:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808050": [
        {
            "ioc_value": "121.196.170.236:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-07 07:06:46",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,cs-watermark-987654321",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808049": [
        {
            "ioc_value": "8.136.182.237:80",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-07 07:06:23",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,cs-watermark-987654321",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1808048": [
        {
            "ioc_value": "netmans.chemistry5till.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:05:08",
            "last_seen_utc": "2026-05-07 07:09:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808047": [
        {
            "ioc_value": "rawdats.cloudtaskgo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 07:01:57",
            "last_seen_utc": "2026-05-07 07:02:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808046": [
        {
            "ioc_value": "tcpcons.chemistry5till.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:56:44",
            "last_seen_utc": "2026-05-07 06:57:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808045": [
        {
            "ioc_value": "ziparks.cloudtaskgo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:55:14",
            "last_seen_utc": "2026-05-07 06:57:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808044": [
        {
            "ioc_value": "sshpros.chemistry5till.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:50:07",
            "last_seen_utc": "2026-05-07 06:50:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808043": [
        {
            "ioc_value": "osbases.srvappsite.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:48:49",
            "last_seen_utc": "2026-05-07 06:49:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808042": [
        {
            "ioc_value": "vmlists.chemistry5till.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:43:16",
            "last_seen_utc": "2026-05-07 06:43:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808041": [
        {
            "ioc_value": "metalts.srvappsite.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:41:24",
            "last_seen_utc": "2026-05-07 06:42:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808040": [
        {
            "ioc_value": "https://moro4tix.digital/script.sh",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:37:25",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808039": [
        {
            "ioc_value": "moro4tix.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:37:14",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808038": [
        {
            "ioc_value": "usrgrps.chemistry5till.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:36:19",
            "last_seen_utc": "2026-05-07 06:37:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808037": [
        {
            "ioc_value": "https://1ymphstoy.digital/script.sh",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:36:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808036": [
        {
            "ioc_value": "1ymphstoy.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:35:49",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macOS",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808035": [
        {
            "ioc_value": "apidocs.srvappsite.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:34:47",
            "last_seen_utc": "2026-05-07 06:34:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808034": [
        {
            "ioc_value": "optwebs.chemistry5till.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:29:32",
            "last_seen_utc": "2026-05-07 06:30:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808031": [
        {
            "ioc_value": "dbinsts.srvappsite.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:27:21",
            "last_seen_utc": "2026-05-07 06:28:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808030": [
        {
            "ioc_value": "https://goodpix21341.digital/t.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:25:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808029": [
        {
            "ioc_value": "https://goodpix21341.digital/ext.f66368c3907c.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:24:41",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808028": [
        {
            "ioc_value": "https://goodpix21341.digital/ext-b.1c60f323a607.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:24:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808027": [
        {
            "ioc_value": "https://goodpix21341.digital/t.188cfd3975db.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:23:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808026": [
        {
            "ioc_value": "proxyss.smell-chat.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:23:06",
            "last_seen_utc": "2026-05-07 06:24:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808025": [
        {
            "ioc_value": "goodpix21341.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:22:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808024": [
        {
            "ioc_value": "skyvpns.srvappsite.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:21:14",
            "last_seen_utc": "2026-05-07 06:21:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808023": [
        {
            "ioc_value": "https://clacndjsvulnarbi.beer/api/css.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:20:18",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,ErrTraffic",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808022": [
        {
            "ioc_value": "clacndjsvulnarbi.beer",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-07 06:19:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,ErrTraffic",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1808021": [
        {
            "ioc_value": "lanhops.smell-chat.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:16:36",
            "last_seen_utc": "2026-05-07 06:16:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808020": [
        {
            "ioc_value": "cmdsets.srvappsite.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:13:51",
            "last_seen_utc": "2026-05-07 06:14:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808019": [
        {
            "ioc_value": "tmpdirs.boxvpslog.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:06:05",
            "last_seen_utc": "2026-05-07 06:06:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808018": [
        {
            "ioc_value": "subclis.smell-chat.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 06:04:55",
            "last_seen_utc": "2026-05-07 06:05:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808017": [
        {
            "ioc_value": "sshbins.boxvpslog.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:59:11",
            "last_seen_utc": "2026-05-07 05:59:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808016": [
        {
            "ioc_value": "bitkits.smell-chat.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:58:14",
            "last_seen_utc": "2026-05-07 05:58:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808015": [
        {
            "ioc_value": "sslkeys.boxvpslog.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:52:08",
            "last_seen_utc": "2026-05-07 05:54:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808014": [
        {
            "ioc_value": "envsets.smell-chat.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:51:29",
            "last_seen_utc": "2026-05-07 05:52:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808013": [
        {
            "ioc_value": "getcfgs.boxvpslog.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:50:47",
            "last_seen_utc": "2026-05-07 05:51:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808012": [
        {
            "ioc_value": "doclabs.smell-chat.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:44:57",
            "last_seen_utc": "2026-05-07 05:45:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808011": [
        {
            "ioc_value": "ipnodes.boxvpslog.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:44:14",
            "last_seen_utc": "2026-05-07 05:47:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808010": [
        {
            "ioc_value": "syncits.inhum2ntendency.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:37:41",
            "last_seen_utc": "2026-05-07 05:42:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808009": [
        {
            "ioc_value": "hotfixs.boxvpslog.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:35:07",
            "last_seen_utc": "2026-05-07 05:35:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808008": [
        {
            "ioc_value": "ioflows.inhum2ntendency.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:30:14",
            "last_seen_utc": "2026-05-07 05:32:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808007": [
        {
            "ioc_value": "bitfoxs.webbitsync.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:28:34",
            "last_seen_utc": "2026-05-07 05:28:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808006": [
        {
            "ioc_value": "taskids.inhum2ntendency.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:23:34",
            "last_seen_utc": "2026-05-07 05:27:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808005": [
        {
            "ioc_value": "topsvcs.webbitsync.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:21:31",
            "last_seen_utc": "2026-05-07 05:21:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1808004": [
        {
            "ioc_value": "comwebs.inhum2ntendency.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:15:00",
            "last_seen_utc": "2026-05-07 05:19:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1808003": [
        {
            "ioc_value": "opsmgrs.webbitsync.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:14:29",
            "last_seen_utc": "2026-05-07 05:15:05",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808002": [
        {
            "ioc_value": "refid-xs.inhum2ntendency.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:08:03",
            "last_seen_utc": "2026-05-07 05:08:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1808001": [
        {
            "ioc_value": "cpupros.webbitsync.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:07:20",
            "last_seen_utc": "2026-05-07 05:07:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807999": [
        {
            "ioc_value": "autboxs.inhum2ntendency.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:01:01",
            "last_seen_utc": "2026-05-07 05:02:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807998": [
        {
            "ioc_value": "vpsruns.webbitsync.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 05:00:38",
            "last_seen_utc": "2026-05-07 05:00:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807997": [
        {
            "ioc_value": "domregs.hatched-labile.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:54:14",
            "last_seen_utc": "2026-05-07 04:54:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807996": [
        {
            "ioc_value": "dnswebs.webbitsync.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:54:07",
            "last_seen_utc": "2026-05-07 04:54:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807995": [
        {
            "ioc_value": "pwrlogs.hatched-labile.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:47:16",
            "last_seen_utc": "2026-05-07 04:47:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807994": [
        {
            "ioc_value": "appboxs.nethubtop.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:46:38",
            "last_seen_utc": "2026-05-07 04:51:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807993": [
        {
            "ioc_value": "extnets.hatched-labile.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:40:15",
            "last_seen_utc": "2026-05-07 04:41:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807992": [
        {
            "ioc_value": "devbits.nethubtop.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:40:07",
            "last_seen_utc": "2026-05-07 04:40:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807991": [
        {
            "ioc_value": "pkgruns.hatched-labile.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:33:26",
            "last_seen_utc": "2026-05-07 04:33:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807990": [
        {
            "ioc_value": "srvlogs.nethubtop.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:33:04",
            "last_seen_utc": "2026-05-07 04:34:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807989": [
        {
            "ioc_value": "modbuss.hatched-labile.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:26:39",
            "last_seen_utc": "2026-05-07 04:27:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807988": [
        {
            "ioc_value": "netapis.nethubtop.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:26:03",
            "last_seen_utc": "2026-05-07 04:26:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807987": [
        {
            "ioc_value": "srcgets.hatched-labile.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:19:42",
            "last_seen_utc": "2026-05-07 04:20:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807986": [
        {
            "ioc_value": "webcdnx.nethubtop.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:19:26",
            "last_seen_utc": "2026-05-07 04:19:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807985": [
        {
            "ioc_value": "uidmaps.poi5oneducation.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:13:05",
            "last_seen_utc": "2026-05-07 04:13:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807984": [
        {
            "ioc_value": "srvhubs.nethubtop.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:13:03",
            "last_seen_utc": "2026-05-07 04:13:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807983": [
        {
            "ioc_value": "ftpsrvs.poi5oneducation.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 04:04:17",
            "last_seen_utc": "2026-05-07 04:08:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807982": [
        {
            "ioc_value": "libsyss.poi5oneducation.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 03:56:57",
            "last_seen_utc": "2026-05-07 03:57:05",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807981": [
        {
            "ioc_value": "jobadms.poi5oneducation.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 03:50:35",
            "last_seen_utc": "2026-05-07 03:51:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807980": [
        {
            "ioc_value": "rawdats.poi5oneducation.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 03:40:57",
            "last_seen_utc": "2026-05-07 03:45:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807979": [
        {
            "ioc_value": "ziparks.poi5oneducation.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 03:34:07",
            "last_seen_utc": "2026-05-07 03:35:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807977": [
        {
            "ioc_value": "osbases.puerto-ricans.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 03:27:19",
            "last_seen_utc": "2026-05-07 03:28:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807976": [
        {
            "ioc_value": "metalts.puerto-ricans.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 03:20:21",
            "last_seen_utc": "2026-05-07 03:20:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807975": [
        {
            "ioc_value": "apidocs.puerto-ricans.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 03:13:42",
            "last_seen_utc": "2026-05-07 03:14:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807974": [
        {
            "ioc_value": "dbinsts.puerto-ricans.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 03:06:48",
            "last_seen_utc": "2026-05-07 03:07:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807973": [
        {
            "ioc_value": "skyvpns.puerto-ricans.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:58:50",
            "last_seen_utc": "2026-05-07 02:59:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807972": [
        {
            "ioc_value": "cmdsets.puerto-ricans.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:52:05",
            "last_seen_utc": "2026-05-07 02:53:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807971": [
        {
            "ioc_value": "tmpdirs.moto7transport.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:45:10",
            "last_seen_utc": "2026-05-07 02:46:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807970": [
        {
            "ioc_value": "sshbins.moto7transport.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:38:21",
            "last_seen_utc": "2026-05-07 02:39:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807969": [
        {
            "ioc_value": "sslkeys.moto7transport.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:31:53",
            "last_seen_utc": "2026-05-07 02:32:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807967": [
        {
            "ioc_value": "getcfgs.moto7transport.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:25:13",
            "last_seen_utc": "2026-05-07 02:28:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807966": [
        {
            "ioc_value": "ipnodes.moto7transport.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:15:57",
            "last_seen_utc": "2026-05-07 02:16:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807965": [
        {
            "ioc_value": "hotfixs.moto7transport.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:08:06",
            "last_seen_utc": "2026-05-07 02:08:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807964": [
        {
            "ioc_value": "bitfoxs.breasted-skoda.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 02:01:38",
            "last_seen_utc": "2026-05-07 02:02:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807963": [
        {
            "ioc_value": "https://ann.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-07 02:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807962": [
        {
            "ioc_value": "ann.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-07 02:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807961": [
        {
            "ioc_value": "topsvcs.breasted-skoda.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 01:54:57",
            "last_seen_utc": "2026-05-07 01:55:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807960": [
        {
            "ioc_value": "opsmgrs.breasted-skoda.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 01:47:59",
            "last_seen_utc": "2026-05-07 01:48:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807959": [
        {
            "ioc_value": "cpupros.breasted-skoda.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 01:41:26",
            "last_seen_utc": "2026-05-07 01:41:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807958": [
        {
            "ioc_value": "vpsruns.breasted-skoda.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 01:29:43",
            "last_seen_utc": "2026-05-07 01:30:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807957": [
        {
            "ioc_value": "dnswebs.breasted-skoda.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 01:22:47",
            "last_seen_utc": "2026-05-07 01:26:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807956": [
        {
            "ioc_value": "appboxs.mowin8single.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 01:14:31",
            "last_seen_utc": "2026-05-07 01:14:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807955": [
        {
            "ioc_value": "devbits.mowin8single.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 01:07:24",
            "last_seen_utc": "2026-05-07 01:07:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807954": [
        {
            "ioc_value": "srvlogs.mowin8single.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 01:00:21",
            "last_seen_utc": "2026-05-07 01:00:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807953": [
        {
            "ioc_value": "netapis.mowin8single.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 00:51:26",
            "last_seen_utc": "2026-05-07 00:55:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807952": [
        {
            "ioc_value": "webcdnx.mowin8single.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 00:42:13",
            "last_seen_utc": "2026-05-07 00:46:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807951": [
        {
            "ioc_value": "srvhubs.mowin8single.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 00:36:24",
            "last_seen_utc": "2026-05-07 00:36:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807950": [
        {
            "ioc_value": "gitlabh.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 00:30:16",
            "last_seen_utc": "2026-05-07 04:03:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807949": [
        {
            "ioc_value": "apiopss.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 00:23:47",
            "last_seen_utc": "2026-05-07 03:57:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "7May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807948": [
        {
            "ioc_value": "logbins.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 00:18:14",
            "last_seen_utc": "2026-05-07 03:50:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807947": [
        {
            "ioc_value": "appsrch.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 00:12:31",
            "last_seen_utc": "2026-05-07 03:42:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807946": [
        {
            "ioc_value": "webdocs.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-07 00:05:08",
            "last_seen_utc": "2026-05-07 03:34:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807944": [
        {
            "ioc_value": "syskeys.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:59:31",
            "last_seen_utc": "2026-05-07 03:28:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807943": [
        {
            "ioc_value": "netmans.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:54:08",
            "last_seen_utc": "2026-05-07 03:24:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807942": [
        {
            "ioc_value": "tcpcons.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:47:47",
            "last_seen_utc": "2026-05-07 03:13:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807941": [
        {
            "ioc_value": "sshpros.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:40:14",
            "last_seen_utc": "2026-05-07 03:07:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807940": [
        {
            "ioc_value": "vmlists.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:34:31",
            "last_seen_utc": "2026-05-07 02:58:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807939": [
        {
            "ioc_value": "usrgrps.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:28:43",
            "last_seen_utc": "2026-05-07 02:50:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807938": [
        {
            "ioc_value": "optwebs.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:23:16",
            "last_seen_utc": "2026-05-07 02:44:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807937": [
        {
            "ioc_value": "proxyss.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:17:47",
            "last_seen_utc": "2026-05-07 02:37:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807936": [
        {
            "ioc_value": "lanhops.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:11:57",
            "last_seen_utc": "2026-05-07 02:30:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807935": [
        {
            "ioc_value": "subclis.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 23:06:41",
            "last_seen_utc": "2026-05-07 02:23:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807934": [
        {
            "ioc_value": "bitkits.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:59:16",
            "last_seen_utc": "2026-05-07 02:16:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807933": [
        {
            "ioc_value": "envsets.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:53:37",
            "last_seen_utc": "2026-05-07 02:07:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807932": [
        {
            "ioc_value": "doclabs.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:47:24",
            "last_seen_utc": "2026-05-07 01:59:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807931": [
        {
            "ioc_value": "syncits.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:39:45",
            "last_seen_utc": "2026-05-07 01:53:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807930": [
        {
            "ioc_value": "ioflows.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:34:11",
            "last_seen_utc": "2026-05-07 01:46:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807929": [
        {
            "ioc_value": "taskids.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:25:47",
            "last_seen_utc": "2026-05-07 01:39:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807928": [
        {
            "ioc_value": "comwebs.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:18:10",
            "last_seen_utc": "2026-05-07 01:29:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807927": [
        {
            "ioc_value": "refid-xs.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:12:40",
            "last_seen_utc": "2026-05-07 01:20:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807926": [
        {
            "ioc_value": "autboxs.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 22:07:12",
            "last_seen_utc": "2026-05-07 01:09:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807925": [
        {
            "ioc_value": "domregs.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:57:32",
            "last_seen_utc": "2026-05-07 01:02:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807924": [
        {
            "ioc_value": "pwrlogs.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:52:05",
            "last_seen_utc": "2026-05-07 00:55:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807923": [
        {
            "ioc_value": "extnets.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:45:36",
            "last_seen_utc": "2026-05-07 00:52:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807922": [
        {
            "ioc_value": "pkgruns.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:40:06",
            "last_seen_utc": "2026-05-07 00:41:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807919": [
        {
            "ioc_value": "modbuss.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:32:04",
            "last_seen_utc": "2026-05-07 00:36:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807917": [
        {
            "ioc_value": "quickhelp.me",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 21:27:19",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": "",
            "tags": "panel,ScreenConnect",
            "anonymous": "0",
            "reporter": "varysz"
        }
    ],
    "1807918": [
        {
            "ioc_value": "srcgets.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:25:42",
            "last_seen_utc": "2026-05-07 00:29:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807909": [
        {
            "ioc_value": "workplacemeetingconnect.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 21:21:15",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "Fake Zoom,RMM",
            "anonymous": "0",
            "reporter": "varysz"
        }
    ],
    "1807915": [
        {
            "ioc_value": "ck34.site",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 21:21:13",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "skocherhan"
        }
    ],
    "1807916": [
        {
            "ioc_value": "uidmaps.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:17:38",
            "last_seen_utc": "2026-05-07 00:24:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807914": [
        {
            "ioc_value": "gitlabh.filipen-typograp.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:13:06",
            "last_seen_utc": "2026-05-06 21:19:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807913": [
        {
            "ioc_value": "ftpsrvs.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:12:14",
            "last_seen_utc": "2026-05-07 00:16:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807912": [
        {
            "ioc_value": "apiopss.filipen-typograp.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:07:38",
            "last_seen_utc": "2026-05-06 21:07:59",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807911": [
        {
            "ioc_value": "libsyss.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:04:40",
            "last_seen_utc": "2026-05-07 00:11:21",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807910": [
        {
            "ioc_value": "logbins.filipen-typograp.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 21:02:04",
            "last_seen_utc": "2026-05-06 21:02:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807908": [
        {
            "ioc_value": "jobadms.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:56:19",
            "last_seen_utc": "2026-05-07 00:05:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807907": [
        {
            "ioc_value": "appsrch.filipen-typograp.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:55:48",
            "last_seen_utc": "2026-05-06 20:56:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807882": [
        {
            "ioc_value": "http://178.16.55.25/bcbb13c7c8984290857b.php",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2026-05-06 20:53:25",
            "last_seen_utc": "2026-05-07 15:47:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "c2,FFF0506,loader,StealC,stealer",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1807898": [
        {
            "ioc_value": "ctcodein.biz",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.magecart",
            "malware_alias": null,
            "malware_printable": "magecart",
            "first_seen_utc": "2026-05-06 20:53:24",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "Magecart",
            "anonymous": "0",
            "reporter": "varysz"
        }
    ],
    "1807867": [
        {
            "ioc_value": "82.21.7.28:4444",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 20:53:22",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "Remcos,RemcosRAT,Remvio,Socmer",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807868": [
        {
            "ioc_value": "27.102.137.139:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 20:53:22",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "Remcos,RemcosRAT,Remvio,Socmer",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807869": [
        {
            "ioc_value": "145.82.181.191:548",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.extreme_rat",
            "malware_alias": "ExtRat",
            "malware_printable": "Xtreme RAT",
            "first_seen_utc": "2026-05-06 20:53:22",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "ExtRat,Xtreme RAT",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807824": [
        {
            "ioc_value": "https://trackpipe.dev",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 20:53:19",
            "last_seen_utc": "2026-05-07 09:04:44",
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807864": [
        {
            "ioc_value": "192.109.200.154:54984",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.nanocore",
            "malware_alias": "Nancrat,NanoCore",
            "malware_printable": "Nanocore RAT",
            "first_seen_utc": "2026-05-06 20:53:19",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "Nancrat,NanoCore,Nanocore RAT",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807823": [
        {
            "ioc_value": "https://wrat.in:992/sa1at/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:18",
            "last_seen_utc": "2026-05-07 09:05:05",
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://darkatlas.io/blog/salat-stealer-analysis-go-based-rat-c2-resilience-and-info-stealing-capabilities",
            "tags": "Salat Stealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807820": [
        {
            "ioc_value": "mxtestacionamentos.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:17",
            "last_seen_utc": null,
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan",
            "tags": "TCLBANKER",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807822": [
        {
            "ioc_value": "https://salat.cn/sa1at/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:17",
            "last_seen_utc": "2026-05-07 09:05:04",
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://darkatlas.io/blog/salat-stealer-analysis-go-based-rat-c2-resilience-and-info-stealing-capabilities",
            "tags": "Salat Stealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807819": [
        {
            "ioc_value": "campanha1-api.ef971a42.workers.dev",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:16",
            "last_seen_utc": null,
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan",
            "tags": "TCLBANKER",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807817": [
        {
            "ioc_value": "support-onion.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:15",
            "last_seen_utc": null,
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://www.malwarebytes.com/blog/threat-intel/2026/05/attackers-adopt-javascript-runtime-bun-to-spread-nwhstealer",
            "tags": "NWHStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807818": [
        {
            "ioc_value": "https://webhook.site/1d98b695-72df-4e88-885c-5efeb3df75f7",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:15",
            "last_seen_utc": null,
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://opensourcemalware.com/blog/antrea-compromise2",
            "tags": "TeamPCP",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807814": [
        {
            "ioc_value": "uploadfiler.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.chaos",
            "malware_alias": "FakeRyuk,RyukJoke,Yashma",
            "malware_printable": "Chaos",
            "first_seen_utc": "2026-05-06 20:53:14",
            "last_seen_utc": null,
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/",
            "tags": null,
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807815": [
        {
            "ioc_value": "cosmic-nebula.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:14",
            "last_seen_utc": null,
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://www.malwarebytes.com/blog/threat-intel/2026/05/attackers-adopt-javascript-runtime-bun-to-spread-nwhstealer",
            "tags": "NWHStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807816": [
        {
            "ioc_value": "silent-orbit.cc",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:14",
            "last_seen_utc": null,
            "confidence_level": 49,
            "is_compromised": false,
            "reference": "https://www.malwarebytes.com/blog/threat-intel/2026/05/attackers-adopt-javascript-runtime-bun-to-spread-nwhstealer",
            "tags": "NWHStealer",
            "anonymous": "0",
            "reporter": "johannes"
        }
    ],
    "1807773": [
        {
            "ioc_value": "72.5.43.193:8888",
            "ioc_type": "ip:port",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:12",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "autovault,autovault-panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807770": [
        {
            "ioc_value": "3zetr6eb20x.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-06 20:53:10",
            "last_seen_utc": "2026-05-06 20:10:05",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116528472676018155",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807747": [
        {
            "ioc_value": "https://t.me/ax03bot",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.phantom_stealer",
            "malware_alias": null,
            "malware_printable": "Phantom Stealer",
            "first_seen_utc": "2026-05-06 20:53:09",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macos,phantompulse,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807769": [
        {
            "ioc_value": "https://3zetr6eb20x.com/d",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-06 20:53:09",
            "last_seen_utc": "2026-05-06 20:10:05",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116528472676018155",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807745": [
        {
            "ioc_value": "honestly.ink",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phantom_stealer",
            "malware_alias": null,
            "malware_printable": "Phantom Stealer",
            "first_seen_utc": "2026-05-06 20:53:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macos,PhantomPulse,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807746": [
        {
            "ioc_value": "acvgste.club",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phantom_stealer",
            "malware_alias": null,
            "malware_printable": "Phantom Stealer",
            "first_seen_utc": "2026-05-06 20:53:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macos,PhantomPulse,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807744": [
        {
            "ioc_value": "0x666.info",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phantom_stealer",
            "malware_alias": null,
            "malware_printable": "Phantom Stealer",
            "first_seen_utc": "2026-05-06 20:53:06",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macos,PhantomPulse,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807743": [
        {
            "ioc_value": "pla7ina.cfd",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.phantom_stealer",
            "malware_alias": null,
            "malware_printable": "Phantom Stealer",
            "first_seen_utc": "2026-05-06 20:53:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "macos,PhantomPulse,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807661": [
        {
            "ioc_value": "https://selelegroup.co.za/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:53:03",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/selelegroup.co.za",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807679": [
        {
            "ioc_value": "boletukk.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807680": [
        {
            "ioc_value": "trotskxt.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:03",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807681": [
        {
            "ioc_value": "springvc.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807682": [
        {
            "ioc_value": "psychozc.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807683": [
        {
            "ioc_value": "pricelou.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807684": [
        {
            "ioc_value": "strainug.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807685": [
        {
            "ioc_value": "americoq.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807686": [
        {
            "ioc_value": "lyingapy.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807687": [
        {
            "ioc_value": "bactergy.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:53:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807688": [
        {
            "ioc_value": "perfecpl.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:52:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807689": [
        {
            "ioc_value": "granddsd.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:52:58",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807690": [
        {
            "ioc_value": "lovesozp.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:52:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807691": [
        {
            "ioc_value": "oncolonb.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:52:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807692": [
        {
            "ioc_value": "amphibgz.cyou",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:52:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807693": [
        {
            "ioc_value": "mushxhb.best",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:52:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807733": [
        {
            "ioc_value": "134.122.48.21:25001",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "apk.kimwolf",
            "malware_alias": null,
            "malware_printable": "Kimwolf",
            "first_seen_utc": "2026-05-06 20:52:55",
            "last_seen_utc": "2026-05-06 14:42:05",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "c2,Kimwolf",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1807735": [
        {
            "ioc_value": "146.190.18.251:25001",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "apk.kimwolf",
            "malware_alias": null,
            "malware_printable": "Kimwolf",
            "first_seen_utc": "2026-05-06 20:52:54",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "c2,Kimwolf",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1807729": [
        {
            "ioc_value": "cpanel.khomeini.eu.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2026-05-06 20:52:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116528027592965867",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807732": [
        {
            "ioc_value": "167.71.66.3:25001",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "apk.kimwolf",
            "malware_alias": null,
            "malware_printable": "Kimwolf",
            "first_seen_utc": "2026-05-06 20:52:53",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "c2,Kimwolf",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1807694": [
        {
            "ioc_value": "genugsq.best",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-06 20:52:52",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma,windows",
            "anonymous": "0",
            "reporter": "fab0"
        }
    ],
    "1807717": [
        {
            "ioc_value": "https://empretec.co.zw/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 20:52:52",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/empretec.co.zw",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807906": [
        {
            "ioc_value": "45.207.192.190:30078",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 20:45:39",
            "last_seen_utc": "2026-05-07 15:45:00",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807905": [
        {
            "ioc_value": "207.56.226.75:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 20:45:29",
            "last_seen_utc": "2026-05-07 15:44:53",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807904": [
        {
            "ioc_value": "117.72.168.103:16337",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 20:45:09",
            "last_seen_utc": "2026-05-07 15:44:39",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807903": [
        {
            "ioc_value": "static.slbc7890.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 20:44:56",
            "last_seen_utc": "2026-05-07 15:44:30",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807902": [
        {
            "ioc_value": "rawdats.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:42:37",
            "last_seen_utc": "2026-05-06 23:59:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807901": [
        {
            "ioc_value": "webdocs.filipen-typograp.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:40:02",
            "last_seen_utc": "2026-05-06 20:40:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807900": [
        {
            "ioc_value": "ziparks.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:36:55",
            "last_seen_utc": "2026-05-06 23:49:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807899": [
        {
            "ioc_value": "syskeys.filipen-typograp.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:34:21",
            "last_seen_utc": "2026-05-06 20:35:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807897": [
        {
            "ioc_value": "osbases.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:29:15",
            "last_seen_utc": "2026-05-06 23:44:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807896": [
        {
            "ioc_value": "netmans.clampe7outback.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:28:44",
            "last_seen_utc": "2026-05-06 20:29:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807895": [
        {
            "ioc_value": "metalts.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:23:38",
            "last_seen_utc": "2026-05-06 23:38:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807894": [
        {
            "ioc_value": "tcpcons.clampe7outback.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:23:10",
            "last_seen_utc": "2026-05-06 20:24:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807893": [
        {
            "ioc_value": "apidocs.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:17:58",
            "last_seen_utc": "2026-05-06 23:34:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807892": [
        {
            "ioc_value": "sshpros.clampe7outback.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:17:29",
            "last_seen_utc": "2026-05-06 20:18:19",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807891": [
        {
            "ioc_value": "https://leemidtownsalon.com/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 20:15:04",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807890": [
        {
            "ioc_value": "dbinsts.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:12:26",
            "last_seen_utc": "2026-05-06 23:31:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807889": [
        {
            "ioc_value": "vmlists.clampe7outback.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:11:57",
            "last_seen_utc": "2026-05-06 20:12:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807888": [
        {
            "ioc_value": "skyvpns.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:06:46",
            "last_seen_utc": "2026-05-06 23:21:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807887": [
        {
            "ioc_value": "usrgrps.clampe7outback.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:06:14",
            "last_seen_utc": "2026-05-06 20:06:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807886": [
        {
            "ioc_value": "cmdsets.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:01:09",
            "last_seen_utc": "2026-05-06 23:15:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807884": [
        {
            "ioc_value": "optwebs.clampe7outback.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 20:00:38",
            "last_seen_utc": "2026-05-06 20:01:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807885": [
        {
            "ioc_value": "https://ntr.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 20:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807883": [
        {
            "ioc_value": "ntr.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 20:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807881": [
        {
            "ioc_value": "x8jh7qqg.die-reformer.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:57:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807880": [
        {
            "ioc_value": "3ck7o3zl.die-reformer.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:56:31",
            "last_seen_utc": "2026-05-07 09:18:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807879": [
        {
            "ioc_value": "tmpdirs.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:55:29",
            "last_seen_utc": "2026-05-06 23:10:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807878": [
        {
            "ioc_value": "proxyss.captive-portal.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:55:00",
            "last_seen_utc": "2026-05-06 19:55:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807877": [
        {
            "ioc_value": "sshbins.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:49:52",
            "last_seen_utc": "2026-05-06 23:05:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807876": [
        {
            "ioc_value": "lanhops.captive-portal.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:49:22",
            "last_seen_utc": "2026-05-06 19:50:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807875": [
        {
            "ioc_value": "sslkeys.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:44:23",
            "last_seen_utc": "2026-05-06 22:59:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807874": [
        {
            "ioc_value": "subclis.captive-portal.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:43:58",
            "last_seen_utc": "2026-05-06 19:47:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807873": [
        {
            "ioc_value": "getcfgs.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:36:52",
            "last_seen_utc": "2026-05-06 22:52:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807872": [
        {
            "ioc_value": "bitkits.captive-portal.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:36:19",
            "last_seen_utc": "2026-05-06 19:37:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807871": [
        {
            "ioc_value": "ipnodes.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:31:10",
            "last_seen_utc": "2026-05-06 22:49:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807870": [
        {
            "ioc_value": "envsets.captive-portal.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:30:40",
            "last_seen_utc": "2026-05-06 19:31:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807866": [
        {
            "ioc_value": "hotfixs.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:25:32",
            "last_seen_utc": "2026-05-06 22:40:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807865": [
        {
            "ioc_value": "doclabs.captive-portal.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:25:03",
            "last_seen_utc": "2026-05-06 19:27:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807863": [
        {
            "ioc_value": "bitfoxs.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:19:55",
            "last_seen_utc": "2026-05-06 22:34:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807862": [
        {
            "ioc_value": "syncits.academicunmemo7.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:19:29",
            "last_seen_utc": "2026-05-06 19:20:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807861": [
        {
            "ioc_value": "https://johnsinstallations.com/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 19:15:04",
            "last_seen_utc": "2026-05-06 21:30:38",
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807860": [
        {
            "ioc_value": "https://vistarmoney.com/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 19:15:02",
            "last_seen_utc": "2026-05-06 21:30:37",
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807859": [
        {
            "ioc_value": "topsvcs.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:14:17",
            "last_seen_utc": "2026-05-06 22:25:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807858": [
        {
            "ioc_value": "ioflows.academicunmemo7.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:13:49",
            "last_seen_utc": "2026-05-06 19:14:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807857": [
        {
            "ioc_value": "opsmgrs.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:08:49",
            "last_seen_utc": "2026-05-06 22:22:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807856": [
        {
            "ioc_value": "taskids.academicunmemo7.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:08:23",
            "last_seen_utc": "2026-05-06 19:09:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807855": [
        {
            "ioc_value": "cpupros.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:02:54",
            "last_seen_utc": "2026-05-06 22:13:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807854": [
        {
            "ioc_value": "comwebs.academicunmemo7.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 19:02:33",
            "last_seen_utc": "2026-05-06 19:02:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807853": [
        {
            "ioc_value": "vpsruns.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:57:03",
            "last_seen_utc": "2026-05-06 22:07:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807852": [
        {
            "ioc_value": "refid-xs.academicunmemo7.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:56:41",
            "last_seen_utc": "2026-05-06 18:58:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807851": [
        {
            "ioc_value": "dnswebs.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:51:11",
            "last_seen_utc": "2026-05-06 21:57:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807850": [
        {
            "ioc_value": "autboxs.academicunmemo7.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:50:50",
            "last_seen_utc": "2026-05-06 18:55:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807849": [
        {
            "ioc_value": "appboxs.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:45:21",
            "last_seen_utc": "2026-05-06 21:51:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807848": [
        {
            "ioc_value": "domregs.cobble-mortgag.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:44:55",
            "last_seen_utc": "2026-05-06 18:45:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807846": [
        {
            "ioc_value": "5.101.86.102:2501",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 18:44:01",
            "last_seen_utc": "2026-05-07 15:44:08",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807847": [
        {
            "ioc_value": "5.101.86.107:4934",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 18:44:01",
            "last_seen_utc": "2026-05-07 15:44:08",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807845": [
        {
            "ioc_value": "31.57.216.62:14641",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 18:43:51",
            "last_seen_utc": "2026-05-07 15:43:55",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807844": [
        {
            "ioc_value": "192.109.200.143:2345",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 18:43:26",
            "last_seen_utc": "2026-05-07 15:43:28",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "AsyncRAT,drb-ra,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807843": [
        {
            "ioc_value": "178.16.52.203:1889",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2026-05-06 18:43:21",
            "last_seen_utc": "2026-05-07 15:43:22",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "DCRat,drb-ra,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807842": [
        {
            "ioc_value": "154.18.238.18:8848",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2026-05-06 18:43:14",
            "last_seen_utc": "2026-05-07 15:43:15",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "DCRat,drb-ra,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807841": [
        {
            "ioc_value": "104.194.157.45:7001",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2026-05-06 18:43:05",
            "last_seen_utc": "2026-05-07 15:43:05",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "DCRat,drb-ra,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807840": [
        {
            "ioc_value": "pwrlogs.cobble-mortgag.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:39:07",
            "last_seen_utc": "2026-05-06 18:42:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807839": [
        {
            "ioc_value": "devbits.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:35:11",
            "last_seen_utc": "2026-05-06 21:46:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807838": [
        {
            "ioc_value": "extnets.cobble-mortgag.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:33:37",
            "last_seen_utc": "2026-05-06 18:38:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807837": [
        {
            "ioc_value": "srvlogs.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:29:30",
            "last_seen_utc": "2026-05-06 21:43:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807836": [
        {
            "ioc_value": "pkgruns.cobble-mortgag.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:27:59",
            "last_seen_utc": "2026-05-06 18:29:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807835": [
        {
            "ioc_value": "netapis.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:23:55",
            "last_seen_utc": "2026-05-06 21:32:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807834": [
        {
            "ioc_value": "modbuss.cobble-mortgag.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:22:22",
            "last_seen_utc": "2026-05-06 18:23:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807833": [
        {
            "ioc_value": "webcdnx.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:18:14",
            "last_seen_utc": "2026-05-06 21:25:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807832": [
        {
            "ioc_value": "srcgets.cobble-mortgag.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:16:43",
            "last_seen_utc": "2026-05-06 18:17:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807831": [
        {
            "ioc_value": "https://alexanderkeller.ch/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 18:15:02",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807830": [
        {
            "ioc_value": "srvhubs.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:12:38",
            "last_seen_utc": "2026-05-06 21:20:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807829": [
        {
            "ioc_value": "uidmaps.setting5hoo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:11:04",
            "last_seen_utc": "2026-05-06 18:14:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807828": [
        {
            "ioc_value": "ftpsrvs.setting5hoo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 18:03:26",
            "last_seen_utc": "2026-05-06 18:04:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807827": [
        {
            "ioc_value": "libsyss.setting5hoo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:57:46",
            "last_seen_utc": "2026-05-06 17:58:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807826": [
        {
            "ioc_value": "jobadms.setting5hoo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:52:10",
            "last_seen_utc": "2026-05-06 17:53:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807825": [
        {
            "ioc_value": "meta-narr0.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:47:02",
            "last_seen_utc": "2026-05-06 17:48:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807821": [
        {
            "ioc_value": "rawdats.setting5hoo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:46:34",
            "last_seen_utc": "2026-05-06 17:47:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807813": [
        {
            "ioc_value": "itfr9qb.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:41:23",
            "last_seen_utc": "2026-05-06 17:42:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807812": [
        {
            "ioc_value": "ziparks.setting5hoo.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:40:54",
            "last_seen_utc": "2026-05-06 17:42:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807811": [
        {
            "ioc_value": "primeproxy.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:35:46",
            "last_seen_utc": "2026-05-06 17:36:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807810": [
        {
            "ioc_value": "osbases.jesuit5itny.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:31:06",
            "last_seen_utc": "2026-05-06 17:31:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807809": [
        {
            "ioc_value": "axwq1.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:30:05",
            "last_seen_utc": "2026-05-06 17:31:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807808": [
        {
            "ioc_value": "metalts.jesuit5itny.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:25:32",
            "last_seen_utc": "2026-05-06 17:26:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807807": [
        {
            "ioc_value": "solven9ix.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:24:32",
            "last_seen_utc": "2026-05-06 17:28:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807806": [
        {
            "ioc_value": "apidocs.jesuit5itny.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:19:46",
            "last_seen_utc": "2026-05-06 17:23:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807805": [
        {
            "ioc_value": "ivorywol.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:16:41",
            "last_seen_utc": "2026-05-06 17:17:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807804": [
        {
            "ioc_value": "dbinsts.jesuit5itny.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:12:06",
            "last_seen_utc": "2026-05-06 17:12:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807803": [
        {
            "ioc_value": "quorlith0or.sorix7el.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:11:04",
            "last_seen_utc": "2026-05-06 17:11:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807802": [
        {
            "ioc_value": "skyvpns.jesuit5itny.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:06:29",
            "last_seen_utc": "2026-05-06 17:07:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807801": [
        {
            "ioc_value": "lan39-trail.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:05:25",
            "last_seen_utc": "2026-05-06 17:06:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807800": [
        {
            "ioc_value": "cmdsets.jesuit5itny.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 17:00:50",
            "last_seen_utc": "2026-05-06 17:02:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807799": [
        {
            "ioc_value": "arra-track.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:59:48",
            "last_seen_utc": "2026-05-06 17:00:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807798": [
        {
            "ioc_value": "tmpdirs.stick-shaped.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:55:11",
            "last_seen_utc": "2026-05-06 16:56:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807797": [
        {
            "ioc_value": "decoderunway.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:54:15",
            "last_seen_utc": "2026-05-06 16:55:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807795": [
        {
            "ioc_value": "sshbins.stick-shaped.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:49:35",
            "last_seen_utc": "2026-05-06 16:50:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807794": [
        {
            "ioc_value": "lischorus.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:48:34",
            "last_seen_utc": "2026-05-06 16:52:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807793": [
        {
            "ioc_value": "68.64.178.130:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:54",
            "last_seen_utc": "2026-05-07 15:45:14",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807792": [
        {
            "ioc_value": "39.101.78.48:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:44",
            "last_seen_utc": "2026-05-07 15:44:57",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807791": [
        {
            "ioc_value": "124.223.90.150:80",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:32",
            "last_seen_utc": "2026-05-07 15:44:44",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807789": [
        {
            "ioc_value": "103.53.81.232:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:24",
            "last_seen_utc": "2026-05-07 15:44:34",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807790": [
        {
            "ioc_value": "103.53.81.232:80",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:24",
            "last_seen_utc": "2026-05-07 15:44:35",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807788": [
        {
            "ioc_value": "1.15.100.187:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:22",
            "last_seen_utc": "2026-05-07 15:44:32",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807787": [
        {
            "ioc_value": "www.pronhub.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:21",
            "last_seen_utc": "2026-05-07 15:44:32",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807786": [
        {
            "ioc_value": "update.javashell.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:20",
            "last_seen_utc": "2026-05-07 15:44:31",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807783": [
        {
            "ioc_value": "1325813086-kvn4jlpgeu.ap-shanghai.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:13",
            "last_seen_utc": "2026-05-07 15:44:23",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807784": [
        {
            "ioc_value": "1364170351-ivarm6apjz.ap-guangzhou.tencentscf.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:13",
            "last_seen_utc": "2026-05-07 15:44:23",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807785": [
        {
            "ioc_value": "4176rbz8vepn6.cfc-execute.bj.baidubce.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 16:44:13",
            "last_seen_utc": "2026-05-07 15:44:23",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807782": [
        {
            "ioc_value": "sslkeys.stick-shaped.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:44:03",
            "last_seen_utc": "2026-05-06 16:45:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807781": [
        {
            "ioc_value": "faithfultin.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:40:53",
            "last_seen_utc": "2026-05-06 16:41:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807780": [
        {
            "ioc_value": "getcfgs.stick-shaped.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:38:20",
            "last_seen_utc": "2026-05-06 16:40:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807779": [
        {
            "ioc_value": "glofabric.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:35:20",
            "last_seen_utc": "2026-05-06 16:38:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807778": [
        {
            "ioc_value": "ipnodes.stick-shaped.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:32:45",
            "last_seen_utc": "2026-05-06 16:36:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807777": [
        {
            "ioc_value": "enwz.5dorexin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:25:39",
            "last_seen_utc": "2026-05-06 16:28:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807776": [
        {
            "ioc_value": "hotfixs.stick-shaped.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:25:15",
            "last_seen_utc": "2026-05-06 16:28:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807775": [
        {
            "ioc_value": "validatorpolar.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:17:23",
            "last_seen_utc": "2026-05-06 16:19:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807774": [
        {
            "ioc_value": "bitfoxs.lyasi-special.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:13:16",
            "last_seen_utc": "2026-05-06 16:19:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807772": [
        {
            "ioc_value": "r3lay-branch.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:07:52",
            "last_seen_utc": "2026-05-06 16:09:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807771": [
        {
            "ioc_value": "topsvcs.lyasi-special.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:07:25",
            "last_seen_utc": "2026-05-06 16:08:13",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807768": [
        {
            "ioc_value": "rurareag.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:02:05",
            "last_seen_utc": "2026-05-06 16:04:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807767": [
        {
            "ioc_value": "opsmgrs.lyasi-special.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 16:01:36",
            "last_seen_utc": "2026-05-06 16:02:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807766": [
        {
            "ioc_value": "ffjc9r7.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:56:09",
            "last_seen_utc": "2026-05-06 16:01:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807765": [
        {
            "ioc_value": "cpupros.lyasi-special.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:55:46",
            "last_seen_utc": "2026-05-06 15:56:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807764": [
        {
            "ioc_value": "eqdq.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:50:26",
            "last_seen_utc": "2026-05-06 15:51:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807763": [
        {
            "ioc_value": "vpsruns.lyasi-special.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:50:03",
            "last_seen_utc": "2026-05-06 15:50:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807762": [
        {
            "ioc_value": "mnepohui.sbs",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown_webinject",
            "malware_alias": null,
            "malware_printable": "Unknown Webinject",
            "first_seen_utc": "2026-05-06 15:49:12",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ErrTraffic",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807761": [
        {
            "ioc_value": "m08xkitq.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:44:09",
            "last_seen_utc": "2026-05-06 15:44:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807760": [
        {
            "ioc_value": "dnswebs.lyasi-special.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:43:48",
            "last_seen_utc": "2026-05-06 15:44:13",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807759": [
        {
            "ioc_value": "nornex8et.vexon4al.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:37:58",
            "last_seen_utc": "2026-05-06 15:38:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807758": [
        {
            "ioc_value": "appboxs.ascenderviinka.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:37:36",
            "last_seen_utc": "2026-05-06 15:38:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807757": [
        {
            "ioc_value": "mvx23.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:31:45",
            "last_seen_utc": "2026-05-06 15:32:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807756": [
        {
            "ioc_value": "devbits.ascenderviinka.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:31:23",
            "last_seen_utc": "2026-05-06 15:32:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807755": [
        {
            "ioc_value": "https://zdc.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 15:30:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807754": [
        {
            "ioc_value": "zdc.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 15:30:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807753": [
        {
            "ioc_value": "iwr5wtk.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:25:34",
            "last_seen_utc": "2026-05-06 15:27:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807752": [
        {
            "ioc_value": "srvlogs.ascenderviinka.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:25:11",
            "last_seen_utc": "2026-05-06 15:25:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807751": [
        {
            "ioc_value": "sol-tidea.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:17:05",
            "last_seen_utc": "2026-05-06 15:18:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807750": [
        {
            "ioc_value": "netapis.ascenderviinka.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:14:39",
            "last_seen_utc": "2026-05-06 15:18:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807749": [
        {
            "ioc_value": "lumnexum4.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:06:50",
            "last_seen_utc": "2026-05-06 15:07:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807748": [
        {
            "ioc_value": "webcdnx.ascenderviinka.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:06:22",
            "last_seen_utc": "2026-05-06 15:07:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807742": [
        {
            "ioc_value": "trinex7is.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:00:37",
            "last_seen_utc": "2026-05-06 15:01:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807741": [
        {
            "ioc_value": "srvhubs.ascenderviinka.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 15:00:21",
            "last_seen_utc": "2026-05-06 15:00:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807740": [
        {
            "ioc_value": "scenwave.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:53:55",
            "last_seen_utc": "2026-05-06 14:54:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807739": [
        {
            "ioc_value": "bs3qkgdh.pav8lorex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:48:22",
            "last_seen_utc": "2026-05-06 14:50:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807738": [
        {
            "ioc_value": "dynmarkar8.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:42:39",
            "last_seen_utc": "2026-05-06 14:47:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807737": [
        {
            "ioc_value": "juixt9f.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:35:36",
            "last_seen_utc": "2026-05-06 14:35:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807736": [
        {
            "ioc_value": "metricregistry.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:29:27",
            "last_seen_utc": "2026-05-06 14:31:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807734": [
        {
            "ioc_value": "root-cul.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:23:41",
            "last_seen_utc": "2026-05-06 14:27:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807731": [
        {
            "ioc_value": "d3c0de-scope.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:16:05",
            "last_seen_utc": "2026-05-06 14:16:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807730": [
        {
            "ioc_value": "5cri-logic.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:10:22",
            "last_seen_utc": "2026-05-06 14:12:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807728": [
        {
            "ioc_value": "fvde.xamir3on.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 14:04:45",
            "last_seen_utc": "2026-05-06 14:09:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807727": [
        {
            "ioc_value": "load-port.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:52:58",
            "last_seen_utc": "2026-05-06 13:54:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807726": [
        {
            "ioc_value": "jrlcxt.zooblob.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:50:36",
            "last_seen_utc": "2026-05-06 13:53:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807725": [
        {
            "ioc_value": "trivaleum8.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:45:04",
            "last_seen_utc": "2026-05-06 13:46:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807724": [
        {
            "ioc_value": "sprounite.zooblob.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:44:41",
            "last_seen_utc": "2026-05-06 13:49:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807723": [
        {
            "ioc_value": "liche3-wave.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:39:16",
            "last_seen_utc": "2026-05-06 13:39:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807722": [
        {
            "ioc_value": "freightbird.rodrules.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:38:48",
            "last_seen_utc": "2026-05-06 13:40:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807721": [
        {
            "ioc_value": "eciepxlt.solid5lowly.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:34:57",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807720": [
        {
            "ioc_value": "5l2tqw0c.solid5lowly.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:33:51",
            "last_seen_utc": "2026-05-06 13:35:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807719": [
        {
            "ioc_value": "ohkmpt.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:33:24",
            "last_seen_utc": "2026-05-06 13:34:19",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807718": [
        {
            "ioc_value": "alt-me4sure.rodrules.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:32:59",
            "last_seen_utc": "2026-05-06 13:33:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807716": [
        {
            "ioc_value": "5dk-array.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:27:08",
            "last_seen_utc": "2026-05-06 13:28:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807715": [
        {
            "ioc_value": "cirshift.portcry.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:26:46",
            "last_seen_utc": "2026-05-06 13:30:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807714": [
        {
            "ioc_value": "duskamp.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:19:26",
            "last_seen_utc": "2026-05-06 13:20:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807713": [
        {
            "ioc_value": "hypersprout.portcry.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:18:33",
            "last_seen_utc": "2026-05-06 13:20:05",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807712": [
        {
            "ioc_value": "104.194.132.27:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2026-05-06 13:16:23",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/5387372b2ac54854b8e99201675221e3e477a924bc767b9cb247fb516c9ef4dc/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807711": [
        {
            "ioc_value": "wolfcri.tavro6xel.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:13:35",
            "last_seen_utc": "2026-05-06 13:14:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807710": [
        {
            "ioc_value": "targetcel.plsqlnew.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:12:42",
            "last_seen_utc": "2026-05-06 13:13:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807709": [
        {
            "ioc_value": "vorcore5ex.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:07:47",
            "last_seen_utc": "2026-05-06 13:08:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807708": [
        {
            "ioc_value": "nortideis9.plsqlnew.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:06:54",
            "last_seen_utc": "2026-05-06 13:07:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807707": [
        {
            "ioc_value": "wintersubtle.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:01:55",
            "last_seen_utc": "2026-05-06 13:03:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807706": [
        {
            "ioc_value": "lummarkex8.noopcup.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 13:01:00",
            "last_seen_utc": "2026-05-06 13:02:21",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807705": [
        {
            "ioc_value": "lz96krml.shim-windless.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:57:01",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807704": [
        {
            "ioc_value": "normeshon6.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:56:04",
            "last_seen_utc": "2026-05-06 12:56:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807703": [
        {
            "ioc_value": "kw5f4rxy.shim-windless.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:55:07",
            "last_seen_utc": "2026-05-06 12:55:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807702": [
        {
            "ioc_value": "8rvi.noopcup.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:54:44",
            "last_seen_utc": "2026-05-06 12:55:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807701": [
        {
            "ioc_value": "quornexal.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:50:48",
            "last_seen_utc": "2026-05-06 12:53:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807700": [
        {
            "ioc_value": "pine5-vector.godjava.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:49:19",
            "last_seen_utc": "2026-05-06 12:53:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807699": [
        {
            "ioc_value": "sudclient.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:44:50",
            "last_seen_utc": "2026-05-06 12:50:59",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807698": [
        {
            "ioc_value": "arkvenex1.godjava.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:43:04",
            "last_seen_utc": "2026-05-06 12:50:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807697": [
        {
            "ioc_value": "cnybvst9.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:41:43",
            "last_seen_utc": "2026-05-06 12:46:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807696": [
        {
            "ioc_value": "handlerharvest.fewhtml.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:37:18",
            "last_seen_utc": "2026-05-06 12:45:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807695": [
        {
            "ioc_value": "pack-bar.1zorelin.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:34:42",
            "last_seen_utc": "2026-05-06 12:44:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807678": [
        {
            "ioc_value": "xscciae7.fewhtml.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:31:24",
            "last_seen_utc": "2026-05-06 12:43:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807677": [
        {
            "ioc_value": "fxfa.dbuswet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:26:56",
            "last_seen_utc": "2026-05-06 12:34:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807676": [
        {
            "ioc_value": "subt13-flow.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:25:58",
            "last_seen_utc": "2026-05-06 12:35:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807675": [
        {
            "ioc_value": "fl4me-field.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:11:52",
            "last_seen_utc": "2026-05-06 12:25:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807674": [
        {
            "ioc_value": "v0lt-sync.dbuswet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:09:38",
            "last_seen_utc": "2026-05-06 12:24:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807673": [
        {
            "ioc_value": "nrbxi7.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:06:21",
            "last_seen_utc": "2026-05-06 12:23:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807672": [
        {
            "ioc_value": "wfvof3o.boxemoj.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 12:04:06",
            "last_seen_utc": "2026-05-06 12:21:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807671": [
        {
            "ioc_value": "ipni4.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:59:49",
            "last_seen_utc": "2026-05-06 12:19:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807670": [
        {
            "ioc_value": "gnqv4r.boxemoj.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:57:36",
            "last_seen_utc": "2026-05-06 12:14:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807669": [
        {
            "ioc_value": "vxbe.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:52:12",
            "last_seen_utc": "2026-05-06 11:57:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807668": [
        {
            "ioc_value": "lwbc.actsdks.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:52:05",
            "last_seen_utc": "2026-05-06 11:53:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807667": [
        {
            "ioc_value": "xttbd.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:46:45",
            "last_seen_utc": "2026-05-06 11:49:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807666": [
        {
            "ioc_value": "kelfluxum.actsdks.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:46:36",
            "last_seen_utc": "2026-05-06 11:49:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807665": [
        {
            "ioc_value": "5udd-signal.qen9varol.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:40:33",
            "last_seen_utc": "2026-05-06 11:41:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807664": [
        {
            "ioc_value": "res.cargowhy.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:40:04",
            "last_seen_utc": "2026-05-06 11:45:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807663": [
        {
            "ioc_value": "buffer-switch.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:34:42",
            "last_seen_utc": "2026-05-06 11:36:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807662": [
        {
            "ioc_value": "dnv.tonmixin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:34:34",
            "last_seen_utc": "2026-05-06 11:35:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807660": [
        {
            "ioc_value": "signalenzy.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:27:09",
            "last_seen_utc": "2026-05-06 11:32:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807659": [
        {
            "ioc_value": "resolvrou.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:21:49",
            "last_seen_utc": "2026-05-06 11:22:05",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807658": [
        {
            "ioc_value": "povver4-pulse.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:16:03",
            "last_seen_utc": "2026-05-06 11:17:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807657": [
        {
            "ioc_value": "gozozk.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:10:38",
            "last_seen_utc": "2026-05-06 11:15:13",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807656": [
        {
            "ioc_value": "srvhubs.tonmixin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:10:15",
            "last_seen_utc": "2026-05-06 11:11:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807655": [
        {
            "ioc_value": "webcdnx.tonmixin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:04:33",
            "last_seen_utc": "2026-05-06 11:05:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807654": [
        {
            "ioc_value": "tridraor.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 11:02:23",
            "last_seen_utc": "2026-05-06 11:06:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807653": [
        {
            "ioc_value": "netapis.tonmixin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:59:04",
            "last_seen_utc": "2026-05-06 11:01:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807652": [
        {
            "ioc_value": "imagedraw.mav2lirex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:55:26",
            "last_seen_utc": "2026-05-06 10:55:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807651": [
        {
            "ioc_value": "srvlogs.tonmixin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:52:54",
            "last_seen_utc": "2026-05-06 10:57:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807650": [
        {
            "ioc_value": "http://110.40.181.138:14433/IIsX",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 10:50:52",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/123b6141959b472dbbf2f0e8fd0d1316d35866efe23ce8a354e3b0dacafa8fde/",
            "tags": "cobaltstrike",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807649": [
        {
            "ioc_value": "neotcdk.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:50:03",
            "last_seen_utc": "2026-05-06 10:50:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807648": [
        {
            "ioc_value": "devbits.tonmixin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:46:45",
            "last_seen_utc": "2026-05-06 10:47:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807647": [
        {
            "ioc_value": "sp4rk-plate.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:43:44",
            "last_seen_utc": "2026-05-06 10:46:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807646": [
        {
            "ioc_value": "appboxs.tonmixin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:40:50",
            "last_seen_utc": "2026-05-06 10:43:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807645": [
        {
            "ioc_value": "ieke13.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:35:28",
            "last_seen_utc": "2026-05-06 10:35:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807644": [
        {
            "ioc_value": "dnswebs.sixunzip.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:33:14",
            "last_seen_utc": "2026-05-06 10:33:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807643": [
        {
            "ioc_value": "93.127.214.44:7802",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:29:59",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807642": [
        {
            "ioc_value": "losslvs.surf",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:29:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807641": [
        {
            "ioc_value": "138.68.148.118:8299",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:28:59",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807640": [
        {
            "ioc_value": "solidgma.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:28:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807639": [
        {
            "ioc_value": "68.183.161.221:4895",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:27:21",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807638": [
        {
            "ioc_value": "vpsruns.sixunzip.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:27:07",
            "last_seen_utc": "2026-05-06 10:27:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807635": [
        {
            "ioc_value": "outcrol.biz",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:26:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807636": [
        {
            "ioc_value": "odoriu.shop",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:26:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807637": [
        {
            "ioc_value": "thread-mark.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:26:51",
            "last_seen_utc": "2026-05-06 10:27:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807634": [
        {
            "ioc_value": "hgt3.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:19:00",
            "last_seen_utc": "2026-05-06 10:19:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807633": [
        {
            "ioc_value": "cpupros.sixunzip.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:18:55",
            "last_seen_utc": "2026-05-06 10:19:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807632": [
        {
            "ioc_value": "havelbeenpwned.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:18:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/75fce6ec4b0815d7ccc9d87c2687c3c379c8e446739b3302b72688dd632c9f9e/",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807608": [
        {
            "ioc_value": "https://activebridgehub.top/metrics/health-build.php",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-06 10:14:34",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116527076503041248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807609": [
        {
            "ioc_value": "activebridgehub.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-06 10:14:34",
            "last_seen_utc": "2026-05-06 10:08:05",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116527076503041248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807610": [
        {
            "ioc_value": "https://activebridgehub.top/metrics/signup-dom.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-06 10:14:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116527076503041248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807611": [
        {
            "ioc_value": "https://futurebuildsystem.com/yolodo",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-06 10:14:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116527076503041248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807612": [
        {
            "ioc_value": "futurebuildsystem.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-06 10:14:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116527076503041248",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807631": [
        {
            "ioc_value": "mlbft.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:14:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807630": [
        {
            "ioc_value": "splitfleet.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:12:45",
            "last_seen_utc": "2026-05-06 10:13:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807629": [
        {
            "ioc_value": "opsmgrs.sixunzip.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:12:27",
            "last_seen_utc": "2026-05-06 10:12:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807617": [
        {
            "ioc_value": "dubaitrades.duckdns.org",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.xworm",
            "malware_alias": null,
            "malware_printable": "XWorm",
            "first_seen_utc": "2026-05-06 10:10:46",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/b0479587dda76317e2e2261984b0522ce0f4e08d2b9093414618c6cbdf7ace6c/",
            "tags": "xworm",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807613": [
        {
            "ioc_value": "maxhealthinsadvantage.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:09:51",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807607": [
        {
            "ioc_value": "alfeeha.online",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:07:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807606": [
        {
            "ioc_value": "195.201.103.159:9403",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remus",
            "malware_alias": null,
            "malware_printable": "Remus",
            "first_seen_utc": "2026-05-06 10:07:40",
            "last_seen_utc": "2026-05-06 10:11:13",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "RemusStealer",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807605": [
        {
            "ioc_value": "vel-nexon.7toralex.lat",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:07:00",
            "last_seen_utc": "2026-05-06 10:07:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807604": [
        {
            "ioc_value": "topsvcs.sixunzip.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:06:39",
            "last_seen_utc": "2026-05-06 10:07:13",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807603": [
        {
            "ioc_value": "203.91.74.204:4499",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2026-05-06 10:06:16",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807602": [
        {
            "ioc_value": "103.215.77.17:5000",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.valley_rat",
            "malware_alias": "Winos",
            "malware_printable": "ValleyRAT",
            "first_seen_utc": "2026-05-06 10:06:13",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "RAT,ValleyRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807601": [
        {
            "ioc_value": "http://ce419619.tw1.ru/L1nc0In.php",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.dcrat",
            "malware_alias": "DarkCrystal RAT",
            "malware_printable": "DCRat",
            "first_seen_utc": "2026-05-06 10:06:10",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "DCRat,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807600": [
        {
            "ioc_value": "172.111.232.239:29810",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 10:06:08",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807599": [
        {
            "ioc_value": "45.131.46.14:20167",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2026-05-06 10:06:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "NjRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807598": [
        {
            "ioc_value": "103.78.0.204:30014",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.njrat",
            "malware_alias": "Bladabindi,Lime-Worm",
            "malware_printable": "NjRAT",
            "first_seen_utc": "2026-05-06 10:06:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "NjRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807567": [
        {
            "ioc_value": "gitlabh.ultrashiftnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:01:47",
            "last_seen_utc": "2026-05-06 10:02:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807548": [
        {
            "ioc_value": "empretec.co.zw",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.iclickfix",
            "malware_alias": null,
            "malware_printable": "IClickFix",
            "first_seen_utc": "2026-05-06 10:01:00",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "",
            "tags": "ClickFix",
            "anonymous": "1",
            "reporter": "crocodilepuppy"
        }
    ],
    "1807549": [
        {
            "ioc_value": "91.92.34.76:443",
            "ioc_type": "ip:port",
            "threat_type": "payload_delivery",
            "malware": "js.iclickfix",
            "malware_alias": null,
            "malware_printable": "IClickFix",
            "first_seen_utc": "2026-05-06 10:00:59",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": null,
            "anonymous": "1",
            "reporter": "crocodilepuppy"
        }
    ],
    "1807566": [
        {
            "ioc_value": "bitfoxs.sixunzip.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 10:00:39",
            "last_seen_utc": "2026-05-06 10:02:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807564": [
        {
            "ioc_value": "som.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 10:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807565": [
        {
            "ioc_value": "https://som.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 10:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807563": [
        {
            "ioc_value": "apiopss.ultrashiftnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:55:13",
            "last_seen_utc": "2026-05-06 09:56:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807562": [
        {
            "ioc_value": "hotfixs.cargowhy.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:54:46",
            "last_seen_utc": "2026-05-06 09:55:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807561": [
        {
            "ioc_value": "logbins.ultrashiftnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:41:08",
            "last_seen_utc": "2026-05-06 09:46:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807560": [
        {
            "ioc_value": "ipnodes.cargowhy.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:39:29",
            "last_seen_utc": "2026-05-06 09:40:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807559": [
        {
            "ioc_value": "appsrch.ultrashiftnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:35:23",
            "last_seen_utc": "2026-05-06 09:36:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807558": [
        {
            "ioc_value": "getcfgs.cargowhy.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:33:25",
            "last_seen_utc": "2026-05-06 09:36:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807557": [
        {
            "ioc_value": "webdocs.ultrashiftnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:29:59",
            "last_seen_utc": "2026-05-06 09:30:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807556": [
        {
            "ioc_value": "sslkeys.cargowhy.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:25:25",
            "last_seen_utc": "2026-05-06 09:29:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807555": [
        {
            "ioc_value": "syskeys.ultrashiftnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:19:20",
            "last_seen_utc": "2026-05-06 09:20:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807554": [
        {
            "ioc_value": "sshbins.cargowhy.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:17:04",
            "last_seen_utc": "2026-05-06 09:17:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807553": [
        {
            "ioc_value": "netmans.cybermetagrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:11:42",
            "last_seen_utc": "2026-05-06 09:12:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807552": [
        {
            "ioc_value": "tmpdirs.cargowhy.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:11:34",
            "last_seen_utc": "2026-05-06 09:12:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807551": [
        {
            "ioc_value": "tcpcons.cybermetagrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:06:15",
            "last_seen_utc": "2026-05-06 09:06:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807550": [
        {
            "ioc_value": "cmdsets.nodespit.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:05:36",
            "last_seen_utc": "2026-05-06 09:09:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807547": [
        {
            "ioc_value": "sshpros.cybermetagrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 09:00:07",
            "last_seen_utc": "2026-05-06 09:01:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807546": [
        {
            "ioc_value": "skyvpns.nodespit.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:57:28",
            "last_seen_utc": "2026-05-06 08:57:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807523": [
        {
            "ioc_value": "http://114.132.190.121:8888/supershell/login/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 08:56:17",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "AS45090,Shenzhen Tencent Computer Systems Company Limited,supershell",
            "anonymous": "0",
            "reporter": "antiphishorg"
        }
    ],
    "1807545": [
        {
            "ioc_value": "vmlists.cybermetagrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:54:37",
            "last_seen_utc": "2026-05-06 08:54:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807544": [
        {
            "ioc_value": "dbinsts.nodespit.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:51:21",
            "last_seen_utc": "2026-05-06 08:51:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807543": [
        {
            "ioc_value": "usrgrps.cybermetagrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:46:25",
            "last_seen_utc": "2026-05-06 08:51:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807542": [
        {
            "ioc_value": "apidocs.nodespit.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:45:54",
            "last_seen_utc": "2026-05-06 08:46:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807540": [
        {
            "ioc_value": "5.101.86.41:2428",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 08:44:09",
            "last_seen_utc": "2026-05-07 15:44:09",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807541": [
        {
            "ioc_value": "5.101.86.41:6448",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 08:44:09",
            "last_seen_utc": "2026-05-07 15:44:09",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807539": [
        {
            "ioc_value": "5.101.86.104:1334",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 08:44:08",
            "last_seen_utc": "2026-05-07 15:44:08",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807538": [
        {
            "ioc_value": "31.57.184.154:7707",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 08:43:54",
            "last_seen_utc": "2026-05-07 15:43:54",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "AsyncRAT,drb-ra,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807537": [
        {
            "ioc_value": "optwebs.cybermetagrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:40:34",
            "last_seen_utc": "2026-05-06 08:41:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807536": [
        {
            "ioc_value": "metalts.nodespit.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:39:44",
            "last_seen_utc": "2026-05-06 08:40:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807535": [
        {
            "ioc_value": "proxyss.quantumtechbox.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:35:10",
            "last_seen_utc": "2026-05-06 08:35:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807534": [
        {
            "ioc_value": "osbases.nodespit.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:33:58",
            "last_seen_utc": "2026-05-06 08:35:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807533": [
        {
            "ioc_value": "lanhops.quantumtechbox.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:29:46",
            "last_seen_utc": "2026-05-06 08:30:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807532": [
        {
            "ioc_value": "apiopss.zooblob.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:29:33",
            "last_seen_utc": "2026-05-06 08:29:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807531": [
        {
            "ioc_value": "subclis.quantumtechbox.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:24:00",
            "last_seen_utc": "2026-05-06 08:24:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807530": [
        {
            "ioc_value": "logbins.zooblob.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:23:40",
            "last_seen_utc": "2026-05-06 08:24:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807529": [
        {
            "ioc_value": "bitkits.quantumtechbox.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:18:40",
            "last_seen_utc": "2026-05-06 08:18:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807528": [
        {
            "ioc_value": "appsrch.zooblob.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:17:33",
            "last_seen_utc": "2026-05-06 08:18:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807527": [
        {
            "ioc_value": "envsets.quantumtechbox.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:12:10",
            "last_seen_utc": "2026-05-06 08:13:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807526": [
        {
            "ioc_value": "webdocs.zooblob.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:12:02",
            "last_seen_utc": "2026-05-06 08:15:13",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807525": [
        {
            "ioc_value": "doclabs.quantumtechbox.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:04:26",
            "last_seen_utc": "2026-05-06 08:04:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807524": [
        {
            "ioc_value": "syskeys.zooblob.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 08:03:22",
            "last_seen_utc": "2026-05-06 08:04:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807522": [
        {
            "ioc_value": "syncits.primeflowspace.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:57:41",
            "last_seen_utc": "2026-05-06 07:58:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807521": [
        {
            "ioc_value": "netmans.rodrules.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:57:34",
            "last_seen_utc": "2026-05-06 07:57:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807520": [
        {
            "ioc_value": "tcpcons.rodrules.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:51:31",
            "last_seen_utc": "2026-05-06 07:54:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807519": [
        {
            "ioc_value": "ioflows.primeflowspace.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:51:29",
            "last_seen_utc": "2026-05-06 07:52:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807518": [
        {
            "ioc_value": "91.92.241.8:3000",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.pure_rat",
            "malware_alias": "PureHVNC,ResolverRAT",
            "malware_printable": "PureRAT",
            "first_seen_utc": "2026-05-06 07:45:48",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "https://bazaar.abuse.ch/sample/6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2/",
            "tags": "PureHVNC,PureRAT,RAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807517": [
        {
            "ioc_value": "taskids.primeflowspace.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:42:49",
            "last_seen_utc": "2026-05-06 07:43:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807516": [
        {
            "ioc_value": "sshpros.rodrules.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:42:41",
            "last_seen_utc": "2026-05-06 07:42:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807515": [
        {
            "ioc_value": "comwebs.primeflowspace.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:36:32",
            "last_seen_utc": "2026-05-06 07:37:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807514": [
        {
            "ioc_value": "vmlists.rodrules.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:36:02",
            "last_seen_utc": "2026-05-06 07:36:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807513": [
        {
            "ioc_value": "refid-xs.primeflowspace.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:30:36",
            "last_seen_utc": "2026-05-06 07:31:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807512": [
        {
            "ioc_value": "usrgrps.rodrules.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:29:58",
            "last_seen_utc": "2026-05-06 07:33:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807511": [
        {
            "ioc_value": "autboxs.primeflowspace.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:20:04",
            "last_seen_utc": "2026-05-06 07:20:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807510": [
        {
            "ioc_value": "optwebs.rodrules.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:19:13",
            "last_seen_utc": "2026-05-06 07:20:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807509": [
        {
            "ioc_value": "domregs.masterlogicgrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:13:56",
            "last_seen_utc": "2026-05-06 07:15:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807508": [
        {
            "ioc_value": "proxyss.portcry.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:13:36",
            "last_seen_utc": "2026-05-06 07:14:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807506": [
        {
            "ioc_value": "pwrlogs.masterlogicgrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:08:09",
            "last_seen_utc": "2026-05-06 07:08:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807505": [
        {
            "ioc_value": "lanhops.portcry.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:07:10",
            "last_seen_utc": "2026-05-06 07:08:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807504": [
        {
            "ioc_value": "extnets.masterlogicgrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 07:00:02",
            "last_seen_utc": "2026-05-06 07:01:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807503": [
        {
            "ioc_value": "subclis.portcry.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:59:40",
            "last_seen_utc": "2026-05-06 07:00:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807502": [
        {
            "ioc_value": "https://truitpix9871.world/ext.f66368c3907c.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:54:33",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1807501": [
        {
            "ioc_value": "https://truitpix9871.world/ext-b.1c60f323a607.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:53:55",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1807500": [
        {
            "ioc_value": "pkgruns.masterlogicgrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:53:35",
            "last_seen_utc": "2026-05-06 06:58:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807499": [
        {
            "ioc_value": "bitkits.portcry.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:53:26",
            "last_seen_utc": "2026-05-06 06:53:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807498": [
        {
            "ioc_value": "https://truitpix9871.world/t.188cfd3975db.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:52:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1807497": [
        {
            "ioc_value": "https://truitpix9871.world/t.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:52:05",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1807496": [
        {
            "ioc_value": "truitpix9871.world",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:51:50",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,EXT",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1807495": [
        {
            "ioc_value": "modbuss.masterlogicgrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:48:09",
            "last_seen_utc": "2026-05-06 06:48:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807494": [
        {
            "ioc_value": "envsets.portcry.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:47:19",
            "last_seen_utc": "2026-05-06 06:48:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807493": [
        {
            "ioc_value": "srcgets.masterlogicgrid.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:41:59",
            "last_seen_utc": "2026-05-06 06:42:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807492": [
        {
            "ioc_value": "doclabs.portcry.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:41:39",
            "last_seen_utc": "2026-05-06 06:41:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807491": [
        {
            "ioc_value": "uidmaps.infinitynodesys.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:36:22",
            "last_seen_utc": "2026-05-06 06:36:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807490": [
        {
            "ioc_value": "syncits.plsqlnew.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:35:44",
            "last_seen_utc": "2026-05-06 06:36:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807489": [
        {
            "ioc_value": "ftpsrvs.infinitynodesys.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:30:04",
            "last_seen_utc": "2026-05-06 06:30:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807488": [
        {
            "ioc_value": "ioflows.plsqlnew.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:29:23",
            "last_seen_utc": "2026-05-06 06:30:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807487": [
        {
            "ioc_value": "libsyss.infinitynodesys.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:23:41",
            "last_seen_utc": "2026-05-06 06:24:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807486": [
        {
            "ioc_value": "taskids.plsqlnew.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:23:14",
            "last_seen_utc": "2026-05-06 06:23:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807485": [
        {
            "ioc_value": "jobadms.infinitynodesys.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:18:09",
            "last_seen_utc": "2026-05-06 06:21:05",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807484": [
        {
            "ioc_value": "comwebs.plsqlnew.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:17:16",
            "last_seen_utc": "2026-05-06 06:19:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807483": [
        {
            "ioc_value": "refid-xs.plsqlnew.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:07:40",
            "last_seen_utc": "2026-05-06 06:08:19",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807482": [
        {
            "ioc_value": "rawdats.infinitynodesys.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:04:27",
            "last_seen_utc": "2026-05-06 06:04:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807481": [
        {
            "ioc_value": "autboxs.plsqlnew.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 06:02:03",
            "last_seen_utc": "2026-05-06 06:03:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807170": [
        {
            "ioc_value": "https://www.bursanehirteknik.com/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:44",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/www.bursanehirteknik.com",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807171": [
        {
            "ioc_value": "https://www.refinishfirst.net/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:43",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/www.refinishfirst.net",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807172": [
        {
            "ioc_value": "https://caliphlebotomy.com/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:43",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/caliphlebotomy.com",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807176": [
        {
            "ioc_value": "151.236.4.149:80",
            "ioc_type": "ip:port",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "ClickFix,msiexec-webdav,msxns-peer,us-com-rotation",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807177": [
        {
            "ioc_value": "msnvm.us.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:42",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "ClickFix,msiexec-webdav,msxns-peer,us-com-rotation",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807196": [
        {
            "ioc_value": "https://www.gavpn.com/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:42",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/www.gavpn.com",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807226": [
        {
            "ioc_value": "https://dvxfigqyzgd.com/d",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-06 06:01:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116523671127878874",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807227": [
        {
            "ioc_value": "dvxfigqyzgd.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-06 06:01:39",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116523671127878874",
            "tags": "KongTuke",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807234": [
        {
            "ioc_value": "http://202.61.137.210:8888/supershell/login/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "AS152194,CTG Server Limited,supershell",
            "anonymous": "0",
            "reporter": "antiphishorg"
        }
    ],
    "1807235": [
        {
            "ioc_value": "202.61.137.210:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:37",
            "last_seen_utc": "2026-05-05 20:09:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "AS152194,CTG Server Limited,supershell",
            "anonymous": "0",
            "reporter": "antiphishorg"
        }
    ],
    "1807244": [
        {
            "ioc_value": "114.132.190.121:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:36",
            "last_seen_utc": "2026-05-06 08:00:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "supershell",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807245": [
        {
            "ioc_value": "194.246.83.43:9000",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.sectop_rat",
            "malware_alias": "1xxbot,ArechClient",
            "malware_printable": "SectopRAT",
            "first_seen_utc": "2026-05-06 06:01:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "1xxbot,ArechClient,SectopRAT",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807246": [
        {
            "ioc_value": "151.59.139.193:8080",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.sectop_rat",
            "malware_alias": "1xxbot,ArechClient",
            "malware_printable": "SectopRAT",
            "first_seen_utc": "2026-05-06 06:01:35",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "1xxbot,ArechClient,SectopRAT",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807247": [
        {
            "ioc_value": "145.241.198.20:80",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:34",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "unam,webpanel",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807248": [
        {
            "ioc_value": "103.82.193.51:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-06 06:01:34",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "Remcos,RemcosRAT,Remvio,Socmer",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807250": [
        {
            "ioc_value": "109.123.239.180:12345",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:34",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "NetBus,Shodan,unkown",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807252": [
        {
            "ioc_value": "104.249.10.115:80",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:33",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": "",
            "tags": "hookbot,panel",
            "anonymous": "0",
            "reporter": "whoamix302"
        }
    ],
    "1807273": [
        {
            "ioc_value": "204.10.194.247:8765",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:32",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://medium.com/@nijina7/the-ghost-in-the-forge-a-deep-dive-analysis-of-the-forge-jsxy-multi-platform-rat-eee92c07fb4b",
            "tags": "infostealer,malware,rat",
            "anonymous": "0",
            "reporter": "Nijin"
        }
    ],
    "1807274": [
        {
            "ioc_value": "204.10.194.247:9877",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:31",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://medium.com/@nijina7/the-ghost-in-the-forge-a-deep-dive-analysis-of-the-forge-jsxy-multi-platform-rat-eee92c07fb4b",
            "tags": "infostealer,malware,rat",
            "anonymous": "0",
            "reporter": "Nijin"
        }
    ],
    "1807277": [
        {
            "ioc_value": "193.143.1.186:80",
            "ioc_type": "ip:port",
            "threat_type": "payload_delivery",
            "malware": "win.sectop_rat",
            "malware_alias": "1xxbot,ArechClient",
            "malware_printable": "SectopRAT",
            "first_seen_utc": "2026-05-06 06:01:30",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://www.virustotal.com/gui/file/2400f3b6e9ad53e8740d29028b48c35e241976ef2667d4540ddc36407f00de08/behavior",
            "tags": "backdoor,evasive,infostealer,powershell",
            "anonymous": "1",
            "reporter": "Anongamer"
        }
    ],
    "1807278": [
        {
            "ioc_value": "https://sendmay.icu/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.sectop_rat",
            "malware_alias": "1xxbot,ArechClient",
            "malware_printable": "SectopRAT",
            "first_seen_utc": "2026-05-06 06:01:29",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://www.virustotal.com/gui/url/a8254d768386c2a08d7b32ba14dc9dbf879f60fa07478ba4cd76d7814b1ed349",
            "tags": "evasive,infostealer,powershell,renengine,sectoprat",
            "anonymous": "1",
            "reporter": "Anongamer"
        }
    ],
    "1807321": [
        {
            "ioc_value": "https://redsbuilding.com.au/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:26",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/redsbuilding.com.au",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807358": [
        {
            "ioc_value": "43.128.27.124:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 06:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "132203,c2,censys,cobalt strike",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807359": [
        {
            "ioc_value": "3.88.6.51:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-06 06:01:25",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "14618,c2,censys,cobalt strike",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807360": [
        {
            "ioc_value": "80.76.49.130:4444",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.meterpreter",
            "malware_alias": null,
            "malware_printable": "Meterpreter",
            "first_seen_utc": "2026-05-06 06:01:24",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "399486,c2,censys,metasploit",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807361": [
        {
            "ioc_value": "142.202.188.247:8808",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 06:01:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "398019,asyncrat,c2,censys",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807362": [
        {
            "ioc_value": "13.124.36.100:34289",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.meterpreter",
            "malware_alias": null,
            "malware_printable": "Meterpreter",
            "first_seen_utc": "2026-05-06 06:01:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "16509,c2,censys,metasploit",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807363": [
        {
            "ioc_value": "45.83.31.43:8080",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 06:01:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "210558,asyncrat,c2,censys",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807364": [
        {
            "ioc_value": "77.93.152.138:8808",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 06:01:23",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "401479,asyncrat,c2,censys",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807365": [
        {
            "ioc_value": "192.109.200.143:6606",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 06:01:22",
            "last_seen_utc": "2026-05-07 15:43:28",
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "51396,asyncrat,c2,censys",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807366": [
        {
            "ioc_value": "46.246.4.17:1000",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 06:01:22",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "42708,asyncrat,c2,censys",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807367": [
        {
            "ioc_value": "111.170.164.98:8443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2026-05-06 06:01:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "151185,c2,censys,quasar",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807368": [
        {
            "ioc_value": "51.85.62.142:1521",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.meterpreter",
            "malware_alias": null,
            "malware_printable": "Meterpreter",
            "first_seen_utc": "2026-05-06 06:01:21",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "16509,c2,censys,metasploit",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807369": [
        {
            "ioc_value": "176.65.132.246:9999",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.quasar_rat",
            "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil",
            "malware_printable": "Quasar RAT",
            "first_seen_utc": "2026-05-06 06:01:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "51396,c2,censys,quasar",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807370": [
        {
            "ioc_value": "192.109.200.143:7707",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.asyncrat",
            "malware_alias": null,
            "malware_printable": "AsyncRAT",
            "first_seen_utc": "2026-05-06 06:01:18",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": null,
            "tags": "51396,asyncrat,c2,censys",
            "anonymous": "0",
            "reporter": "sojubear"
        }
    ],
    "1807400": [
        {
            "ioc_value": "179.43.140.114:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807401": [
        {
            "ioc_value": "155.2.192.215:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:17",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807402": [
        {
            "ioc_value": "96.9.124.111:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:16",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807403": [
        {
            "ioc_value": "45.156.87.8:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:16",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807404": [
        {
            "ioc_value": "45.87.249.150:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:15",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807405": [
        {
            "ioc_value": "139.60.162.100:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:15",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807407": [
        {
            "ioc_value": "178.16.52.152:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:14",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807406": [
        {
            "ioc_value": "54.39.30.233:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:13",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807408": [
        {
            "ioc_value": "178.16.55.242:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:12",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807409": [
        {
            "ioc_value": "158.94.211.237:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:11",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807410": [
        {
            "ioc_value": "158.94.209.188:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:11",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807411": [
        {
            "ioc_value": "158.94.208.34:8888",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:10",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "2026-05-05-discovery,autovault,bulletproof-hosting,hijackloader-related,unknown_panel",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807431": [
        {
            "ioc_value": "https://goatcouture.org/wordpress/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:10",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/goatcouture.org",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807432": [
        {
            "ioc_value": "https://newmaritime.ch/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:09",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/newmaritime.ch",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807433": [
        {
            "ioc_value": "https://bg-transparency.online/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:09",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/bg-transparency.online",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807434": [
        {
            "ioc_value": "https://ai-detect.online/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-06 06:01:08",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/ai-detect.online",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807480": [
        {
            "ioc_value": "domregs.noopcup.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:55:30",
            "last_seen_utc": "2026-05-06 06:00:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807479": [
        {
            "ioc_value": "ziparks.infinitynodesys.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:51:57",
            "last_seen_utc": "2026-05-06 05:56:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807478": [
        {
            "ioc_value": "pwrlogs.noopcup.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:49:39",
            "last_seen_utc": "2026-05-06 05:50:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807477": [
        {
            "ioc_value": "osbases.technovortexhub.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:44:18",
            "last_seen_utc": "2026-05-06 05:45:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807476": [
        {
            "ioc_value": "extnets.noopcup.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:43:50",
            "last_seen_utc": "2026-05-06 05:44:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807475": [
        {
            "ioc_value": "metalts.technovortexhub.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:38:48",
            "last_seen_utc": "2026-05-06 05:39:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807474": [
        {
            "ioc_value": "pkgruns.noopcup.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:38:03",
            "last_seen_utc": "2026-05-06 05:38:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807473": [
        {
            "ioc_value": "apidocs.technovortexhub.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:32:44",
            "last_seen_utc": "2026-05-06 05:33:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807472": [
        {
            "ioc_value": "modbuss.noopcup.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:32:13",
            "last_seen_utc": "2026-05-06 05:33:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807471": [
        {
            "ioc_value": "dbinsts.technovortexhub.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:27:23",
            "last_seen_utc": "2026-05-06 05:27:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807470": [
        {
            "ioc_value": "srcgets.noopcup.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:26:31",
            "last_seen_utc": "2026-05-06 05:27:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807469": [
        {
            "ioc_value": "skyvpns.technovortexhub.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:21:17",
            "last_seen_utc": "2026-05-06 05:21:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807468": [
        {
            "ioc_value": "uidmaps.godjava.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:20:33",
            "last_seen_utc": "2026-05-06 05:23:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807467": [
        {
            "ioc_value": "cmdsets.technovortexhub.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:15:42",
            "last_seen_utc": "2026-05-06 05:16:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807466": [
        {
            "ioc_value": "ftpsrvs.godjava.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:14:38",
            "last_seen_utc": "2026-05-06 05:19:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807465": [
        {
            "ioc_value": "tmpdirs.globaldatastack.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:08:39",
            "last_seen_utc": "2026-05-06 05:09:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807464": [
        {
            "ioc_value": "libsyss.godjava.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:08:11",
            "last_seen_utc": "2026-05-06 05:09:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807463": [
        {
            "ioc_value": "sshbins.globaldatastack.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:03:02",
            "last_seen_utc": "2026-05-06 05:03:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807462": [
        {
            "ioc_value": "jobadms.godjava.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 05:02:28",
            "last_seen_utc": "2026-05-06 05:07:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807461": [
        {
            "ioc_value": "sslkeys.globaldatastack.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:56:52",
            "last_seen_utc": "2026-05-06 04:58:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807460": [
        {
            "ioc_value": "rawdats.godjava.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:56:21",
            "last_seen_utc": "2026-05-06 04:56:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807459": [
        {
            "ioc_value": "getcfgs.globaldatastack.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:51:09",
            "last_seen_utc": "2026-05-06 04:52:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807458": [
        {
            "ioc_value": "ziparks.godjava.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:51:00",
            "last_seen_utc": "2026-05-06 04:51:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807457": [
        {
            "ioc_value": "ipnodes.globaldatastack.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:45:32",
            "last_seen_utc": "2026-05-06 04:45:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807456": [
        {
            "ioc_value": "osbases.fewhtml.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:44:21",
            "last_seen_utc": "2026-05-06 04:47:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807455": [
        {
            "ioc_value": "hotfixs.globaldatastack.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:36:46",
            "last_seen_utc": "2026-05-06 04:37:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807454": [
        {
            "ioc_value": "metalts.fewhtml.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:36:36",
            "last_seen_utc": "2026-05-06 04:36:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807453": [
        {
            "ioc_value": "bitfoxs.securelinkpoint.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:30:48",
            "last_seen_utc": "2026-05-06 04:31:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807452": [
        {
            "ioc_value": "apidocs.fewhtml.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:30:37",
            "last_seen_utc": "2026-05-06 04:31:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807451": [
        {
            "ioc_value": "topsvcs.securelinkpoint.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:25:03",
            "last_seen_utc": "2026-05-06 04:25:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807450": [
        {
            "ioc_value": "dbinsts.fewhtml.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:24:48",
            "last_seen_utc": "2026-05-06 04:25:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807449": [
        {
            "ioc_value": "opsmgrs.securelinkpoint.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:19:45",
            "last_seen_utc": "2026-05-06 04:21:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807448": [
        {
            "ioc_value": "skyvpns.fewhtml.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:18:37",
            "last_seen_utc": "2026-05-06 04:19:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807447": [
        {
            "ioc_value": "cpupros.securelinkpoint.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:13:54",
            "last_seen_utc": "2026-05-06 04:18:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807446": [
        {
            "ioc_value": "cmdsets.fewhtml.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:12:57",
            "last_seen_utc": "2026-05-06 04:13:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807445": [
        {
            "ioc_value": "vpsruns.securelinkpoint.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:07:14",
            "last_seen_utc": "2026-05-06 04:08:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807444": [
        {
            "ioc_value": "tmpdirs.dbuswet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:06:58",
            "last_seen_utc": "2026-05-06 04:07:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807443": [
        {
            "ioc_value": "dnswebs.securelinkpoint.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:01:14",
            "last_seen_utc": "2026-05-06 04:03:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807442": [
        {
            "ioc_value": "sshbins.dbuswet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 04:01:02",
            "last_seen_utc": "2026-05-06 04:01:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807441": [
        {
            "ioc_value": "sslkeys.dbuswet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:53:41",
            "last_seen_utc": "2026-05-06 03:53:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807440": [
        {
            "ioc_value": "appboxs.digitalcloudnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:52:18",
            "last_seen_utc": "2026-05-06 03:53:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807439": [
        {
            "ioc_value": "getcfgs.dbuswet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:47:54",
            "last_seen_utc": "2026-05-06 03:48:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807438": [
        {
            "ioc_value": "devbits.digitalcloudnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:46:26",
            "last_seen_utc": "2026-05-06 03:47:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807437": [
        {
            "ioc_value": "ipnodes.dbuswet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:41:56",
            "last_seen_utc": "2026-05-06 03:42:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807436": [
        {
            "ioc_value": "srvlogs.digitalcloudnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:35:54",
            "last_seen_utc": "2026-05-06 03:36:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807435": [
        {
            "ioc_value": "hotfixs.dbuswet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:35:32",
            "last_seen_utc": "2026-05-06 03:39:04",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807430": [
        {
            "ioc_value": "netapis.digitalcloudnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:27:59",
            "last_seen_utc": "2026-05-06 03:28:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807429": [
        {
            "ioc_value": "bitfoxs.boxemoj.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:27:46",
            "last_seen_utc": "2026-05-06 03:28:21",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807428": [
        {
            "ioc_value": "webcdnx.digitalcloudnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:22:19",
            "last_seen_utc": "2026-05-06 03:22:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807427": [
        {
            "ioc_value": "topsvcs.boxemoj.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:21:55",
            "last_seen_utc": "2026-05-06 03:21:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807425": [
        {
            "ioc_value": "srvhubs.digitalcloudnet.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:15:53",
            "last_seen_utc": "2026-05-06 03:17:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807424": [
        {
            "ioc_value": "opsmgrs.boxemoj.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:15:40",
            "last_seen_utc": "2026-05-06 03:16:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807423": [
        {
            "ioc_value": "gitlab.sorix2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:10:00",
            "last_seen_utc": "2026-05-06 03:10:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807422": [
        {
            "ioc_value": "cpupros.boxemoj.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:09:33",
            "last_seen_utc": "2026-05-06 03:10:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807421": [
        {
            "ioc_value": "apiops.sorix2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:04:48",
            "last_seen_utc": "2026-05-06 03:05:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807420": [
        {
            "ioc_value": "vpsruns.boxemoj.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 03:04:04",
            "last_seen_utc": "2026-05-06 03:04:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807419": [
        {
            "ioc_value": "logbin.sorix2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:58:12",
            "last_seen_utc": "2026-05-06 02:59:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807418": [
        {
            "ioc_value": "dnswebs.boxemoj.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:57:34",
            "last_seen_utc": "2026-05-06 03:01:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807417": [
        {
            "ioc_value": "appsrc.sorix2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:51:36",
            "last_seen_utc": "2026-05-06 02:52:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807416": [
        {
            "ioc_value": "appboxs.actsdks.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:51:08",
            "last_seen_utc": "2026-05-06 02:53:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807415": [
        {
            "ioc_value": "webdoc.sorix2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:45:46",
            "last_seen_utc": "2026-05-06 02:47:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807414": [
        {
            "ioc_value": "devbits.actsdks.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:45:37",
            "last_seen_utc": "2026-05-06 02:50:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807413": [
        {
            "ioc_value": "syskey.sorix2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:39:39",
            "last_seen_utc": "2026-05-06 02:40:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807412": [
        {
            "ioc_value": "srvlogs.actsdks.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:39:08",
            "last_seen_utc": "2026-05-06 02:40:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807399": [
        {
            "ioc_value": "net-man.8dorexin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:33:36",
            "last_seen_utc": "2026-05-06 02:33:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807398": [
        {
            "ioc_value": "netapis.actsdks.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:33:31",
            "last_seen_utc": "2026-05-06 02:34:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807397": [
        {
            "ioc_value": "tcp-con.8dorexin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:27:13",
            "last_seen_utc": "2026-05-06 02:28:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807396": [
        {
            "ioc_value": "webcdnx.actsdks.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:27:05",
            "last_seen_utc": "2026-05-06 02:28:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807395": [
        {
            "ioc_value": "ssh-pro.8dorexin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:21:42",
            "last_seen_utc": "2026-05-06 02:22:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807394": [
        {
            "ioc_value": "srvhubs.actsdks.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:20:35",
            "last_seen_utc": "2026-05-06 02:21:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807393": [
        {
            "ioc_value": "vm-list.8dorexin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:15:11",
            "last_seen_utc": "2026-05-06 02:15:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807392": [
        {
            "ioc_value": "gitlabh.lorex7in.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:15:06",
            "last_seen_utc": "2026-05-06 02:17:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807391": [
        {
            "ioc_value": "usr-grp.8dorexin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:06:35",
            "last_seen_utc": "2026-05-06 02:08:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807390": [
        {
            "ioc_value": "apiopss.lorex7in.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 02:06:27",
            "last_seen_utc": "2026-05-06 02:08:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807389": [
        {
            "ioc_value": "opt-web.8dorexin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:59:41",
            "last_seen_utc": "2026-05-06 02:00:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807388": [
        {
            "ioc_value": "logbins.lorex7in.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:57:49",
            "last_seen_utc": "2026-05-06 02:00:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807387": [
        {
            "ioc_value": "proxys.vexon4al.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:54:00",
            "last_seen_utc": "2026-05-06 01:54:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807385": [
        {
            "ioc_value": "appsrch.lorex7in.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:52:22",
            "last_seen_utc": "2026-05-06 01:53:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807386": [
        {
            "ioc_value": "appsrch.lorex7in.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:52:22",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807384": [
        {
            "ioc_value": "lanhop.vexon4al.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:48:04",
            "last_seen_utc": "2026-05-06 01:48:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807383": [
        {
            "ioc_value": "webdocs.lorex7in.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:45:53",
            "last_seen_utc": "2026-05-06 01:46:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807382": [
        {
            "ioc_value": "subcli.vexon4al.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:42:21",
            "last_seen_utc": "2026-05-06 01:42:41",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807381": [
        {
            "ioc_value": "syskeys.lorex7in.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:40:08",
            "last_seen_utc": "2026-05-06 01:40:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807380": [
        {
            "ioc_value": "bitkit.vexon4al.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:37:12",
            "last_seen_utc": "2026-05-06 01:37:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807379": [
        {
            "ioc_value": "netmans.mel2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:34:15",
            "last_seen_utc": "2026-05-06 01:35:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807378": [
        {
            "ioc_value": "envset.vexon4al.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:31:04",
            "last_seen_utc": "2026-05-06 01:31:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807377": [
        {
            "ioc_value": "tcpcons.mel2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:28:26",
            "last_seen_utc": "2026-05-06 01:29:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807376": [
        {
            "ioc_value": "doclab.vexon4al.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:25:09",
            "last_seen_utc": "2026-05-06 01:25:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807375": [
        {
            "ioc_value": "sshpros.mel2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:20:43",
            "last_seen_utc": "2026-05-06 01:21:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807374": [
        {
            "ioc_value": "syncit.pav3lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:19:24",
            "last_seen_utc": "2026-05-06 01:20:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807373": [
        {
            "ioc_value": "vmlists.mel2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:15:00",
            "last_seen_utc": "2026-05-06 01:15:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807372": [
        {
            "ioc_value": "ioflow.pav3lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:13:59",
            "last_seen_utc": "2026-05-06 01:14:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807371": [
        {
            "ioc_value": "usrgrps.mel2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:08:39",
            "last_seen_utc": "2026-05-06 01:09:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807357": [
        {
            "ioc_value": "task-id.pav3lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:04:11",
            "last_seen_utc": "2026-05-06 01:04:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807356": [
        {
            "ioc_value": "optwebs.mel2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 01:02:49",
            "last_seen_utc": "2026-05-06 01:03:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807355": [
        {
            "ioc_value": "com-web.pav3lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:58:28",
            "last_seen_utc": "2026-05-06 00:59:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807354": [
        {
            "ioc_value": "proxyss.sorix9el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:56:48",
            "last_seen_utc": "2026-05-06 00:57:56",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807353": [
        {
            "ioc_value": "refid-x.pav3lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:52:31",
            "last_seen_utc": "2026-05-06 00:53:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807352": [
        {
            "ioc_value": "lanhops.sorix9el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:51:21",
            "last_seen_utc": "2026-05-06 00:51:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807351": [
        {
            "ioc_value": "autbox.pav3lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:47:07",
            "last_seen_utc": "2026-05-06 00:47:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807350": [
        {
            "ioc_value": "subclis.sorix9el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:45:46",
            "last_seen_utc": "2026-05-06 00:46:09",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807349": [
        {
            "ioc_value": "dom-reg.xamir9on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:40:40",
            "last_seen_utc": "2026-05-06 00:41:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807348": [
        {
            "ioc_value": "bitkits.sorix9el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:39:30",
            "last_seen_utc": "2026-05-06 00:39:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807347": [
        {
            "ioc_value": "pwr-log.xamir9on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:35:02",
            "last_seen_utc": "2026-05-06 00:35:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807346": [
        {
            "ioc_value": "envsets.sorix9el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:33:29",
            "last_seen_utc": "2026-05-06 00:33:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807343": [
        {
            "ioc_value": "https://ray.smtpdenz.my.id/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 00:30:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807344": [
        {
            "ioc_value": "ray.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 00:30:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807345": [
        {
            "ioc_value": "https://ray.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 00:30:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807342": [
        {
            "ioc_value": "ray.smtpdenz.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-06 00:30:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807341": [
        {
            "ioc_value": "ext-net.xamir9on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:29:07",
            "last_seen_utc": "2026-05-06 00:29:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807340": [
        {
            "ioc_value": "doclabs.sorix9el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:27:56",
            "last_seen_utc": "2026-05-06 00:28:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807339": [
        {
            "ioc_value": "pkg-run.xamir9on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:24:10",
            "last_seen_utc": "2026-05-06 00:25:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807338": [
        {
            "ioc_value": "syncits.pav6lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:22:24",
            "last_seen_utc": "2026-05-06 00:22:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807337": [
        {
            "ioc_value": "mod-bus.xamir9on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:18:14",
            "last_seen_utc": "2026-05-06 00:19:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807336": [
        {
            "ioc_value": "ioflows.pav6lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:15:59",
            "last_seen_utc": "2026-05-06 00:16:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "6May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807335": [
        {
            "ioc_value": "src-get.xamir9on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:10:44",
            "last_seen_utc": "2026-05-06 00:11:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807334": [
        {
            "ioc_value": "taskids.pav6lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:10:38",
            "last_seen_utc": "2026-05-06 00:13:44",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807333": [
        {
            "ioc_value": "uidmap.tavro5xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:04:06",
            "last_seen_utc": "2026-05-06 00:04:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807332": [
        {
            "ioc_value": "comwebs.pav6lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-06 00:01:55",
            "last_seen_utc": "2026-05-06 00:02:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807331": [
        {
            "ioc_value": "ftpsrv.tavro5xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:58:22",
            "last_seen_utc": "2026-05-05 23:58:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807330": [
        {
            "ioc_value": "refid-xs.pav6lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:56:11",
            "last_seen_utc": "2026-05-05 23:57:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807329": [
        {
            "ioc_value": "libsys.tavro5xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:52:59",
            "last_seen_utc": "2026-05-05 23:53:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807328": [
        {
            "ioc_value": "autboxs.pav6lorex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:50:02",
            "last_seen_utc": "2026-05-05 23:50:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807327": [
        {
            "ioc_value": "jobadm.tavro5xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:46:47",
            "last_seen_utc": "2026-05-05 23:49:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807326": [
        {
            "ioc_value": "domregs.xamir4on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:44:30",
            "last_seen_utc": "2026-05-05 23:44:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807325": [
        {
            "ioc_value": "rawdat.tavro5xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:39:16",
            "last_seen_utc": "2026-05-05 23:39:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807324": [
        {
            "ioc_value": "pwrlogs.xamir4on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:39:05",
            "last_seen_utc": "2026-05-05 23:39:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807323": [
        {
            "ioc_value": "zipark.tavro5xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:33:21",
            "last_seen_utc": "2026-05-05 23:33:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807322": [
        {
            "ioc_value": "extnets.xamir4on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:32:54",
            "last_seen_utc": "2026-05-05 23:33:01",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807320": [
        {
            "ioc_value": "pkgruns.xamir4on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:27:02",
            "last_seen_utc": "2026-05-05 23:29:51",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807319": [
        {
            "ioc_value": "osbase.1zorelix.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:26:59",
            "last_seen_utc": "2026-05-05 23:27:08",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807318": [
        {
            "ioc_value": "metalt.1zorelix.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:18:11",
            "last_seen_utc": "2026-05-05 23:19:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807317": [
        {
            "ioc_value": "modbuss.xamir4on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:18:05",
            "last_seen_utc": "2026-05-05 23:21:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807316": [
        {
            "ioc_value": "apidoc.1zorelix.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:09:56",
            "last_seen_utc": "2026-05-05 23:10:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807315": [
        {
            "ioc_value": "srcgets.xamir4on.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:09:49",
            "last_seen_utc": "2026-05-05 23:11:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807314": [
        {
            "ioc_value": "dbinst.1zorelix.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:04:06",
            "last_seen_utc": "2026-05-05 23:04:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807313": [
        {
            "ioc_value": "uidmaps.tavro8xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 23:03:53",
            "last_seen_utc": "2026-05-05 23:08:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807312": [
        {
            "ioc_value": "skyvpn.1zorelix.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:58:30",
            "last_seen_utc": "2026-05-05 22:59:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807311": [
        {
            "ioc_value": "ftpsrvs.tavro8xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:58:21",
            "last_seen_utc": "2026-05-05 22:58:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807310": [
        {
            "ioc_value": "cmdset.1zorelix.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:50:04",
            "last_seen_utc": "2026-05-05 22:54:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807309": [
        {
            "ioc_value": "libsyss.tavro8xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:49:38",
            "last_seen_utc": "2026-05-05 22:50:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807307": [
        {
            "ioc_value": "jobadms.tavro8xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:44:06",
            "last_seen_utc": "2026-05-05 22:44:32",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807308": [
        {
            "ioc_value": "tmpdir.qen2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:44:06",
            "last_seen_utc": "2026-05-05 22:44:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807306": [
        {
            "ioc_value": "sshbin.qen2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:38:45",
            "last_seen_utc": "2026-05-05 22:39:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807305": [
        {
            "ioc_value": "rawdats.tavro8xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:37:53",
            "last_seen_utc": "2026-05-05 22:38:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807304": [
        {
            "ioc_value": "sslkey.qen2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:32:33",
            "last_seen_utc": "2026-05-05 22:33:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807303": [
        {
            "ioc_value": "ziparks.tavro8xel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:32:02",
            "last_seen_utc": "2026-05-05 22:32:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807301": [
        {
            "ioc_value": "getcfg.qen2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:26:45",
            "last_seen_utc": "2026-05-05 22:28:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807300": [
        {
            "ioc_value": "osbases.2zorelin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:26:40",
            "last_seen_utc": "2026-05-05 22:27:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807299": [
        {
            "ioc_value": "ipnode.qen2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:20:36",
            "last_seen_utc": "2026-05-05 22:25:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807298": [
        {
            "ioc_value": "metalts.2zorelin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:20:17",
            "last_seen_utc": "2026-05-05 22:20:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807297": [
        {
            "ioc_value": "hotfix.qen2vrax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:14:59",
            "last_seen_utc": "2026-05-05 22:15:17",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807296": [
        {
            "ioc_value": "apidocs.2zorelin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:14:52",
            "last_seen_utc": "2026-05-05 22:17:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807294": [
        {
            "ioc_value": "bit-fox.mav7loren.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:08:37",
            "last_seen_utc": "2026-05-05 22:09:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807293": [
        {
            "ioc_value": "dbinsts.2zorelin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:06:24",
            "last_seen_utc": "2026-05-05 22:07:15",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807292": [
        {
            "ioc_value": "top-svc.mav7loren.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:00:41",
            "last_seen_utc": "2026-05-05 22:02:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807291": [
        {
            "ioc_value": "skyvpns.2zorelin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 22:00:39",
            "last_seen_utc": "2026-05-05 22:03:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807290": [
        {
            "ioc_value": "ops-mgr.mav7loren.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:52:37",
            "last_seen_utc": "2026-05-05 21:52:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807289": [
        {
            "ioc_value": "cmdsets.2zorelin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:51:38",
            "last_seen_utc": "2026-05-05 21:52:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807288": [
        {
            "ioc_value": "cpu-pro.mav7loren.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:46:53",
            "last_seen_utc": "2026-05-05 21:47:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807287": [
        {
            "ioc_value": "tmpdirs.qen7varol.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:46:09",
            "last_seen_utc": "2026-05-05 21:46:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807286": [
        {
            "ioc_value": "vps-run.mav7loren.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:40:53",
            "last_seen_utc": "2026-05-05 21:42:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807285": [
        {
            "ioc_value": "sshbins.qen7varol.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:40:05",
            "last_seen_utc": "2026-05-05 21:40:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807284": [
        {
            "ioc_value": "dns-web.mav7loren.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:35:22",
            "last_seen_utc": "2026-05-05 21:39:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807283": [
        {
            "ioc_value": "sslkeys.qen7varol.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:34:14",
            "last_seen_utc": "2026-05-05 21:35:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807282": [
        {
            "ioc_value": "appbox.6toralex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:28:54",
            "last_seen_utc": "2026-05-05 21:30:27",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807281": [
        {
            "ioc_value": "getcfgs.qen7varol.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:28:46",
            "last_seen_utc": "2026-05-05 21:29:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807280": [
        {
            "ioc_value": "devbit.6toralex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:22:46",
            "last_seen_utc": "2026-05-05 21:23:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807279": [
        {
            "ioc_value": "ipnodes.qen7varol.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:22:16",
            "last_seen_utc": "2026-05-05 21:23:19",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807276": [
        {
            "ioc_value": "srvlog.6toralex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:16:53",
            "last_seen_utc": "2026-05-05 21:17:13",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807275": [
        {
            "ioc_value": "hotfixs.qen7varol.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:16:36",
            "last_seen_utc": "2026-05-05 21:17:24",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807272": [
        {
            "ioc_value": "netapi.6toralex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:10:14",
            "last_seen_utc": "2026-05-05 21:10:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807271": [
        {
            "ioc_value": "bitfoxs.mav3lirex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:10:06",
            "last_seen_utc": "2026-05-05 21:14:48",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807270": [
        {
            "ioc_value": "webcdn.6toralex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:04:11",
            "last_seen_utc": "2026-05-05 21:04:50",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807269": [
        {
            "ioc_value": "topsvcs.mav3lirex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 21:03:37",
            "last_seen_utc": "2026-05-05 21:04:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807268": [
        {
            "ioc_value": "srvhub.6toralex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:58:12",
            "last_seen_utc": "2026-05-05 20:59:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807267": [
        {
            "ioc_value": "opsmgrs.mav3lirex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:58:05",
            "last_seen_utc": "2026-05-05 20:58:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807265": [
        {
            "ioc_value": "gitlab.sori7xen.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:51:40",
            "last_seen_utc": "2026-05-05 20:52:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807264": [
        {
            "ioc_value": "cpupros.mav3lirex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:51:28",
            "last_seen_utc": "2026-05-05 20:51:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807263": [
        {
            "ioc_value": "apiops.sori7xen.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:45:52",
            "last_seen_utc": "2026-05-05 20:46:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807262": [
        {
            "ioc_value": "vpsruns.mav3lirex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:45:02",
            "last_seen_utc": "2026-05-05 20:46:38",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807261": [
        {
            "ioc_value": "www.cement-chemistry.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.cobalt_strike",
            "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon",
            "malware_printable": "Cobalt Strike",
            "first_seen_utc": "2026-05-05 20:44:19",
            "last_seen_utc": "2026-05-07 15:44:31",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "CobaltStrike,drb-ra",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807260": [
        {
            "ioc_value": "logbin.sori7xen.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:37:59",
            "last_seen_utc": "2026-05-05 20:38:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807259": [
        {
            "ioc_value": "dnswebs.mav3lirex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:37:24",
            "last_seen_utc": "2026-05-05 20:37:46",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807258": [
        {
            "ioc_value": "appsrc.sori7xen.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:32:09",
            "last_seen_utc": "2026-05-05 20:32:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807257": [
        {
            "ioc_value": "appboxs.9toravex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:31:26",
            "last_seen_utc": "2026-05-05 20:31:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807256": [
        {
            "ioc_value": "webdoc.sori7xen.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:26:33",
            "last_seen_utc": "2026-05-05 20:26:39",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807255": [
        {
            "ioc_value": "devbits.9toravex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:25:34",
            "last_seen_utc": "2026-05-05 20:25:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807254": [
        {
            "ioc_value": "syskey.sori7xen.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:20:29",
            "last_seen_utc": "2026-05-05 20:21:19",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807253": [
        {
            "ioc_value": "srvlogs.9toravex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:19:21",
            "last_seen_utc": "2026-05-05 20:20:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807251": [
        {
            "ioc_value": "net-man.4dorexal.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:13:58",
            "last_seen_utc": "2026-05-05 20:15:03",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807249": [
        {
            "ioc_value": "netapis.9toravex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:13:42",
            "last_seen_utc": "2026-05-05 20:13:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807243": [
        {
            "ioc_value": "tcp-con.4dorexal.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:08:21",
            "last_seen_utc": "2026-05-05 20:09:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807242": [
        {
            "ioc_value": "webcdnx.9toravex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:08:13",
            "last_seen_utc": "2026-05-05 20:08:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807241": [
        {
            "ioc_value": "ssh-pro.4dorexal.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:02:31",
            "last_seen_utc": "2026-05-05 20:03:07",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807240": [
        {
            "ioc_value": "srvhubs.9toravex.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 20:01:55",
            "last_seen_utc": "2026-05-05 20:02:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807237": [
        {
            "ioc_value": "https://mne.smtpdenz.my.id/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 20:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807238": [
        {
            "ioc_value": "mne.hidayahnetwork.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 20:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807239": [
        {
            "ioc_value": "https://mne.hidayahnetwork.com/",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 20:00:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807236": [
        {
            "ioc_value": "mne.smtpdenz.my.id",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 20:00:37",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": null,
            "tags": "vidar",
            "anonymous": "0",
            "reporter": "crep1x"
        }
    ],
    "1807233": [
        {
            "ioc_value": "vm-list.4dorexal.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:56:19",
            "last_seen_utc": "2026-05-05 19:57:13",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807232": [
        {
            "ioc_value": "vnchy.sorix7en.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:56:07",
            "last_seen_utc": "2026-05-05 19:56:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807231": [
        {
            "ioc_value": "usr-grp.4dorexal.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:50:47",
            "last_seen_utc": "2026-05-05 19:51:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807230": [
        {
            "ioc_value": "dzst.sorix7en.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:49:57",
            "last_seen_utc": "2026-05-05 19:50:59",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807229": [
        {
            "ioc_value": "opt-web.4dorexal.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:44:51",
            "last_seen_utc": "2026-05-05 19:45:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807228": [
        {
            "ioc_value": "otntjfbp.sorix7en.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:44:26",
            "last_seen_utc": "2026-05-05 19:45:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807225": [
        {
            "ioc_value": "proxys.vexo3nar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:39:06",
            "last_seen_utc": "2026-05-05 19:40:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807224": [
        {
            "ioc_value": "mer-nexa.sorix7en.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:38:25",
            "last_seen_utc": "2026-05-05 19:38:55",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807223": [
        {
            "ioc_value": "lanhop.vexo3nar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:33:05",
            "last_seen_utc": "2026-05-05 19:33:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807222": [
        {
            "ioc_value": "vorvaleon3.sorix7en.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:32:28",
            "last_seen_utc": "2026-05-05 19:33:10",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807221": [
        {
            "ioc_value": "subcli.vexo3nar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:27:02",
            "last_seen_utc": "2026-05-05 19:27:21",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807220": [
        {
            "ioc_value": "geo-tru3.sorix7en.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:26:36",
            "last_seen_utc": "2026-05-05 19:26:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807219": [
        {
            "ioc_value": "bitkit.vexo3nar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:21:07",
            "last_seen_utc": "2026-05-05 19:21:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807218": [
        {
            "ioc_value": "echo-sync.sorix7en.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:20:44",
            "last_seen_utc": "2026-05-05 19:21:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807217": [
        {
            "ioc_value": "rl88qulx.izyob7rickets.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:15:56",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "clearfake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807216": [
        {
            "ioc_value": "5bb2q4fr.izyob7rickets.digital",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:15:50",
            "last_seen_utc": "2026-05-05 19:16:02",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807215": [
        {
            "ioc_value": "envset.vexo3nar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:14:56",
            "last_seen_utc": "2026-05-05 19:16:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807214": [
        {
            "ioc_value": "ixc32.1dorelax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:14:42",
            "last_seen_utc": "2026-05-05 19:15:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807213": [
        {
            "ioc_value": "doclab.vexo3nar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:09:44",
            "last_seen_utc": "2026-05-05 19:10:23",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807212": [
        {
            "ioc_value": "hyper-cr4te.1dorelax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:08:45",
            "last_seen_utc": "2026-05-05 19:09:31",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807211": [
        {
            "ioc_value": "syncit.pavl9ore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:03:15",
            "last_seen_utc": "2026-05-05 19:04:11",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807210": [
        {
            "ioc_value": "alig9-trail.1dorelax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 19:03:07",
            "last_seen_utc": "2026-05-05 19:04:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807209": [
        {
            "ioc_value": "ioflow.pavl9ore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:57:24",
            "last_seen_utc": "2026-05-05 18:57:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807208": [
        {
            "ioc_value": "serforgeis.1dorelax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:57:17",
            "last_seen_utc": "2026-05-05 18:57:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807207": [
        {
            "ioc_value": "task-id.pavl9ore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:51:54",
            "last_seen_utc": "2026-05-05 18:52:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807206": [
        {
            "ioc_value": "5.101.86.98:4126",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-05 18:49:30",
            "last_seen_utc": "2026-05-07 15:44:11",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807204": [
        {
            "ioc_value": "5.101.82.228:9362",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-05 18:49:12",
            "last_seen_utc": "2026-05-07 15:44:07",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807205": [
        {
            "ioc_value": "5.101.82.229:3039",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-05 18:49:12",
            "last_seen_utc": "2026-05-07 15:44:07",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807203": [
        {
            "ioc_value": "5.101.81.81:2428",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-05 18:49:05",
            "last_seen_utc": "2026-05-07 15:44:06",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807202": [
        {
            "ioc_value": "refinspruc.1dorelax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:48:57",
            "last_seen_utc": "2026-05-05 18:49:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807201": [
        {
            "ioc_value": "38.190.224.70:4338",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.remcos",
            "malware_alias": "RemcosRAT,Remvio,Socmer",
            "malware_printable": "Remcos",
            "first_seen_utc": "2026-05-05 18:48:26",
            "last_seen_utc": "2026-05-07 15:43:57",
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "drb-ra,RAT,RemcosRAT",
            "anonymous": "0",
            "reporter": "abuse_ch"
        }
    ],
    "1807200": [
        {
            "ioc_value": "com-web.pavl9ore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:45:42",
            "last_seen_utc": "2026-05-05 18:48:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807199": [
        {
            "ioc_value": "pr1rn-frame.1dorelax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:43:38",
            "last_seen_utc": "2026-05-05 18:44:26",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807198": [
        {
            "ioc_value": "refid-1.pavl9ore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:37:57",
            "last_seen_utc": "2026-05-05 18:38:43",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807197": [
        {
            "ioc_value": "iigbclf.1dorelax.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:37:39",
            "last_seen_utc": "2026-05-05 18:40:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807195": [
        {
            "ioc_value": "autbox.pavl9ore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:29:17",
            "last_seen_utc": "2026-05-05 18:30:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807194": [
        {
            "ioc_value": "kelforgeor8.vexon3ar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:29:09",
            "last_seen_utc": "2026-05-05 18:29:16",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807193": [
        {
            "ioc_value": "dom-reg.xam1riel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:23:31",
            "last_seen_utc": "2026-05-05 18:24:18",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807192": [
        {
            "ioc_value": "9sgsurs.vexon3ar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:23:07",
            "last_seen_utc": "2026-05-05 18:23:52",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807191": [
        {
            "ioc_value": "pwr-log.xam1riel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:17:35",
            "last_seen_utc": "2026-05-05 18:18:20",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807190": [
        {
            "ioc_value": "crystalreef.vexon3ar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:17:07",
            "last_seen_utc": "2026-05-05 18:17:45",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807189": [
        {
            "ioc_value": "https://bobik.cfd/log.php",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-05 18:14:40",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,ErrTraffic",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1807188": [
        {
            "ioc_value": "https://bobik.cfd/api/index.php",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-05 18:14:24",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,ErrTraffic",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1807187": [
        {
            "ioc_value": "https://bobik.cfd/cf.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-05 18:14:02",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": "ClickFix,ErrTraffic",
            "anonymous": "0",
            "reporter": "HuntYethHounds"
        }
    ],
    "1807186": [
        {
            "ioc_value": "ext-net.xam1riel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:11:46",
            "last_seen_utc": "2026-05-05 18:12:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807185": [
        {
            "ioc_value": "podcasdeliv.vexon3ar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:11:39",
            "last_seen_utc": "2026-05-05 18:14:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807184": [
        {
            "ioc_value": "pkg-run.xam1riel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:05:15",
            "last_seen_utc": "2026-05-05 18:05:58",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807183": [
        {
            "ioc_value": "quorvale4et.vexon3ar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 18:00:53",
            "last_seen_utc": "2026-05-05 18:01:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807182": [
        {
            "ioc_value": "mod-bus.xam1riel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:59:44",
            "last_seen_utc": "2026-05-05 18:02:36",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807181": [
        {
            "ioc_value": "oiyksxf.vexon3ar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:55:01",
            "last_seen_utc": "2026-05-05 17:55:33",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "1",
            "reporter": "ttakvam"
        }
    ],
    "1807180": [
        {
            "ioc_value": "src-get.xam1riel.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:51:28",
            "last_seen_utc": "2026-05-05 17:52:29",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807179": [
        {
            "ioc_value": "a1ig-vector.vexon3ar.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:49:23",
            "last_seen_utc": "2026-05-05 17:49:57",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807178": [
        {
            "ioc_value": "uidmap.torex6lin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:46:20",
            "last_seen_utc": "2026-05-05 17:47:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807175": [
        {
            "ioc_value": "plskl.pavlore9.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:43:23",
            "last_seen_utc": "2026-05-05 17:44:54",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807174": [
        {
            "ioc_value": "ftpsrv.torex6lin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:37:57",
            "last_seen_utc": "2026-05-05 17:38:14",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807173": [
        {
            "ioc_value": "uykfqn.pavlore9.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:37:39",
            "last_seen_utc": "2026-05-05 17:41:49",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807169": [
        {
            "ioc_value": "libsys.torex6lin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:30:43",
            "last_seen_utc": "2026-05-05 17:31:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807168": [
        {
            "ioc_value": "dawnsud.pavlore9.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:28:58",
            "last_seen_utc": "2026-05-05 17:33:37",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807167": [
        {
            "ioc_value": "jobadm.torex6lin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:25:48",
            "last_seen_utc": "2026-05-05 17:26:21",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807166": [
        {
            "ioc_value": "trendinspect.pavlore9.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:22:58",
            "last_seen_utc": "2026-05-05 17:23:42",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807165": [
        {
            "ioc_value": "rawdat.torex6lin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:20:04",
            "last_seen_utc": "2026-05-05 17:23:06",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807066": [
        {
            "ioc_value": "ceoally.com",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.iclickfix",
            "malware_alias": null,
            "malware_printable": "IClickFix",
            "first_seen_utc": "2026-05-05 17:17:45",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "GeNer8"
        }
    ],
    "1807068": [
        {
            "ioc_value": "https://silentmatrix.top/proxy/logout-client.php",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-05 17:17:44",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116522363903192665",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807069": [
        {
            "ioc_value": "silentmatrix.top",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-05 17:17:44",
            "last_seen_utc": "2026-05-05 14:09:37",
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116522363903192665",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807070": [
        {
            "ioc_value": "https://silentmatrix.top/proxy/acl-pipeline.js",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-05 17:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116522363903192665",
            "tags": "SmartApeSG",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807072": [
        {
            "ioc_value": "images.tippytoespreschoolva.com",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "js.fakeupdates",
            "malware_alias": "FakeUpdate,GhoLoader,SocGholish",
            "malware_printable": "FAKEUPDATES",
            "first_seen_utc": "2026-05-05 17:17:43",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": true,
            "reference": "https://infosec.exchange/@monitorsg/116522365919320672",
            "tags": "SocGholish",
            "anonymous": "0",
            "reporter": "monitorsg"
        }
    ],
    "1807073": [
        {
            "ioc_value": "http://5.252.177.67/bb7f17919d0a4d0aaf22.php",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2026-05-05 17:17:43",
            "last_seen_utc": "2026-05-07 16:17:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "c2,loader,StealC,stealer,win20",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1807083": [
        {
            "ioc_value": "95.214.55.177:2525",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.rhadamanthys",
            "malware_alias": null,
            "malware_printable": "Rhadamanthys",
            "first_seen_utc": "2026-05-05 17:17:42",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "GeNer8"
        }
    ],
    "1807091": [
        {
            "ioc_value": "http://45.131.214.189/6a4133a676c340b0b27b.php",
            "ioc_type": "url",
            "threat_type": "botnet_cc",
            "malware": "win.stealc",
            "malware_alias": null,
            "malware_printable": "Stealc",
            "first_seen_utc": "2026-05-05 17:17:41",
            "last_seen_utc": "2026-05-07 15:47:30",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "1803,c2,loader,StealC,stealer",
            "anonymous": "0",
            "reporter": "Bitsight"
        }
    ],
    "1807093": [
        {
            "ioc_value": "modedapk.net",
            "ioc_type": "domain",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-05 17:17:40",
            "last_seen_utc": null,
            "confidence_level": 50,
            "is_compromised": false,
            "reference": "",
            "tags": "lumma",
            "anonymous": "0",
            "reporter": "GeNer8"
        }
    ],
    "1807092": [
        {
            "ioc_value": "205.196.123.189:443",
            "ioc_type": "ip:port",
            "threat_type": "botnet_cc",
            "malware": "win.lumma",
            "malware_alias": "LummaC2 Stealer",
            "malware_printable": "Lumma Stealer",
            "first_seen_utc": "2026-05-05 17:17:38",
            "last_seen_utc": null,
            "confidence_level": 100,
            "is_compromised": false,
            "reference": "",
            "tags": null,
            "anonymous": "0",
            "reporter": "GeNer8"
        }
    ],
    "1807112": [
        {
            "ioc_value": "https://bobik.cfd/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "unknown",
            "malware_alias": null,
            "malware_printable": "Unknown malware",
            "first_seen_utc": "2026-05-05 17:17:37",
            "last_seen_utc": null,
            "confidence_level": 90,
            "is_compromised": false,
            "reference": "https://clickfix.carsonww.com/domains/bobik.cfd",
            "tags": "ClickFix",
            "anonymous": "0",
            "reporter": "CarsonWilliams"
        }
    ],
    "1807115": [
        {
            "ioc_value": "http://dvxfigqyzgd.com/d",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-05 17:17:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807116": [
        {
            "ioc_value": "0a73595b5c7efcefe1e82174a3492aa903f4760d6c3202cb93e960a9b9cc9fc8",
            "ioc_type": "sha256_hash",
            "threat_type": "payload",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-05 17:17:36",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807117": [
        {
            "ioc_value": "28c86021ad35cc4e42684376314fe52aa02a5c2776c3a79abcc83a896295967e",
            "ioc_type": "sha256_hash",
            "threat_type": "payload",
            "malware": "js.kongtuke",
            "malware_alias": "TAG-124,js.LandUpdate808",
            "malware_printable": "KongTuke",
            "first_seen_utc": "2026-05-05 17:17:35",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": null,
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807120": [
        {
            "ioc_value": "16cfe58eab4573ff575c563839e65474da5569247d55fbb59fd56f2684cec610",
            "ioc_type": "sha256_hash",
            "threat_type": "payload",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-05 17:17:34",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "clickfix,smartapesg",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807121": [
        {
            "ioc_value": "8e1ed8998519001d4f4af8e1fe9381950cf9c2501ca1b25c414712d29966aee6",
            "ioc_type": "sha256_hash",
            "threat_type": "payload",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-05 17:17:34",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "clickfix,smartapesg",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807122": [
        {
            "ioc_value": "97f3bdf6db1c274da0e5e653ef59f49514f6d7ed531138f487912d1f9a8fac1c",
            "ioc_type": "sha256_hash",
            "threat_type": "payload",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-05 17:17:33",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "clickfix,smartapesg",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807123": [
        {
            "ioc_value": "144.208.127.215:443",
            "ioc_type": "ip:port",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-05 17:17:33",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "clickfix,smartapesg",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807124": [
        {
            "ioc_value": "144.208.127.163:443",
            "ioc_type": "ip:port",
            "threat_type": "payload_delivery",
            "malware": "js.smartapesg",
            "malware_alias": "HANEYMANEY,ZPHP",
            "malware_printable": "SmartApeSG",
            "first_seen_utc": "2026-05-05 17:17:32",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": false,
            "reference": null,
            "tags": "clickfix,smartapesg",
            "anonymous": "0",
            "reporter": "Lenny_3BO"
        }
    ],
    "1807164": [
        {
            "ioc_value": "iontrai.pavlore9.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:17:03",
            "last_seen_utc": "2026-05-05 17:18:28",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807161": [
        {
            "ioc_value": "https://impress.com.pk/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 17:15:05",
            "last_seen_utc": "2026-05-05 19:30:54",
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807162": [
        {
            "ioc_value": "https://jggoldstein.org/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 17:15:05",
            "last_seen_utc": "2026-05-05 19:30:54",
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807163": [
        {
            "ioc_value": "https://notesyndication.com/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 17:15:05",
            "last_seen_utc": "2026-05-05 19:30:54",
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807159": [
        {
            "ioc_value": "https://touraine-impression.fr/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 17:15:04",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807160": [
        {
            "ioc_value": "https://beamriverenergy.org/",
            "ioc_type": "url",
            "threat_type": "payload_delivery",
            "malware": "win.vidar",
            "malware_alias": null,
            "malware_printable": "Vidar",
            "first_seen_utc": "2026-05-05 17:15:04",
            "last_seen_utc": null,
            "confidence_level": 75,
            "is_compromised": true,
            "reference": null,
            "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress",
            "anonymous": "1",
            "reporter": "m_govcert_ch"
        }
    ],
    "1807158": [
        {
            "ioc_value": "zipark.torex6lin.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:11:28",
            "last_seen_utc": "2026-05-05 17:12:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807157": [
        {
            "ioc_value": "couri-shall.pavlore9.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:11:20",
            "last_seen_utc": "2026-05-05 17:12:35",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807156": [
        {
            "ioc_value": "4dapt3-node.pavlore9.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:05:22",
            "last_seen_utc": "2026-05-05 17:09:40",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807155": [
        {
            "ioc_value": "osbase.3zavlore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 17:05:05",
            "last_seen_utc": "2026-05-05 17:07:34",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807154": [
        {
            "ioc_value": "prof9-point.xamir2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 16:58:25",
            "last_seen_utc": "2026-05-05 17:01:12",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807153": [
        {
            "ioc_value": "metalt.3zavlore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 16:54:53",
            "last_seen_utc": "2026-05-05 16:58:53",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807152": [
        {
            "ioc_value": "port-mar.xamir2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 16:50:16",
            "last_seen_utc": "2026-05-05 16:51:22",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807151": [
        {
            "ioc_value": "apidoc.3zavlore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 16:41:58",
            "last_seen_utc": "2026-05-05 16:43:25",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807150": [
        {
            "ioc_value": "dyn-lithos.xamir2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 16:39:56",
            "last_seen_utc": "2026-05-05 16:41:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "5May2026,ClearFake,Commandline,Windows",
            "anonymous": "0",
            "reporter": "Gi7w0rm"
        }
    ],
    "1807149": [
        {
            "ioc_value": "dbinst.3zavlore.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 16:36:30",
            "last_seen_utc": "2026-05-05 16:39:00",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ],
    "1807148": [
        {
            "ioc_value": "mxqbq.xamir2el.surf",
            "ioc_type": "domain",
            "threat_type": "payload_delivery",
            "malware": "js.clearfake",
            "malware_alias": null,
            "malware_printable": "ClearFake",
            "first_seen_utc": "2026-05-05 16:33:40",
            "last_seen_utc": "2026-05-05 16:34:47",
            "confidence_level": 100,
            "is_compromised": false,
            "reference": null,
            "tags": "ClearFake",
            "anonymous": "0",
            "reporter": "threatcat_ch"
        }
    ]
}