{ "1792728": [ { "ioc_value": "4cnluiv.burrowkislyat.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 11:32:22", "last_seen_utc": "2026-04-16 11:34:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792727": [ { "ioc_value": "arkspireor.burrowkislyat.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 11:26:24", "last_seen_utc": "2026-04-16 11:28:31", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792719": [ { "ioc_value": "gusto.brothbridge.space", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 11:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "odiznrio,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792718": [ { "ioc_value": "http://gusto.brothbridge.space", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 11:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "odiznrio,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792717": [ { "ioc_value": "tth.shurimaster.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 11:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792716": [ { "ioc_value": "https://tth.shurimaster.com/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 11:16:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792715": [ { "ioc_value": "tth.blogdospesados.com.br", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 11:15:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792714": [ { "ioc_value": "https://tth.blogdospesados.com.br/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 11:15:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792712": [ { "ioc_value": "198.46.173.5:3000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-16 11:12:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/4bfd0b95c3baf8b621e009aec5b92344e4e236ebc12b34fad891d0a1996668c6/", "tags": "remcos", "anonymous": "0", "reporter": "abuse_ch" } ], "1792711": [ { "ioc_value": "doome.crazy-talk.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 11:10:36", "last_seen_utc": "2026-04-16 11:13:35", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792710": [ { "ioc_value": "work-done6.crazy-talk.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 11:05:50", "last_seen_utc": "2026-04-16 11:08:21", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792709": [ { "ioc_value": "heavy-pack5.crazy-talk.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:59:58", "last_seen_utc": "2026-04-16 11:03:23", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792702": [ { "ioc_value": "solid-base6.overgr0wnsaval.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:59:09", "last_seen_utc": "2026-04-16 10:36:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "16April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1792708": [ { "ioc_value": "47.109.23.77:4567", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 10:57:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792707": [ { "ioc_value": "43.167.177.224:7778", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 10:56:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792706": [ { "ioc_value": "short-word4.crazy-talk.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:54:07", "last_seen_utc": "2026-04-16 10:57:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792705": [ { "ioc_value": "sticky-note3.crazy-talk.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:48:45", "last_seen_utc": "2026-04-16 10:52:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792704": [ { "ioc_value": "direct-send2.crazy-talk.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:43:27", "last_seen_utc": "2026-04-16 10:46:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792703": [ { "ioc_value": "express-mail1.crazy-talk.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:37:24", "last_seen_utc": "2026-04-16 10:41:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792701": [ { "ioc_value": "rain-drop5.overgr0wnsaval.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:26:24", "last_seen_utc": "2026-04-16 10:27:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792700": [ { "ioc_value": "deep-well4.overgr0wnsaval.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:20:30", "last_seen_utc": "2026-04-16 10:23:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792699": [ { "ioc_value": "river-flow3.overgr0wnsaval.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:15:27", "last_seen_utc": "2026-04-16 10:18:23", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792698": [ { "ioc_value": "ocean-blue2.overgr0wnsaval.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:09:21", "last_seen_utc": "2026-04-16 10:13:12", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792697": [ { "ioc_value": "clear-water1.overgr0wnsaval.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 10:03:46", "last_seen_utc": "2026-04-16 10:08:55", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792696": [ { "ioc_value": "group-join6.aim-national.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:58:30", "last_seen_utc": "2026-04-16 09:59:18", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792695": [ { "ioc_value": "brief-meet5.aim-national.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:52:53", "last_seen_utc": "2026-04-16 09:54:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792694": [ { "ioc_value": "simple-form4.aim-national.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:47:10", "last_seen_utc": "2026-04-16 09:48:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792684": [ { "ioc_value": "ismemcs.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792685": [ { "ioc_value": "moma-cdn.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792686": [ { "ioc_value": "pakistanpower.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792687": [ { "ioc_value": "pakpower.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792688": [ { "ioc_value": "pakserver.live", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792689": [ { "ioc_value": "pkenergy.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792690": [ { "ioc_value": "pkfileserver.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792691": [ { "ioc_value": "pkserver.live", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792692": [ { "ioc_value": "psca-gop.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792693": [ { "ioc_value": "energy.pakpower.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 09:42:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/500mk500/status/2044440829859643849", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792683": [ { "ioc_value": "phone-call3.aim-national.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:41:16", "last_seen_utc": "2026-04-16 09:42:21", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792682": [ { "ioc_value": "144.172.65.204:4443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-16 09:36:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/salmanvsf/status/2044635908981604371", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1792681": [ { "ioc_value": "senior-staff2.aim-national.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:35:41", "last_seen_utc": "2026-04-16 09:40:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792680": [ { "ioc_value": "small-team1.aim-national.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:30:07", "last_seen_utc": "2026-04-16 09:34:35", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792679": [ { "ioc_value": "brand-mark6.guy5mist.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:24:40", "last_seen_utc": "2026-04-16 09:28:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792678": [ { "ioc_value": "quick-cash5.guy5mist.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:19:10", "last_seen_utc": "2026-04-16 09:24:02", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792677": [ { "ioc_value": "info-desk4.guy5mist.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:13:20", "last_seen_utc": "2026-04-16 09:18:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792676": [ { "ioc_value": "empty-cart3.guy5mist.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:07:43", "last_seen_utc": "2026-04-16 09:09:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792675": [ { "ioc_value": "summer-sale2.guy5mist.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 09:02:13", "last_seen_utc": "2026-04-16 09:02:52", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792674": [ { "ioc_value": "fresh-food1.guy5mist.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:56:35", "last_seen_utc": "2026-04-16 09:00:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792673": [ { "ioc_value": "active-job6.empirical-tuna.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:51:16", "last_seen_utc": "2026-04-16 08:55:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792669": [ { "ioc_value": "daily-bonus2.empirical-tuna.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:48:06", "last_seen_utc": "2026-04-16 08:33:37", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "16April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1792672": [ { "ioc_value": "short-plan5.empirical-tuna.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:45:17", "last_seen_utc": "2026-04-16 08:45:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792671": [ { "ioc_value": "promo-card4.empirical-tuna.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:39:48", "last_seen_utc": "2026-04-16 08:40:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792670": [ { "ioc_value": "extra-coin3.empirical-tuna.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:34:04", "last_seen_utc": "2026-04-16 08:34:22", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792668": [ { "ioc_value": "lucky-gift1.empirical-tuna.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:23:09", "last_seen_utc": "2026-04-16 08:25:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792667": [ { "ioc_value": "front-gate6.benomkin5.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:17:06", "last_seen_utc": "2026-04-16 08:22:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792666": [ { "ioc_value": "user-profile5.benomkin5.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:11:41", "last_seen_utc": "2026-04-16 08:15:09", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792665": [ { "ioc_value": "full-table4.benomkin5.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:06:47", "last_seen_utc": "2026-04-16 08:10:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792664": [ { "ioc_value": "prime-list3.benomkin5.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 08:01:08", "last_seen_utc": "2026-04-16 08:01:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792663": [ { "ioc_value": "smart-point2.benomkin5.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:54:49", "last_seen_utc": "2026-04-16 07:56:31", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792662": [ { "ioc_value": "best-choice1.benomkin5.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:49:14", "last_seen_utc": "2026-04-16 07:50:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792661": [ { "ioc_value": "open-source6.acidity-inflame.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:43:45", "last_seen_utc": "2026-04-16 07:45:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792659": [ { "ioc_value": "travel-blog5.acidity-inflame.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:37:48", "last_seen_utc": "2026-04-16 07:42:50", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792658": [ { "ioc_value": "small-map4.acidity-inflame.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:32:24", "last_seen_utc": "2026-04-16 07:34:18", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792657": [ { "ioc_value": "latest-news3.acidity-inflame.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:27:00", "last_seen_utc": "2026-04-16 07:27:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792656": [ { "ioc_value": "http://bootstrup-cdn-ns.beer/api/css.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:24:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792655": [ { "ioc_value": "bootstrup-cdn-ns.beer", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:23:48", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792654": [ { "ioc_value": "http://fontawesome-js-cdn.beer/api/css.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:23:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792653": [ { "ioc_value": "fontawesome-js-cdn.beer", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:22:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792652": [ { "ioc_value": "http://bbdsnssserver.beer/api/css.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:22:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792651": [ { "ioc_value": "bbdsnssserver.beer", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:22:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792650": [ { "ioc_value": "https://lsnsdns.beer/api/css.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:21:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792649": [ { "ioc_value": "scenic-spot2.acidity-inflame.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:21:26", "last_seen_utc": "2026-04-16 07:24:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792648": [ { "ioc_value": "lsnsdns.beer", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:21:13", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792647": [ { "ioc_value": "http://fijscdn.beer/api/css.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:20:36", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792646": [ { "ioc_value": "fijscdn.beer", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:20:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792645": [ { "ioc_value": "http://bilfojsclod.beer/api/css.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:19:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792644": [ { "ioc_value": "bilfojsclod.beer", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:19:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792643": [ { "ioc_value": "https://bigbadwolf.click/log.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:17:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792642": [ { "ioc_value": "https://bigbadwolf.click/api/index.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:17:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792641": [ { "ioc_value": "https://bigbadwolf.click/cf.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:16:48", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792640": [ { "ioc_value": "bigbadwolf.click", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 07:16:26", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792639": [ { "ioc_value": "urban-vision1.acidity-inflame.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:15:58", "last_seen_utc": "2026-04-16 07:20:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792638": [ { "ioc_value": "global-site6.rol1erspeeding.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:10:08", "last_seen_utc": "2026-04-16 07:10:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792637": [ { "ioc_value": "main-street5.rol1erspeeding.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 07:04:41", "last_seen_utc": "2026-04-16 07:08:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792636": [ { "ioc_value": "total-summary4.rol1erspeeding.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:58:47", "last_seen_utc": "2026-04-16 06:59:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792635": [ { "ioc_value": "local-office3.rol1erspeeding.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:53:19", "last_seen_utc": "2026-04-16 06:57:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792634": [ { "ioc_value": "5.104.86.108:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 06:48:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-987654321", "anonymous": "0", "reporter": "abuse_ch" } ], "1792633": [ { "ioc_value": "194.87.198.115:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 06:48:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-987654321", "anonymous": "0", "reporter": "abuse_ch" } ], "1792632": [ { "ioc_value": "large-parcel2.rol1erspeeding.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:47:51", "last_seen_utc": "2026-04-16 06:49:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792631": [ { "ioc_value": "47.109.23.77:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 06:43:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-666666666", "anonymous": "0", "reporter": "abuse_ch" } ], "1792630": [ { "ioc_value": "8.141.116.149:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 06:43:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-1234567890", "anonymous": "0", "reporter": "abuse_ch" } ], "1792629": [ { "ioc_value": "order-status1.rol1erspeeding.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:41:55", "last_seen_utc": "2026-04-16 06:44:48", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792628": [ { "ioc_value": "home-section6.domna-replenish.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:36:14", "last_seen_utc": "2026-04-16 06:39:00", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792627": [ { "ioc_value": "public-help5.domna-replenish.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:30:55", "last_seen_utc": "2026-04-16 06:33:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792626": [ { "ioc_value": "item-details4.domna-replenish.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:25:30", "last_seen_utc": "2026-04-16 06:27:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792625": [ { "ioc_value": "media-gallery3.domna-replenish.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:19:39", "last_seen_utc": "2026-04-16 06:22:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792623": [ { "ioc_value": "https://careerendeavour.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792624": [ { "ioc_value": "https://jichma.jg.gov.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792620": [ { "ioc_value": "https://portalmusica.ramossoft.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792621": [ { "ioc_value": "https://rosicastrolaser.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792622": [ { "ioc_value": "https://fightzonesg.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792617": [ { "ioc_value": "https://cnbottinginsurance.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792618": [ { "ioc_value": "https://electrostore-kw.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792619": [ { "ioc_value": "https://neohumanismedu.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792615": [ { "ioc_value": "https://apkdira.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792616": [ { "ioc_value": "https://barkerplumbingservices.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792613": [ { "ioc_value": "https://anastasopoulosandco.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792614": [ { "ioc_value": "https://sabba.llc/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792611": [ { "ioc_value": "https://crossjo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792612": [ { "ioc_value": "https://test10.seoteach.ru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 06:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792610": [ { "ioc_value": "guest-portal2.domna-replenish.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:14:01", "last_seen_utc": "2026-04-16 06:16:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792601": [ { "ioc_value": "whtempdomain.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 06:09:35", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1792602": [ { "ioc_value": "https://whtempdomain.com/files/jar/Pjibf.exe", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 06:09:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1792603": [ { "ioc_value": "https://whtempdomain.com/files/jar/security", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 06:09:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1792604": [ { "ioc_value": "https://whtempdomain.com/files/jar/module", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 06:09:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1792605": [ { "ioc_value": "https://whtempdomain.com/files/jar/RuntimeBroker.exe", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 06:09:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1792606": [ { "ioc_value": "https://whtempdomain.com/files/jar/elevator", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 06:09:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1792607": [ { "ioc_value": "https://whtempdomain.com/files/jar/module2", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 06:09:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1792608": [ { "ioc_value": "https://whtempdomain.com/files/jar/component", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 06:09:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1792609": [ { "ioc_value": "central-market1.domna-replenish.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:08:36", "last_seen_utc": "2026-04-16 06:09:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792600": [ { "ioc_value": "street-view6.kro2vilen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 06:02:37", "last_seen_utc": "2026-04-16 06:04:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792599": [ { "ioc_value": "good-luck5.kro2vilen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:57:15", "last_seen_utc": "2026-04-16 05:58:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792598": [ { "ioc_value": "92.63.106.237:14888", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-16 05:51:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/e9bf8b0cc4f99ab868fbdbf3e90a6adcb867a7041f6201007a7844414ba0cc55/", "tags": "quasar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792597": [ { "ioc_value": "sunny-day4.kro2vilen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:51:22", "last_seen_utc": "2026-04-16 05:53:23", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792595": [ { "ioc_value": "http://130.12.180.28/cdn-cgi/beacon", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 05:45:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://urlhaus.abuse.ch/url/3823147/", "tags": "dropped-by-vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792596": [ { "ioc_value": "http://130.12.180.28/cdn-cgi/trace", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 05:45:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://urlhaus.abuse.ch/url/3823147/", "tags": "dropped-by-vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792594": [ { "ioc_value": "bright-sun3.kro2vilen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:45:45", "last_seen_utc": "2026-04-16 05:47:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792593": [ { "ioc_value": "ooo.websitearaxa.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 05:40:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756/", "tags": "Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792592": [ { "ioc_value": "https://ooo.websitearaxa.com/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 05:40:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756/", "tags": "Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792591": [ { "ioc_value": "health-care2.kro2vilen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:40:29", "last_seen_utc": "2026-04-16 05:42:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792590": [ { "ioc_value": "172.245.4.226:3000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-16 05:36:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/ade9874ddc5fb64c27f3eecddeeabdddb4b62e341e1ec06f09fea29ac9e6baa5/", "tags": "remcos", "anonymous": "0", "reporter": "abuse_ch" } ], "1792589": [ { "ioc_value": "http://ca125159.tw1.ru/L1nc0In.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.dcrat", "malware_alias": "DarkCrystal RAT", "malware_printable": "DCRat", "first_seen_utc": "2026-04-16 05:35:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "DCRat,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1792588": [ { "ioc_value": "sweet-home1.kro2vilen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:34:32", "last_seen_utc": "2026-04-16 05:37:02", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792587": [ { "ioc_value": "work-done6.tix9larem.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:29:12", "last_seen_utc": "2026-04-16 05:31:21", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792586": [ { "ioc_value": "heavy-pack5.tix9larem.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:23:48", "last_seen_utc": "2026-04-16 05:26:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792485": [ { "ioc_value": "http://217.69.0.159/get_encrypt_file_exe/AIgcaBsOKY4l4R4DMN5Caw==", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-16 05:22:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792486": [ { "ioc_value": "http://217.69.0.159/get_arhive_npm/CaZPVvNsQfLDx9O6QbxOnw==", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-16 05:22:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792487": [ { "ioc_value": "http://217.69.3.152:80/log", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-16 05:22:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "exfil,glassworm,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792488": [ { "ioc_value": "http://45.32.150.251/get_encrypt_file_exe/Uj+ZA5DGnVUc9s8ezel5NQ==", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-16 05:22:02", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792489": [ { "ioc_value": "http://45.32.150.251/get_arhive_npm/1hSS+kiByorP8+9JrXLvgg==", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-16 05:22:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792469": [ { "ioc_value": "dl.armour-inc-down.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-16 05:21:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": "", "tags": "Vidar", "anonymous": "0", "reporter": "tcains1" } ], "1792466": [ { "ioc_value": "flagbrother.uk", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 05:21:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/9f9c4d0f6644abe7500325d2e387ff606a1d72f8d033bc164f984deee92d7d65/", "tags": "c2,FlagStealer", "anonymous": "0", "reporter": "burger" } ], "1792426": [ { "ioc_value": "google-meet-live.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 05:21:57", "last_seen_utc": null, "confidence_level": 50, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "varysz" } ], "1792319": [ { "ioc_value": "213.176.73.132:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.smartloader", "malware_alias": null, "malware_printable": "SmartLoader", "first_seen_utc": "2026-04-16 05:21:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": "", "tags": "SmartLoader", "anonymous": "0", "reporter": "tcains1" } ], "1792418": [ { "ioc_value": "http://213.176.73.163/task/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.smartloader", "malware_alias": null, "malware_printable": "SmartLoader", "first_seen_utc": "2026-04-16 05:21:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": "", "tags": "SmartLoader", "anonymous": "0", "reporter": "tcains1" } ], "1792419": [ { "ioc_value": "213.176.73.163:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.smartloader", "malware_alias": null, "malware_printable": "SmartLoader", "first_seen_utc": "2026-04-16 05:21:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": "", "tags": "SmartLoader", "anonymous": "0", "reporter": "tcains1" } ], "1792318": [ { "ioc_value": "http://213.176.73.132/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.smartloader", "malware_alias": null, "malware_printable": "SmartLoader", "first_seen_utc": "2026-04-16 05:21:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": "", "tags": "SmartLoader", "anonymous": "0", "reporter": "tcains1" } ], "1792317": [ { "ioc_value": "rave3-layer.expect-runes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:21:50", "last_seen_utc": "2026-04-15 19:50:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "15April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1792316": [ { "ioc_value": "servena.expect-runes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:21:49", "last_seen_utc": "2026-04-15 19:45:23", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "15April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1792277": [ { "ioc_value": "https://www.zeitdanach.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 05:21:48", "last_seen_utc": null, "confidence_level": 90, "is_compromised": false, "reference": "https://clickfix.carsonww.com/domains/www.zeitdanach.ch", "tags": "ClickFix", "anonymous": "0", "reporter": "CarsonWilliams" } ], "1792278": [ { "ioc_value": "https://www.aircliniq.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 05:21:47", "last_seen_utc": null, "confidence_level": 90, "is_compromised": false, "reference": "https://clickfix.carsonww.com/domains/www.aircliniq.com", "tags": "ClickFix", "anonymous": "0", "reporter": "CarsonWilliams" } ], "1792279": [ { "ioc_value": "https://www.omnicoresolutions.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-16 05:21:47", "last_seen_utc": null, "confidence_level": 90, "is_compromised": false, "reference": "https://clickfix.carsonww.com/domains/www.omnicoresolutions.net", "tags": "ClickFix", "anonymous": "0", "reporter": "CarsonWilliams" } ], "1792585": [ { "ioc_value": "short-word4.tix9larem.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:17:39", "last_seen_utc": "2026-04-16 05:20:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792584": [ { "ioc_value": "sticky-note3.tix9larem.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:12:14", "last_seen_utc": "2026-04-16 05:14:27", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792583": [ { "ioc_value": "direct-send2.tix9larem.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:06:32", "last_seen_utc": "2026-04-16 05:08:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792582": [ { "ioc_value": "express-mail1.tix9larem.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 05:00:50", "last_seen_utc": "2026-04-16 05:03:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792581": [ { "ioc_value": "solid-base6.bex1lorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:55:20", "last_seen_utc": "2026-04-16 04:58:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792580": [ { "ioc_value": "rain-drop5.bex1lorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:50:05", "last_seen_utc": "2026-04-16 04:52:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792579": [ { "ioc_value": "18.170.69.70:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 04:49:21", "last_seen_utc": "2026-04-16 10:53:49", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792578": [ { "ioc_value": "deep-well4.bex1lorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:44:01", "last_seen_utc": "2026-04-16 04:46:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792577": [ { "ioc_value": "river-flow3.bex1lorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:38:48", "last_seen_utc": "2026-04-16 04:40:37", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792576": [ { "ioc_value": "ocean-blue2.bex1lorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:32:47", "last_seen_utc": "2026-04-16 04:34:55", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792575": [ { "ioc_value": "clear-water1.bex1lorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:27:51", "last_seen_utc": "2026-04-16 04:30:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792573": [ { "ioc_value": "group-join6.dax6porel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:21:41", "last_seen_utc": "2026-04-16 04:24:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792563": [ { "ioc_value": "brief-meet5.dax6porel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:16:22", "last_seen_utc": "2026-04-16 04:18:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792555": [ { "ioc_value": "simple-form4.dax6porel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:10:52", "last_seen_utc": "2026-04-16 04:12:46", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792554": [ { "ioc_value": "phone-call3.dax6porel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 04:04:55", "last_seen_utc": "2026-04-16 04:09:43", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792553": [ { "ioc_value": "senior-staff2.dax6porel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:59:18", "last_seen_utc": "2026-04-16 03:59:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792552": [ { "ioc_value": "small-team1.dax6porel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:53:50", "last_seen_utc": "2026-04-16 03:57:18", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792551": [ { "ioc_value": "brand-mark6.pyn9sorel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:48:00", "last_seen_utc": "2026-04-16 03:51:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792550": [ { "ioc_value": "quick-cash5.pyn9sorel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:42:28", "last_seen_utc": "2026-04-16 03:45:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792549": [ { "ioc_value": "info-desk4.pyn9sorel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:37:12", "last_seen_utc": "2026-04-16 03:40:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792548": [ { "ioc_value": "empty-cart3.pyn9sorel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:31:06", "last_seen_utc": "2026-04-16 03:34:22", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792547": [ { "ioc_value": "summer-sale2.pyn9sorel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:25:44", "last_seen_utc": "2026-04-16 03:29:07", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792546": [ { "ioc_value": "fresh-food1.pyn9sorel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:20:08", "last_seen_utc": "2026-04-16 03:22:45", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792545": [ { "ioc_value": "active-job6.wex4tiral.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:14:34", "last_seen_utc": "2026-04-16 03:17:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792544": [ { "ioc_value": "short-plan5.wex4tiral.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:08:38", "last_seen_utc": "2026-04-16 03:11:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792543": [ { "ioc_value": "promo-card4.wex4tiral.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 03:03:23", "last_seen_utc": "2026-04-16 03:05:31", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792542": [ { "ioc_value": "52.220.247.175:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 02:58:55", "last_seen_utc": "2026-04-16 10:59:09", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792541": [ { "ioc_value": "extra-coin3.wex4tiral.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:57:49", "last_seen_utc": "2026-04-16 02:59:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792540": [ { "ioc_value": "43.128.59.217:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 02:56:40", "last_seen_utc": "2026-04-16 10:56:28", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792539": [ { "ioc_value": "klaus-schmitt.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "win.strelastealer", "malware_alias": null, "malware_printable": "StrelaStealer", "first_seen_utc": "2026-04-16 02:56:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": null, "tags": "StrelaStealer", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792538": [ { "ioc_value": "35.179.185.166:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 02:56:02", "last_seen_utc": "2026-04-16 10:55:12", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792537": [ { "ioc_value": "18.170.69.70:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 02:55:03", "last_seen_utc": "2026-04-16 10:53:52", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792536": [ { "ioc_value": "124.71.231.231:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 02:52:19", "last_seen_utc": "2026-04-16 10:51:18", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792535": [ { "ioc_value": "daily-bonus2.wex4tiral.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:52:18", "last_seen_utc": "2026-04-16 02:55:07", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792534": [ { "ioc_value": "lucky-gift1.wex4tiral.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:46:20", "last_seen_utc": "2026-04-16 02:48:56", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792533": [ { "ioc_value": "cdn2.raqeeb.dev", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 02:43:47", "last_seen_utc": "2026-04-16 10:43:42", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792532": [ { "ioc_value": "bxx2rghe05kng.cfc-execute.bj.baidubce.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-16 02:43:39", "last_seen_utc": "2026-04-16 10:43:30", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1792531": [ { "ioc_value": "front-gate6.tix7marel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:40:52", "last_seen_utc": "2026-04-16 02:43:45", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792530": [ { "ioc_value": "user-profile5.tix7marel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:35:33", "last_seen_utc": "2026-04-16 02:40:27", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792529": [ { "ioc_value": "full-table4.tix7marel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:30:03", "last_seen_utc": "2026-04-16 02:32:48", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792528": [ { "ioc_value": "prime-list3.tix7marel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:23:55", "last_seen_utc": "2026-04-16 02:26:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792527": [ { "ioc_value": "smart-point2.tix7marel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:18:34", "last_seen_utc": "2026-04-16 02:19:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792526": [ { "ioc_value": "best-choice1.tix7marel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:13:05", "last_seen_utc": "2026-04-16 02:15:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792525": [ { "ioc_value": "open-source6.vyr3solen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:07:01", "last_seen_utc": "2026-04-16 02:10:04", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792524": [ { "ioc_value": "travel-blog5.vyr3solen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 02:01:34", "last_seen_utc": "2026-04-16 02:04:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792523": [ { "ioc_value": "small-map4.vyr3solen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:56:05", "last_seen_utc": "2026-04-16 01:56:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792522": [ { "ioc_value": "latest-news3.vyr3solen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:50:28", "last_seen_utc": "2026-04-16 01:52:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792521": [ { "ioc_value": "scenic-spot2.vyr3solen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:44:51", "last_seen_utc": "2026-04-16 01:47:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792520": [ { "ioc_value": "urban-vision1.vyr3solen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:39:11", "last_seen_utc": "2026-04-16 01:41:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792519": [ { "ioc_value": "global-site6.lax8dorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:33:53", "last_seen_utc": "2026-04-16 01:36:01", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792518": [ { "ioc_value": "main-street5.lax8dorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:28:48", "last_seen_utc": "2026-04-16 01:30:55", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792517": [ { "ioc_value": "total-summary4.lax8dorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:22:11", "last_seen_utc": "2026-04-16 01:27:09", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792516": [ { "ioc_value": "local-office3.lax8dorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:16:49", "last_seen_utc": "2026-04-16 01:19:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792515": [ { "ioc_value": "large-parcel2.lax8dorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:10:59", "last_seen_utc": "2026-04-16 01:13:37", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792514": [ { "ioc_value": "order-status1.lax8dorim.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 01:05:44", "last_seen_utc": "2026-04-16 01:10:25", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792513": [ { "ioc_value": "home-section6.zom5pirel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:59:46", "last_seen_utc": "2026-04-16 01:01:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792512": [ { "ioc_value": "http://91.214.78.31", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.stealc", "malware_alias": null, "malware_printable": "Stealc", "first_seen_utc": "2026-04-16 00:55:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/d0545dc9e3fd3fbb17c6945c4b8bdbb339a78b7af99d3ada96b2620d171f4518/", "tags": "stealc", "anonymous": "0", "reporter": "abuse_ch" } ], "1792511": [ { "ioc_value": "public-help5.zom5pirel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:54:35", "last_seen_utc": "2026-04-16 00:56:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792510": [ { "ioc_value": "item-details4.zom5pirel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:48:29", "last_seen_utc": "2026-04-16 00:50:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792509": [ { "ioc_value": "media-gallery3.zom5pirel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:43:24", "last_seen_utc": "2026-04-16 00:45:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792508": [ { "ioc_value": "guest-portal2.zom5pirel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:37:20", "last_seen_utc": "2026-04-16 00:39:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792507": [ { "ioc_value": "central-market1.zom5pirel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:32:13", "last_seen_utc": "2026-04-16 00:32:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792506": [ { "ioc_value": "tri-fluxon.invert-manner.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:26:11", "last_seen_utc": "2026-04-16 00:28:31", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792505": [ { "ioc_value": "authsnapshot.invert-manner.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:20:40", "last_seen_utc": "2026-04-16 00:21:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792504": [ { "ioc_value": "gutyx.invert-manner.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:14:48", "last_seen_utc": "2026-04-16 00:17:08", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792503": [ { "ioc_value": "87phs.invert-manner.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:09:33", "last_seen_utc": "2026-04-16 00:12:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792502": [ { "ioc_value": "vscoj.invert-manner.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-16 00:04:13", "last_seen_utc": "2026-04-16 00:06:31", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792501": [ { "ioc_value": "11q31v.invert-manner.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:58:15", "last_seen_utc": "2026-04-16 00:00:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792500": [ { "ioc_value": "p14sm-grid.racersta7ving.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:52:35", "last_seen_utc": "2026-04-15 23:54:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792499": [ { "ioc_value": "9adl.racersta7ving.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:47:07", "last_seen_utc": "2026-04-15 23:48:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792498": [ { "ioc_value": "specapi.racersta7ving.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:41:10", "last_seen_utc": "2026-04-15 23:43:58", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792497": [ { "ioc_value": "b1oo9-hold.racersta7ving.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:35:56", "last_seen_utc": "2026-04-15 23:38:31", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792496": [ { "ioc_value": "ovumpg.racersta7ving.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:30:24", "last_seen_utc": "2026-04-15 23:32:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792495": [ { "ioc_value": "iijbe.racersta7ving.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:24:28", "last_seen_utc": "2026-04-15 23:26:45", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792494": [ { "ioc_value": "npmx.photot-sudok.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:18:55", "last_seen_utc": "2026-04-15 23:20:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792493": [ { "ioc_value": "sol-tidea.photot-sudok.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:13:25", "last_seen_utc": "2026-04-15 23:15:31", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792492": [ { "ioc_value": "fbhi02d.photot-sudok.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:07:50", "last_seen_utc": "2026-04-15 23:10:12", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792491": [ { "ioc_value": "queu-crest.photot-sudok.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 23:02:15", "last_seen_utc": "2026-04-15 23:03:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792490": [ { "ioc_value": "4cti-pulse.photot-sudok.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:56:32", "last_seen_utc": "2026-04-15 22:58:03", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792484": [ { "ioc_value": "povv3r3-sheet.photot-sudok.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:50:52", "last_seen_utc": "2026-04-15 22:52:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792483": [ { "ioc_value": "74vjq.go0duntenable.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:45:24", "last_seen_utc": "2026-04-15 22:47:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792482": [ { "ioc_value": "rqwhul1.go0duntenable.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:39:38", "last_seen_utc": "2026-04-15 22:41:58", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792481": [ { "ioc_value": "ridgetempo.go0duntenable.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:34:28", "last_seen_utc": "2026-04-15 22:35:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792480": [ { "ioc_value": "solcorea8.go0duntenable.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:28:46", "last_seen_utc": "2026-04-15 22:30:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792479": [ { "ioc_value": "op3n-cast.go0duntenable.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:22:41", "last_seen_utc": "2026-04-15 22:24:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792478": [ { "ioc_value": "hfjivor0.go0duntenable.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:17:11", "last_seen_utc": "2026-04-15 22:20:04", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792477": [ { "ioc_value": "ser-lineor.quant-splashes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:11:36", "last_seen_utc": "2026-04-15 22:14:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792476": [ { "ioc_value": "209.54.101.159:5003", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-15 22:07:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/37fb059d66f036d9fcbde38eae1f577e5c214713ed0f2c2ff42f893c3b16e035/", "tags": "remcos", "anonymous": "0", "reporter": "abuse_ch" } ], "1792475": [ { "ioc_value": "192.227.135.240:3000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-15 22:07:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/5646873f89e3468c306385ef3d65b7daf63aeee4128553c3224c75cb0e6902ca/", "tags": "remcos", "anonymous": "0", "reporter": "abuse_ch" } ], "1792474": [ { "ioc_value": "xuymf0.quant-splashes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:06:24", "last_seen_utc": "2026-04-15 22:06:42", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792473": [ { "ioc_value": "tshev.quant-splashes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 22:00:45", "last_seen_utc": "2026-04-15 22:02:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792472": [ { "ioc_value": "312pl.quant-splashes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:54:40", "last_seen_utc": "2026-04-15 21:56:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792471": [ { "ioc_value": "f1nal-wave.quant-splashes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:49:01", "last_seen_utc": "2026-04-15 21:50:48", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792470": [ { "ioc_value": "zzx2x3.quant-splashes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:43:26", "last_seen_utc": "2026-04-15 21:46:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792468": [ { "ioc_value": "servenum7.marinmort8ager.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:37:55", "last_seen_utc": "2026-04-15 21:42:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792467": [ { "ioc_value": "notifycrystal.marinmort8ager.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:32:19", "last_seen_utc": "2026-04-15 21:34:14", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792465": [ { "ioc_value": "zenvale0um.marinmort8ager.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:26:51", "last_seen_utc": "2026-04-15 21:28:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792464": [ { "ioc_value": "5and-stack.marinmort8ager.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:21:07", "last_seen_utc": "2026-04-15 21:21:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792463": [ { "ioc_value": "talcore4is.marinmort8ager.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:15:39", "last_seen_utc": "2026-04-15 21:18:09", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792461": [ { "ioc_value": "https://mehryanatravel.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792462": [ { "ioc_value": "https://trihc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792456": [ { "ioc_value": "https://malavikasinnerboutique.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792457": [ { "ioc_value": "https://theinfiniteloop.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792458": [ { "ioc_value": "https://i-mpressmta.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792459": [ { "ioc_value": "https://dev.queer.lu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792460": [ { "ioc_value": "https://ezycleanpest.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792453": [ { "ioc_value": "https://afro.bulk2cart.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792454": [ { "ioc_value": "https://skymoodwood.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792455": [ { "ioc_value": "https://corporaterescue.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792449": [ { "ioc_value": "https://rajaraghbirsinghclub.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792450": [ { "ioc_value": "https://1stmaids.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792451": [ { "ioc_value": "https://abdullah-brothers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792452": [ { "ioc_value": "https://huroniapropertymaintenance.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792446": [ { "ioc_value": "https://rompteam.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792447": [ { "ioc_value": "https://effectiveguidesforsales.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792448": [ { "ioc_value": "https://fruitandvine.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792443": [ { "ioc_value": "https://imbookingit.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792444": [ { "ioc_value": "https://modernizemyhome.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792445": [ { "ioc_value": "https://moringaacres.mw/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792440": [ { "ioc_value": "https://transpactechnology.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792441": [ { "ioc_value": "https://autoviplimo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792442": [ { "ioc_value": "https://dataentrywork.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792437": [ { "ioc_value": "https://luminary-group.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792438": [ { "ioc_value": "https://marthapettigrew.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792439": [ { "ioc_value": "https://popartmachine.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792435": [ { "ioc_value": "https://bizownerscoachingforretention.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792436": [ { "ioc_value": "https://hoo-siercoder.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792432": [ { "ioc_value": "https://thetempleofetienne.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792433": [ { "ioc_value": "https://timesofsydney.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792434": [ { "ioc_value": "https://alphainsulationsmelbourne.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792430": [ { "ioc_value": "https://homeperfectionguide.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792431": [ { "ioc_value": "https://theerosmethod.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 21:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792429": [ { "ioc_value": "ejwrfoig.marinmort8ager.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:10:01", "last_seen_utc": "2026-04-15 21:12:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792428": [ { "ioc_value": "mpjim.parchm-susyuka.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 21:04:27", "last_seen_utc": "2026-04-15 21:06:41", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792427": [ { "ioc_value": "driftvoic.parchm-susyuka.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:58:53", "last_seen_utc": "2026-04-15 21:01:14", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792425": [ { "ioc_value": "m0ti9-route.parchm-susyuka.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:53:18", "last_seen_utc": "2026-04-15 20:55:47", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792424": [ { "ioc_value": "civi1-flow.parchm-susyuka.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:47:45", "last_seen_utc": "2026-04-15 20:49:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792423": [ { "ioc_value": "un1oad-sync.parchm-susyuka.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:43:32", "last_seen_utc": "2026-04-15 20:44:41", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792422": [ { "ioc_value": "185.167.61.11:14600", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-15 20:41:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "RAT,RemcosRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1792421": [ { "ioc_value": "eydfdx4.parchm-susyuka.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:37:08", "last_seen_utc": "2026-04-15 20:41:07", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792420": [ { "ioc_value": "mer-crestal.imperturbs1av.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:30:43", "last_seen_utc": "2026-04-15 20:32:45", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792417": [ { "ioc_value": "oassyn.imperturbs1av.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:25:26", "last_seen_utc": "2026-04-15 20:27:43", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792416": [ { "ioc_value": "brave-sens.imperturbs1av.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:19:31", "last_seen_utc": "2026-04-15 20:21:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792415": [ { "ioc_value": "bgo.sequareeus.online", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:16:13", "last_seen_utc": "2026-04-16 10:15:53", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792414": [ { "ioc_value": "https://bgo.sequareeus.online/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:16:09", "last_seen_utc": "2026-04-16 10:15:49", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792413": [ { "ioc_value": "bgo.biolinks.com.br", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:16:03", "last_seen_utc": "2026-04-16 10:15:45", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792412": [ { "ioc_value": "https://bgo.biolinks.com.br/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:16:00", "last_seen_utc": "2026-04-16 10:15:42", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792411": [ { "ioc_value": "https://survika.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792407": [ { "ioc_value": "https://kaimarconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792408": [ { "ioc_value": "https://pjpexporting.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792409": [ { "ioc_value": "https://realproficiencyhub.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792410": [ { "ioc_value": "https://smartbizexpansion.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792403": [ { "ioc_value": "https://affordablediyfixes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792404": [ { "ioc_value": "https://boo-cleaning.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792405": [ { "ioc_value": "https://frischair.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792406": [ { "ioc_value": "https://getcivil.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792398": [ { "ioc_value": "https://millikensreef.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792399": [ { "ioc_value": "https://verynoice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792400": [ { "ioc_value": "https://yellowhouseart.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792401": [ { "ioc_value": "https://help.storeboostkit.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792402": [ { "ioc_value": "https://scarsdaleautobody.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792393": [ { "ioc_value": "https://myhomebetterliving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792394": [ { "ioc_value": "https://strategicgrowthsphere.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792395": [ { "ioc_value": "https://yearroundriders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792396": [ { "ioc_value": "https://greenleavestreeandlandscapesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792397": [ { "ioc_value": "https://lawshucks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792388": [ { "ioc_value": "https://curategifts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792389": [ { "ioc_value": "https://munich-trip.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792390": [ { "ioc_value": "https://amwritingblog.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792391": [ { "ioc_value": "https://bukhshhospital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792392": [ { "ioc_value": "https://homeownershipmanagement.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792383": [ { "ioc_value": "https://realfindersdomain.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792384": [ { "ioc_value": "https://thehomeresources.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792385": [ { "ioc_value": "https://aworldglobalnews.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792386": [ { "ioc_value": "https://b2cafe.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792387": [ { "ioc_value": "https://carcitymotors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792379": [ { "ioc_value": "https://engineeringontheedge.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792380": [ { "ioc_value": "https://homeownerschecklistofimprovements.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792381": [ { "ioc_value": "https://oryxinflightmagazine.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792382": [ { "ioc_value": "https://rankandtrack.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792374": [ { "ioc_value": "https://themmob.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792375": [ { "ioc_value": "https://greatgreenpet.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792376": [ { "ioc_value": "https://homeimprovementmagazine.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792377": [ { "ioc_value": "https://kentpartnership.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792378": [ { "ioc_value": "https://abllogistica.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792373": [ { "ioc_value": "https://technologypundits.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792369": [ { "ioc_value": "https://davesautoglassrepairmountainviewca.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792370": [ { "ioc_value": "https://familybadge.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792371": [ { "ioc_value": "https://lateenough.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792372": [ { "ioc_value": "https://realsproject.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792364": [ { "ioc_value": "https://familymagazine.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792365": [ { "ioc_value": "https://greenoasis.co.nz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792366": [ { "ioc_value": "https://mlm-dra.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792367": [ { "ioc_value": "https://northstonepavehomeimprovementsltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792368": [ { "ioc_value": "https://yearroundhomefixes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792359": [ { "ioc_value": "https://homemanagerorganization.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792360": [ { "ioc_value": "https://homeremodelingandrenovationnewsletter.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792361": [ { "ioc_value": "https://hop-hosting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792362": [ { "ioc_value": "https://internzoo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792363": [ { "ioc_value": "https://proactiveresident.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792355": [ { "ioc_value": "https://creativedecoratingideas.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792356": [ { "ioc_value": "https://discoveryvideos.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792357": [ { "ioc_value": "https://freecarmagazines.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792358": [ { "ioc_value": "https://heroonlinemoney.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792350": [ { "ioc_value": "https://michbelles.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792351": [ { "ioc_value": "https://shelfbucks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792352": [ { "ioc_value": "https://signpast.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792353": [ { "ioc_value": "https://sportsradio610online.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792354": [ { "ioc_value": "https://americanbagger.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792345": [ { "ioc_value": "https://braingainmarketing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792346": [ { "ioc_value": "https://davidmills.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792347": [ { "ioc_value": "https://divorcewell.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792348": [ { "ioc_value": "https://familyvideomovies.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792349": [ { "ioc_value": "https://houserepairlab.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792341": [ { "ioc_value": "https://strategicproficiencyhub.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792342": [ { "ioc_value": "https://valleyfairzone.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792343": [ { "ioc_value": "https://yourhomeintro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792344": [ { "ioc_value": "https://biologyofaging.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792337": [ { "ioc_value": "https://healthylunch.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792338": [ { "ioc_value": "https://iermann.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792339": [ { "ioc_value": "https://legaltermsdictionary.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792340": [ { "ioc_value": "https://livetofitness.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792333": [ { "ioc_value": "https://cardealera.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792334": [ { "ioc_value": "https://cartalkradio.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792335": [ { "ioc_value": "https://clevelandinternships.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792336": [ { "ioc_value": "https://customwheelsdirect.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792330": [ { "ioc_value": "https://harkswindowsandsiding.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792331": [ { "ioc_value": "https://gie.net.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792332": [ { "ioc_value": "https://aisite.wealthlinkmedia.website/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792326": [ { "ioc_value": "https://nonniesdiner.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792327": [ { "ioc_value": "https://benforex.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792328": [ { "ioc_value": "https://syrianeds.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792329": [ { "ioc_value": "https://grupoespacios.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792325": [ { "ioc_value": "https://kewsrs.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 20:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792324": [ { "ioc_value": "euwt.imperturbs1av.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:13:42", "last_seen_utc": "2026-04-15 20:14:56", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792323": [ { "ioc_value": "xcmw.imperturbs1av.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:09:20", "last_seen_utc": "2026-04-15 20:09:22", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792322": [ { "ioc_value": "glashado.imperturbs1av.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 20:02:55", "last_seen_utc": "2026-04-15 20:05:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792321": [ { "ioc_value": "partn4-bridge.expect-runes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:57:12", "last_seen_utc": "2026-04-15 19:59:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792320": [ { "ioc_value": "wnokm63.expect-runes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:51:31", "last_seen_utc": "2026-04-15 19:54:58", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792315": [ { "ioc_value": "2cpd365m.plaque5tucco.digital", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:38:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "clearfake", "anonymous": "1", "reporter": "ttakvam" } ], "1792314": [ { "ioc_value": "wsxrcpse.plaque5tucco.digital", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:37:25", "last_seen_utc": "2026-04-15 19:42:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792313": [ { "ioc_value": "geo-dec0d.expect-runes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:34:58", "last_seen_utc": "2026-04-15 19:35:56", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792312": [ { "ioc_value": "dyndraex.expect-runes.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:29:08", "last_seen_utc": "2026-04-15 19:32:02", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792311": [ { "ioc_value": "https://wxqdcakvuv.com/api.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 19:27:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,ErrTraffic,Metateam1337x-afk", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792310": [ { "ioc_value": "69cy8114.factpre5ent.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:23:24", "last_seen_utc": "2026-04-15 19:26:43", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792309": [ { "ioc_value": "invoicecel.factpre5ent.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:17:56", "last_seen_utc": "2026-04-15 19:22:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792307": [ { "ioc_value": "https://jpdigitalindia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 19:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792308": [ { "ioc_value": "https://thebrisbanetimes.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 19:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792305": [ { "ioc_value": "https://vstkia.mktng-int.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 19:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792306": [ { "ioc_value": "https://thehorizon2025.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 19:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792302": [ { "ioc_value": "https://sareemela.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 19:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792303": [ { "ioc_value": "https://youtransport.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 19:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792304": [ { "ioc_value": "https://sadansh.in10.cdn-alpha.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 19:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792301": [ { "ioc_value": "nv7cx.factpre5ent.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:12:19", "last_seen_utc": "2026-04-15 19:16:27", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792300": [ { "ioc_value": "39rd.factpre5ent.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:06:38", "last_seen_utc": "2026-04-15 19:11:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792299": [ { "ioc_value": "hibcn.factpre5ent.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 19:01:17", "last_seen_utc": "2026-04-15 19:04:53", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792298": [ { "ioc_value": "dispgua.factpre5ent.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:55:26", "last_seen_utc": "2026-04-15 18:56:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792297": [ { "ioc_value": "solmeshos.qen8lorix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:50:06", "last_seen_utc": "2026-04-15 18:51:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792296": [ { "ioc_value": "s0ck-spool.qen8lorix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:44:16", "last_seen_utc": "2026-04-15 18:48:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792295": [ { "ioc_value": "https://www.zoorning.com/zoom.us.invite/downloads/zoom.us.invite.vbs", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:41:13", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom,VBScript", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792294": [ { "ioc_value": "pub-8393efc92b0a4fd198729ebb0d6f7b67.r2.dev", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:39:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792293": [ { "ioc_value": "https://pub-8393efc92b0a4fd198729ebb0d6f7b67.r2.dev/zoom.us.invite.msi", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:39:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792292": [ { "ioc_value": "duskparce.qen8lorix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:38:45", "last_seen_utc": "2026-04-15 18:42:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792291": [ { "ioc_value": "https://www.zoorning.com/zoom.us.invite/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:37:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792290": [ { "ioc_value": "https://www.zoorning.com/zoom.invite/Windows/download.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:36:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792289": [ { "ioc_value": "https://www.zoorning.com/zoom.invite/Windows/install-guide.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:36:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792288": [ { "ioc_value": "https://www.zoorning.com/zoom.invite/Windows/microsoft-store.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:35:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792287": [ { "ioc_value": "https://www.zoorning.com/zoom.invite/Windows/invite.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:35:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792286": [ { "ioc_value": "zoorning.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:34:47", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792285": [ { "ioc_value": "https://painel.guintter.com.br/Windows/download.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:33:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792284": [ { "ioc_value": "https://painel.guintter.com.br/Windows/install-guide.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:33:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792283": [ { "ioc_value": "subtcav.qen8lorix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:33:00", "last_seen_utc": "2026-04-15 18:37:04", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792282": [ { "ioc_value": "https://painel.guintter.com.br/Windows/microsoft-store.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:32:35", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792281": [ { "ioc_value": "https://painel.guintter.com.br/Windows/invite.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:32:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792280": [ { "ioc_value": "painel.guintter.com.br", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:31:52", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792276": [ { "ioc_value": "https://www.meet.google.debacssa.com/Windows/download.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:28:49", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792275": [ { "ioc_value": "https://www.meet.google.debacssa.com/Windows/invite.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:28:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792274": [ { "ioc_value": "https://www.meet.google.debacssa.com/Windows/index3.html", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:28:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792273": [ { "ioc_value": "meet.google.debacssa.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:27:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792272": [ { "ioc_value": "unitecres.qen8lorix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:27:22", "last_seen_utc": "2026-04-15 18:31:50", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792271": [ { "ioc_value": "https://invite.fonoon.ae/Windows/download.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:24:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792270": [ { "ioc_value": "https://invite.fonoon.ae/Windows/install-guide.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:23:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792269": [ { "ioc_value": "https://invite.fonoon.ae/Windows/microsoft-store.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:23:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792268": [ { "ioc_value": "https://invite.fonoon.ae/Windows/invite.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:22:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792267": [ { "ioc_value": "invite.fonoon.ae", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:22:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792266": [ { "ioc_value": "planslow.qen8lorix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:21:45", "last_seen_utc": "2026-04-15 18:26:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792265": [ { "ioc_value": "https://take.ameliaflick.xyz/Windows/download.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:20:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792264": [ { "ioc_value": "https://take.ameliaflick.xyz/Windows/install-guide.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:20:09", "last_seen_utc": "2026-04-15 18:20:32", "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792263": [ { "ioc_value": "https://take.ameliaflick.xyz/Windows/microsoft-store.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:19:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792166": [ { "ioc_value": "cpch.us.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:18:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "kongtuke", "anonymous": "1", "reporter": "tanner" } ], "1792183": [ { "ioc_value": "http://217.69.2.135/HUWe6R8FWrnq2XaXMjonzA%3D%3D", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-15 18:18:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792184": [ { "ioc_value": "http://217.69.3.51/lYc8y7qfNjkARpt8FxAZsw%3D%3D", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-15 18:18:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792185": [ { "ioc_value": "http://217.69.2.135/get_arhive_npm/Zkew%2F1gS%2Bd7eUQ5NwZThvg%3D%3D", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-15 18:18:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792186": [ { "ioc_value": "http://217.69.2.135/darwin-universal/%2BOEP1WW19zry7L%2BAIfWfow%3D%3D?wallet=trezor", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-15 18:18:37", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,wallet-trojan,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792187": [ { "ioc_value": "http://217.69.2.135/darwin-universal/%2BOEP1WW19zry7L%2BAIfWfow%3D%3D?wallet=ledger", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.glassworm", "malware_alias": null, "malware_printable": "GlassWorm", "first_seen_utc": "2026-04-15 18:18:36", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://codeberg.org/tip-o-deincognito/glassworm-writeup", "tags": "glassworm,wallet-trojan,Wave3", "anonymous": "0", "reporter": "tipo_deincognito" } ], "1792189": [ { "ioc_value": "https://weedhack.xyz/files/jar/Pjibf.exe", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.purelogs", "malware_alias": null, "malware_printable": "PureLogs Stealer", "first_seen_utc": "2026-04-15 18:18:36", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "PureHVNC", "anonymous": "0", "reporter": "burger" } ], "1792192": [ { "ioc_value": "45.153.34.18:56002", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-15 18:18:35", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/14118a6070f89baafd5f2aeaf2df7535a8053f99944453584f0d1efeb6501ac3/", "tags": "c2,PureHVNC", "anonymous": "0", "reporter": "burger" } ], "1792262": [ { "ioc_value": "https://take.ameliaflick.xyz/Windows/invite.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:18:35", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792190": [ { "ioc_value": "telemetrydata.to", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-15 18:18:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/14118a6070f89baafd5f2aeaf2df7535a8053f99944453584f0d1efeb6501ac3/", "tags": "c2,PureHVNC", "anonymous": "0", "reporter": "burger" } ], "1792191": [ { "ioc_value": "45.153.34.18:56001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-15 18:18:33", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/14118a6070f89baafd5f2aeaf2df7535a8053f99944453584f0d1efeb6501ac3/", "tags": "c2,PureHVNC", "anonymous": "0", "reporter": "burger" } ], "1792193": [ { "ioc_value": "45.153.34.18:56003", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-15 18:18:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/14118a6070f89baafd5f2aeaf2df7535a8053f99944453584f0d1efeb6501ac3/", "tags": "c2,PureHVNC", "anonymous": "0", "reporter": "burger" } ], "1792213": [ { "ioc_value": "https://www.freejunkcarhauling.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:18:28", "last_seen_utc": null, "confidence_level": 90, "is_compromised": false, "reference": "https://clickfix.carsonww.com/domains/www.freejunkcarhauling.com", "tags": "ClickFix", "anonymous": "0", "reporter": "CarsonWilliams" } ], "1792225": [ { "ioc_value": "https://z3nbyte.top/metrics/public-effect.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-15 18:18:28", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116410056030488409", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1792226": [ { "ioc_value": "z3nbyte.top", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-15 18:18:28", "last_seen_utc": "2026-04-15 18:08:47", "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116410056030488409", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1792227": [ { "ioc_value": "https://z3nbyte.top/metrics/reset-transpiler.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-15 18:18:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116410056030488409", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1792228": [ { "ioc_value": "https://z3nbyte.top/metrics/trace-hook.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-15 18:18:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116410056030488409", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1792261": [ { "ioc_value": "take.ameliaflick.xyz", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:18:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792260": [ { "ioc_value": "vel-spireex.bri4talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:15:58", "last_seen_utc": "2026-04-15 18:18:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792259": [ { "ioc_value": "https://dthit.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792256": [ { "ioc_value": "https://listingberita.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792257": [ { "ioc_value": "https://perfectcatfood.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792258": [ { "ioc_value": "https://onetechsolutions.ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792252": [ { "ioc_value": "https://maritime.webmaze.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792253": [ { "ioc_value": "https://holisticayurveda.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792254": [ { "ioc_value": "https://pcinjski017portal.rs/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792255": [ { "ioc_value": "https://enjoylife.fit/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792249": [ { "ioc_value": "https://coastlafia.edu.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792250": [ { "ioc_value": "https://dcoregym.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792251": [ { "ioc_value": "https://m-und-c-partners.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792247": [ { "ioc_value": "https://taylormiller.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792248": [ { "ioc_value": "https://cardiology-lipidology.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792244": [ { "ioc_value": "https://himaldarpan.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792245": [ { "ioc_value": "https://tropicmagic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792246": [ { "ioc_value": "https://costaricahorsebackriding.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792241": [ { "ioc_value": "https://advoptic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792242": [ { "ioc_value": "https://transformagro.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792243": [ { "ioc_value": "https://royalheritagehealthfoundation.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792240": [ { "ioc_value": "https://mastmediazm.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792238": [ { "ioc_value": "https://nlrindonesia.or.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792239": [ { "ioc_value": "https://kerrylehane.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792235": [ { "ioc_value": "https://zamakhchary.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792236": [ { "ioc_value": "https://qnayds.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792237": [ { "ioc_value": "https://skinlaserlongevity.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792233": [ { "ioc_value": "https://greenstonebuilder.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792234": [ { "ioc_value": "https://tecnospurghiverona.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 18:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792232": [ { "ioc_value": "https://googlejoininvite.click/Windows/files/GoogleMeet-GoogleMeet_o_backup_v8.3.0.85_oid654a1d9b-536a-42f3-8fc0-ce9a9d70eb8f_bidknTIxRjfhU6S6WbVIMuwFw.exe", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:11:02", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792231": [ { "ioc_value": "t1ny-point.bri4talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:10:52", "last_seen_utc": "2026-04-15 18:15:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792230": [ { "ioc_value": "https://googlejoininvite.click/Windows/invite.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:09:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792229": [ { "ioc_value": "googlejoininvite.click", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:09:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792224": [ { "ioc_value": "https://vbhgv.info/Windows/download.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:07:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792223": [ { "ioc_value": "https://vbhgv.info/Windows/install-guide.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:06:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792222": [ { "ioc_value": "https://vbhgv.info/Windows/invite.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:06:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792221": [ { "ioc_value": "vbhgv.info", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:06:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Zoom", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792220": [ { "ioc_value": "tal-forgear.bri4talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 18:05:04", "last_seen_utc": "2026-04-15 18:05:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792219": [ { "ioc_value": "https://meetingwthgooglemeet.top/Windows/microsoft-store.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:04:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792218": [ { "ioc_value": "https://meetingwthgooglemeet.top/Windows/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:04:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792217": [ { "ioc_value": "meetingwthgooglemeet.top", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:04:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792216": [ { "ioc_value": "https://join-nw09web.com/Windows/files/17TWXVV5PRHTS_19SI0B7FBSUF4_windows_x64.msi", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:03:13", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792215": [ { "ioc_value": "https://join-nw09web.com/Windows/invite.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:02:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792214": [ { "ioc_value": "join-nw09web.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 18:02:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Google Meet", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792212": [ { "ioc_value": "qhbvndc7.bri4talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:59:11", "last_seen_utc": "2026-04-15 18:01:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792211": [ { "ioc_value": "2ffmg.bri4talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:53:33", "last_seen_utc": "2026-04-15 17:56:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792210": [ { "ioc_value": "ioncove.bri4talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:48:19", "last_seen_utc": "2026-04-15 17:50:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792209": [ { "ioc_value": "shallo-uni.dru6moxin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:42:27", "last_seen_utc": "2026-04-15 17:45:42", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792206": [ { "ioc_value": "ihrydwg.dru6moxin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:36:40", "last_seen_utc": "2026-04-15 17:37:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792205": [ { "ioc_value": "011kep.dru6moxin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:31:17", "last_seen_utc": "2026-04-15 17:33:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792204": [ { "ioc_value": "https://irgufhdur.space/login", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 17:28:33", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Amnesia Panel", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792203": [ { "ioc_value": "irgufhdur.space", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 17:28:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Amnesia Panel", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1792202": [ { "ioc_value": "fr0st-branch.dru6moxin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:25:56", "last_seen_utc": "2026-04-15 17:28:27", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792201": [ { "ioc_value": "trimarket.dru6moxin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:20:22", "last_seen_utc": "2026-04-15 17:22:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792200": [ { "ioc_value": "alt.sequareeus.online", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 17:16:00", "last_seen_utc": "2026-04-15 19:16:49", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792199": [ { "ioc_value": "https://alt.sequareeus.online/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 17:15:56", "last_seen_utc": "2026-04-15 19:16:45", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792198": [ { "ioc_value": "alt.biolinks.com.br", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 17:15:50", "last_seen_utc": "2026-04-15 19:16:39", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792197": [ { "ioc_value": "https://alt.biolinks.com.br/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 17:15:46", "last_seen_utc": "2026-04-15 19:16:35", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1792196": [ { "ioc_value": "jjfcpkvh.dru6moxin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:14:37", "last_seen_utc": "2026-04-15 17:16:43", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792195": [ { "ioc_value": "tlnsb.zor2laven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:08:46", "last_seen_utc": "2026-04-15 17:11:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792194": [ { "ioc_value": "lps08.zor2laven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 17:03:00", "last_seen_utc": "2026-04-15 17:05:37", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792188": [ { "ioc_value": "proxyeas.zor2laven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:57:43", "last_seen_utc": "2026-04-15 16:59:52", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792182": [ { "ioc_value": "h4rve5-loop.zor2laven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:52:19", "last_seen_utc": "2026-04-15 16:54:00", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792180": [ { "ioc_value": "bm1rtmr.zor2laven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:46:22", "last_seen_utc": "2026-04-15 16:49:08", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792179": [ { "ioc_value": "kaspar-studio.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "win.strelastealer", "malware_alias": null, "malware_printable": "StrelaStealer", "first_seen_utc": "2026-04-15 16:45:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": null, "tags": "StrelaStealer", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792178": [ { "ioc_value": "xxvxsk4x.zor2laven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:40:44", "last_seen_utc": "2026-04-15 16:43:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792177": [ { "ioc_value": "mervaleon1.prax9vitor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:35:25", "last_seen_utc": "2026-04-15 16:37:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792174": [ { "ioc_value": "vialstr.prax9vitor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:29:36", "last_seen_utc": "2026-04-15 16:34:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792173": [ { "ioc_value": "86.135.2.35:7752", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 16:25:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "QuasarRAT,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1792172": [ { "ioc_value": "lnrjp.prax9vitor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:24:03", "last_seen_utc": "2026-04-15 16:24:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792171": [ { "ioc_value": "par5e-array.prax9vitor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:18:27", "last_seen_utc": "2026-04-15 16:20:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792170": [ { "ioc_value": "arrayshore.prax9vitor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:12:43", "last_seen_utc": "2026-04-15 16:14:37", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792169": [ { "ioc_value": "nnid.prax9vitor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:07:39", "last_seen_utc": "2026-04-15 16:09:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792168": [ { "ioc_value": "freshstorage.kry3qelin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 16:01:34", "last_seen_utc": "2026-04-15 16:05:37", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792167": [ { "ioc_value": "neo-tok3.kry3qelin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:57:06", "last_seen_utc": "2026-04-15 16:02:12", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792165": [ { "ioc_value": "proto-dynam1.kry3qelin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:50:52", "last_seen_utc": "2026-04-15 15:58:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792164": [ { "ioc_value": "massivespectra.kry3qelin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:44:53", "last_seen_utc": "2026-04-15 15:53:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792163": [ { "ioc_value": "solnex0ex.kry3qelin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:40:18", "last_seen_utc": "2026-04-15 15:47:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792162": [ { "ioc_value": "registryfaithful.kry3qelin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:34:32", "last_seen_utc": "2026-04-15 15:42:45", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792161": [ { "ioc_value": "wilpol.tul7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:28:32", "last_seen_utc": "2026-04-15 15:39:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792160": [ { "ioc_value": "birdout.tul7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:23:26", "last_seen_utc": "2026-04-15 15:36:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792159": [ { "ioc_value": "queryguard.tul7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:17:15", "last_seen_utc": "2026-04-15 15:27:41", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792158": [ { "ioc_value": "bay-banne.tul7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:12:06", "last_seen_utc": "2026-04-15 15:15:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792157": [ { "ioc_value": "sercore2or.tul7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 15:06:58", "last_seen_utc": "2026-04-15 15:09:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792156": [ { "ioc_value": "5ync-lab.tul7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:58:13", "last_seen_utc": "2026-04-15 14:59:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792155": [ { "ioc_value": "encodersensor.vex1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:51:54", "last_seen_utc": "2026-04-15 14:54:12", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792154": [ { "ioc_value": "https://arrayhouse.org/SqX55Z32TtCh/oA3gW185qmtI.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 14:50:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/045d995dee9b3fba080415be55c932f245582c44d70243fc3fbf0174fd3495bd/", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792153": [ { "ioc_value": "arrayhouse.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 14:50:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/045d995dee9b3fba080415be55c932f245582c44d70243fc3fbf0174fd3495bd/", "tags": "APT,Patchwork", "anonymous": "0", "reporter": "abuse_ch" } ], "1792152": [ { "ioc_value": "psca-gop.org", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-15 14:48:50", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/045d995dee9b3fba080415be55c932f245582c44d70243fc3fbf0174fd3495bd/", "tags": "Patchwork,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1792151": [ { "ioc_value": "shiftcascade.vex1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:46:14", "last_seen_utc": "2026-04-15 14:48:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792150": [ { "ioc_value": "flovv-chain.vex1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:41:41", "last_seen_utc": "2026-04-15 14:42:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792149": [ { "ioc_value": "ychgg.vex1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:35:05", "last_seen_utc": "2026-04-15 14:37:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792148": [ { "ioc_value": "streambreeze.vex1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:30:22", "last_seen_utc": "2026-04-15 14:34:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792142": [ { "ioc_value": "https://byte-shard.top/metrics/reset-transpiler.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-15 14:28:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116409113642006782", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1792143": [ { "ioc_value": "byte-shard.top", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-15 14:28:14", "last_seen_utc": "2026-04-15 14:08:54", "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116409113642006782", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1792144": [ { "ioc_value": "https://byte-shard.top/metrics/trace-hook.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-15 14:28:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116409113642006782", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1792147": [ { "ioc_value": "velline0os.vex1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:24:03", "last_seen_utc": "2026-04-15 14:26:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792146": [ { "ioc_value": "zdjine7o.nor8tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:18:34", "last_seen_utc": "2026-04-15 14:20:58", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792145": [ { "ioc_value": "syxnh65t.nor8tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:13:03", "last_seen_utc": "2026-04-15 14:13:21", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792141": [ { "ioc_value": "talfluxen3.nor8tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:07:28", "last_seen_utc": "2026-04-15 14:10:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792140": [ { "ioc_value": "sketchneuron.nor8tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 14:01:30", "last_seen_utc": "2026-04-15 14:03:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792139": [ { "ioc_value": "fi3rce7-watch.nor8tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:56:07", "last_seen_utc": "2026-04-15 13:58:01", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792138": [ { "ioc_value": "valleydispatcher.nor8tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:50:37", "last_seen_utc": "2026-04-15 13:52:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792137": [ { "ioc_value": "t0mbk.xel5navin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:44:48", "last_seen_utc": "2026-04-15 13:47:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792136": [ { "ioc_value": "vor-coreum.xel5navin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:39:16", "last_seen_utc": "2026-04-15 13:40:42", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792135": [ { "ioc_value": "motmolecu.xel5navin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:33:39", "last_seen_utc": "2026-04-15 13:35:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1792134": [ { "ioc_value": "pb64.duckdns.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-15 13:31:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/a9162085e46a67728e0f4a05a1adaeb4221ccffb0954b1ec80e976250307450a/", "tags": "remcos", "anonymous": "0", "reporter": "abuse_ch" } ], "1792133": [ { "ioc_value": "fundoasis.xel5navin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:28:06", "last_seen_utc": "2026-04-15 13:29:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792132": [ { "ioc_value": "ice-mark.xel5navin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:22:13", "last_seen_utc": "2026-04-15 13:24:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792131": [ { "ioc_value": "dwkch.ru", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 13:20:08", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/d18f44233eedff915615c7d618a50c3fefbd571d0b70e83b4e01339097d208ea/", "tags": "MeshAgent,RMM", "anonymous": "0", "reporter": "abuse_ch" } ], "1792130": [ { "ioc_value": "c-pdf1.ddns.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 13:17:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/JAMESWT_WT/status/2044400047303819382", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1792129": [ { "ioc_value": "dynflux6al.xel5navin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:16:53", "last_seen_utc": "2026-04-15 13:18:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792127": [ { "ioc_value": "https://brightextend.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792128": [ { "ioc_value": "https://mdtcx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792125": [ { "ioc_value": "https://tinkerwiz.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792126": [ { "ioc_value": "https://ilnostrobridge.altervista.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792123": [ { "ioc_value": "https://onorb2.site.tb-hosting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792124": [ { "ioc_value": "https://krisallys-medias.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792121": [ { "ioc_value": "https://farranreefamilyresourcecentre.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792122": [ { "ioc_value": "https://token-ersteller.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792120": [ { "ioc_value": "https://ghorkothon.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 13:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1792119": [ { "ioc_value": "next.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:14:02", "last_seen_utc": "2026-04-15 13:15:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792118": [ { "ioc_value": "vera.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:07:59", "last_seen_utc": "2026-04-15 13:09:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792115": [ { "ioc_value": "nvoaagent.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:07:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/brkalbyrk7/status/2044139560318165073", "tags": "MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792116": [ { "ioc_value": "vastbets.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:07:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/brkalbyrk7/status/2044139560318165073", "tags": "MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792117": [ { "ioc_value": "mrakagent.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:07:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/brkalbyrk7/status/2044139560318165073", "tags": "MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792114": [ { "ioc_value": "http://111.90.143.163:8080/install", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 13:07:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/ctrlaltintel/status/2044362338879312233", "tags": "ClickFucker", "anonymous": "0", "reporter": "abuse_ch" } ], "1792113": [ { "ioc_value": "111.90.143.163:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 13:07:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/ctrlaltintel/status/2044362338879312233", "tags": "ClickFucker", "anonymous": "0", "reporter": "abuse_ch" } ], "1792112": [ { "ioc_value": "saqo.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 13:04:48", "last_seen_utc": "2026-04-15 13:05:55", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1792111": [ { "ioc_value": "152.32.144.5:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 13:03:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/RedDrip7/status/2044239571370815802", "tags": "APT,OceanLotus", "anonymous": "0", "reporter": "abuse_ch" } ], "1792108": [ { "ioc_value": "http://flwoagent.com/gate", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:01:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://gist.github.com/brkalbyrk/d8c136921e15e5a2a07ecf459506ffae", "tags": "MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792109": [ { "ioc_value": "https://flwoagent.com/ledger/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:01:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://gist.github.com/brkalbyrk/d8c136921e15e5a2a07ecf459506ffae", "tags": "MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792110": [ { "ioc_value": "https://flwoagent.com/ledger/live/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:01:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://gist.github.com/brkalbyrk/d8c136921e15e5a2a07ecf459506ffae", "tags": "MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792106": [ { "ioc_value": "http://flwoagent.com/curl/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:01:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://gist.github.com/brkalbyrk/d8c136921e15e5a2a07ecf459506ffae", "tags": "MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792107": [ { "ioc_value": "http://flwoagent.com/dynamic", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:01:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://gist.github.com/brkalbyrk/d8c136921e15e5a2a07ecf459506ffae", "tags": "MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792105": [ { "ioc_value": "flwoagent.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-15 13:01:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://gist.github.com/brkalbyrk/d8c136921e15e5a2a07ecf459506ffae", "tags": "Clickfix,MacSync", "anonymous": "0", "reporter": "abuse_ch" } ], "1792074": [ { "ioc_value": "rostov-uga.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792075": [ { "ioc_value": "alpha-centavr.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792076": [ { "ioc_value": "urugvai.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792077": [ { "ioc_value": "krd-ugpromt.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792079": [ { "ioc_value": "files-storage.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792078": [ { "ioc_value": "azure-s3-bucket.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792080": [ { "ioc_value": "airdefence.gl", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792081": [ { "ioc_value": "s3-microservice-updatehub.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792082": [ { "ioc_value": "network-defender.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792083": [ { "ioc_value": "deluxe.gl", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792084": [ { "ioc_value": "explorer.vg", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792085": [ { "ioc_value": "github-repository.gl", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792086": [ { "ioc_value": "vless-proto.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792087": [ { "ioc_value": "ros-tele.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792088": [ { "ioc_value": "webdrive-select.vg", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792089": [ { "ioc_value": "ccleaner.gl", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792090": [ { "ioc_value": "system-monitor.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792091": [ { "ioc_value": "parent-control.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792092": [ { "ioc_value": "holiday-forever.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792093": [ { "ioc_value": "hosting-control.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792094": [ { "ioc_value": "fileless-market.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792096": [ { "ioc_value": "captcha-verification.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792095": [ { "ioc_value": "immortal-service.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792097": [ { "ioc_value": "webdriver-terminal.vg", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792098": [ { "ioc_value": "firefox.vg", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792099": [ { "ioc_value": "police-center.vg", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792100": [ { "ioc_value": "venom-flagman.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792101": [ { "ioc_value": "ug-network.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:59:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792102": [ { "ioc_value": "command-center.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:58:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792103": [ { "ioc_value": "offshore-storage.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:58:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792104": [ { "ioc_value": "fileshare.vg", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 12:58:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "whoamix302" } ], "1792073": [ { "ioc_value": "isgsofgey.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.netsupportmanager_rat", "malware_alias": "NetSupport", "malware_printable": "NetSupportManager RAT", "first_seen_utc": "2026-04-15 12:54:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/JAMESWT_WT/status/2044309528376672366", "tags": "NetSupport,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1792072": [ { "ioc_value": "isabellathordsen.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:53:46", "last_seen_utc": "2026-04-15 12:53:54", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792071": [ { "ioc_value": "idev101.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:53:33", "last_seen_utc": "2026-04-15 12:53:44", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792070": [ { "ioc_value": "hyggelig-news.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:53:26", "last_seen_utc": "2026-04-15 12:53:32", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792068": [ { "ioc_value": "lkhpihf.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.netsupportmanager_rat", "malware_alias": "NetSupport", "malware_printable": "NetSupportManager RAT", "first_seen_utc": "2026-04-15 12:53:16", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/JAMESWT_WT/status/2044309528376672366", "tags": "NetSupport,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1792069": [ { "ioc_value": "lkboasprqw.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.netsupportmanager_rat", "malware_alias": "NetSupport", "malware_printable": "NetSupportManager RAT", "first_seen_utc": "2026-04-15 12:53:16", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/JAMESWT_WT/status/2044309528376672366", "tags": "NetSupport,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1792067": [ { "ioc_value": "hondavaughan.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:53:11", "last_seen_utc": "2026-04-15 12:53:24", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792066": [ { "ioc_value": "hondathornhill.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:52:52", "last_seen_utc": "2026-04-15 12:53:08", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792065": [ { "ioc_value": "hondathornhill.ca", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:52:36", "last_seen_utc": "2026-04-15 12:52:50", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792064": [ { "ioc_value": "hondaofvaughan.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:52:19", "last_seen_utc": "2026-04-15 12:52:33", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792063": [ { "ioc_value": "hondaoftoronto.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:52:00", "last_seen_utc": "2026-04-15 12:52:17", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792062": [ { "ioc_value": "hondaofthornill.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:51:45", "last_seen_utc": "2026-04-15 12:51:57", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792061": [ { "ioc_value": "hondaofnorthtoronto.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:51:29", "last_seen_utc": "2026-04-15 12:51:42", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792059": [ { "ioc_value": "hondaofnorthtoronto.ca", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:51:09", "last_seen_utc": "2026-04-15 12:51:27", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792060": [ { "ioc_value": "130.12.180.28:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:51:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/Fact_Finder03/status/2044295240425844975", "tags": "CryptorPanel", "anonymous": "0", "reporter": "abuse_ch" } ], "1792058": [ { "ioc_value": "hondaoffnorthtoronto.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:50:50", "last_seen_utc": "2026-04-15 12:51:06", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792057": [ { "ioc_value": "hondanorthtoronto.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:50:35", "last_seen_utc": "2026-04-15 12:50:48", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792054": [ { "ioc_value": "188.214.144.18:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:50:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/Fact_Finder03/status/2044293562721075686", "tags": "Curse,CurseBot", "anonymous": "0", "reporter": "abuse_ch" } ], "1792055": [ { "ioc_value": "188.214.144.18:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:50:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/Fact_Finder03/status/2044293562721075686", "tags": "Curse,CurseBot", "anonymous": "0", "reporter": "abuse_ch" } ], "1792056": [ { "ioc_value": "45.154.98.217:5000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:50:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/Fact_Finder03/status/2044293562721075686", "tags": "Curse,CurseBot", "anonymous": "0", "reporter": "abuse_ch" } ], "1792053": [ { "ioc_value": "hondanorthtoronto.ca", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:50:18", "last_seen_utc": "2026-04-15 12:50:33", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792052": [ { "ioc_value": "hokusetsu-ikimono.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:49:58", "last_seen_utc": "2026-04-15 12:50:16", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792051": [ { "ioc_value": "friendsoffortmacon.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:49:42", "last_seen_utc": "2026-04-15 12:49:55", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792050": [ { "ioc_value": "festra.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:49:26", "last_seen_utc": "2026-04-15 12:49:40", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792049": [ { "ioc_value": "141.147.45.169:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:49:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/Fact_Finder03/status/2044297770341937339", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1792048": [ { "ioc_value": "esteticauab.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:49:09", "last_seen_utc": "2026-04-15 12:49:24", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792047": [ { "ioc_value": "elmotahedaclean.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:48:51", "last_seen_utc": "2026-04-15 12:49:07", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792046": [ { "ioc_value": "http://195.201.194.107:8010/api/validate/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:48:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/abh1sek/status/2044260573324685605", "tags": "js-logger-pack", "anonymous": "0", "reporter": "abuse_ch" } ], "1792044": [ { "ioc_value": "195.201.194.107:8010", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:48:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/abh1sek/status/2044260573324685605", "tags": "js-logger-pack", "anonymous": "0", "reporter": "abuse_ch" } ], "1792045": [ { "ioc_value": "elcronistadiario.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:48:35", "last_seen_utc": "2026-04-15 12:48:48", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792043": [ { "ioc_value": "edwardmermelstein.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:48:18", "last_seen_utc": "2026-04-15 12:48:32", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792042": [ { "ioc_value": "edelamarre.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:47:59", "last_seen_utc": "2026-04-15 12:48:15", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792041": [ { "ioc_value": "corregidorphilippines.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:47:41", "last_seen_utc": "2026-04-15 12:47:57", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792040": [ { "ioc_value": "collapsinghorsetheatre.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:47:21", "last_seen_utc": "2026-04-15 12:47:39", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792039": [ { "ioc_value": "buyahonda.ca", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:46:57", "last_seen_utc": "2026-04-15 12:47:18", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791785": [ { "ioc_value": "154.9.227.191:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791783": [ { "ioc_value": "107.175.1.26:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791784": [ { "ioc_value": "64.83.33.237:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791786": [ { "ioc_value": "45.77.69.174:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791787": [ { "ioc_value": "45.77.69.174:8081", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791788": [ { "ioc_value": "39.97.57.113:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791789": [ { "ioc_value": "47.250.141.249:19998", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791790": [ { "ioc_value": "208.87.201.115:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791791": [ { "ioc_value": "64.7.199.177:10882", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791792": [ { "ioc_value": "64.7.199.177:18084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791793": [ { "ioc_value": "110.41.71.46:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792038": [ { "ioc_value": "buddyboybrands.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:46:41", "last_seen_utc": "2026-04-15 12:46:55", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791794": [ { "ioc_value": "8.130.215.153:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:40", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791795": [ { "ioc_value": "8.163.19.200:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791796": [ { "ioc_value": "82.156.127.116:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791797": [ { "ioc_value": "38.49.38.233:8765", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791798": [ { "ioc_value": "165.154.245.177:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791799": [ { "ioc_value": "45.207.210.150:8883", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791800": [ { "ioc_value": "103.106.230.240:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:37", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791801": [ { "ioc_value": "107.173.50.53:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:37", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791802": [ { "ioc_value": "150.158.103.85:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:35", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791803": [ { "ioc_value": "205.186.112.15:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:35", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791804": [ { "ioc_value": "205.186.112.15:8089", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791805": [ { "ioc_value": "83.229.120.101:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791806": [ { "ioc_value": "47.76.185.85:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:33", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791807": [ { "ioc_value": "193.31.28.155:2082", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:33", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791808": [ { "ioc_value": "193.31.28.155:2086", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791809": [ { "ioc_value": "49.232.105.96:18888", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791810": [ { "ioc_value": "111.228.2.9:50002", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791811": [ { "ioc_value": "113.44.90.0:8056", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791812": [ { "ioc_value": "38.181.44.109:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791813": [ { "ioc_value": "38.181.44.109:8089", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791814": [ { "ioc_value": "38.181.44.109:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792037": [ { "ioc_value": "bluarmorhelmets.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:46:23", "last_seen_utc": "2026-04-15 12:46:39", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791815": [ { "ioc_value": "83.229.123.240:23679", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791816": [ { "ioc_value": "49.234.28.41:8085", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791817": [ { "ioc_value": "113.44.78.152:18088", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791818": [ { "ioc_value": "23.224.69.108:3308", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791819": [ { "ioc_value": "23.224.69.109:3308", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791820": [ { "ioc_value": "23.224.69.106:3308", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:17", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791822": [ { "ioc_value": "23.224.69.110:3308", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:16", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791821": [ { "ioc_value": "23.224.69.107:3308", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:13", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791823": [ { "ioc_value": "39.101.174.60:8083", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791824": [ { "ioc_value": "60.205.5.254:8899", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791825": [ { "ioc_value": "8.138.251.8:8083", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791826": [ { "ioc_value": "60.205.95.107:5432", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791827": [ { "ioc_value": "107.172.142.207:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791828": [ { "ioc_value": "47.110.72.155:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791829": [ { "ioc_value": "8.218.240.166:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:08", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791830": [ { "ioc_value": "8.145.41.135:14122", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:08", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791831": [ { "ioc_value": "45.192.99.112:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:07", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791833": [ { "ioc_value": "192.144.148.8:8000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791832": [ { "ioc_value": "45.192.99.121:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791836": [ { "ioc_value": "106.75.7.239:1433", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791834": [ { "ioc_value": "121.41.84.136:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:02", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791835": [ { "ioc_value": "106.75.7.239:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792036": [ { "ioc_value": "automotoclassicsale.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:46:01", "last_seen_utc": "2026-04-15 12:46:20", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791837": [ { "ioc_value": "83.229.123.193:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:46:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791838": [ { "ioc_value": "139.196.89.43:19999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791839": [ { "ioc_value": "149.104.24.149:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791841": [ { "ioc_value": "45.207.194.238:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791840": [ { "ioc_value": "129.204.227.135:56651", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791842": [ { "ioc_value": "129.204.76.212:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791843": [ { "ioc_value": "124.220.16.198:18084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791844": [ { "ioc_value": "47.76.237.133:63484", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791845": [ { "ioc_value": "175.178.12.127:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791846": [ { "ioc_value": "107.175.185.73:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791847": [ { "ioc_value": "8.130.190.133:8090", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:53", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791848": [ { "ioc_value": "102.129.165.177:8545", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:52", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791849": [ { "ioc_value": "8.140.236.137:10000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:52", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791850": [ { "ioc_value": "108.187.4.216:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791851": [ { "ioc_value": "108.187.4.216:8085", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791852": [ { "ioc_value": "47.79.123.84:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:50", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791853": [ { "ioc_value": "47.79.123.84:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:50", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791855": [ { "ioc_value": "198.46.234.37:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:50", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791854": [ { "ioc_value": "38.55.200.183:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:48", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791856": [ { "ioc_value": "157.230.250.121:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:47", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791857": [ { "ioc_value": "104.168.94.108:38001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791858": [ { "ioc_value": "114.67.97.16:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791859": [ { "ioc_value": "154.8.136.171:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791860": [ { "ioc_value": "155.94.154.120:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791861": [ { "ioc_value": "149.104.27.136:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791862": [ { "ioc_value": "139.180.222.237:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791863": [ { "ioc_value": "8.210.248.241:8088", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791864": [ { "ioc_value": "8.138.0.204:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791865": [ { "ioc_value": "45.136.15.98:8098", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791866": [ { "ioc_value": "116.204.34.3:1234", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:40", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792035": [ { "ioc_value": "asoprimatologicacolombiana.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:45:39", "last_seen_utc": "2026-04-15 12:45:58", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791867": [ { "ioc_value": "116.204.34.3:42314", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791868": [ { "ioc_value": "24.144.69.220:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791869": [ { "ioc_value": "39.105.213.210:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791870": [ { "ioc_value": "167.253.156.34:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791871": [ { "ioc_value": "139.180.213.27:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791872": [ { "ioc_value": "139.180.213.27:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791873": [ { "ioc_value": "154.206.99.60:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791874": [ { "ioc_value": "154.211.7.41:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791875": [ { "ioc_value": "134.122.140.110:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791876": [ { "ioc_value": "39.98.70.94:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791877": [ { "ioc_value": "182.92.128.236:58084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791878": [ { "ioc_value": "159.75.161.182:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791879": [ { "ioc_value": "42.51.34.56:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791880": [ { "ioc_value": "23.94.87.135:8011", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:28", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791881": [ { "ioc_value": "140.82.3.117:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:26", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791882": [ { "ioc_value": "106.75.141.4:1399", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:26", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791883": [ { "ioc_value": "1.94.67.53:8085", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791884": [ { "ioc_value": "113.249.109.219:7443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791885": [ { "ioc_value": "43.133.218.169:12736", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791886": [ { "ioc_value": "115.190.247.97:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791887": [ { "ioc_value": "158.94.208.64:1433", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791888": [ { "ioc_value": "158.94.208.64:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791889": [ { "ioc_value": "156.238.239.253:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791890": [ { "ioc_value": "45.76.148.187:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:22", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792034": [ { "ioc_value": "90phutxvf.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:45:22", "last_seen_utc": "2026-04-15 12:45:36", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791891": [ { "ioc_value": "144.172.103.194:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:21", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791892": [ { "ioc_value": "144.172.103.194:9090", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:21", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791893": [ { "ioc_value": "45.77.45.191:20001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791894": [ { "ioc_value": "60.205.184.39:8089", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791895": [ { "ioc_value": "103.123.133.179:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791896": [ { "ioc_value": "101.132.34.211:8085", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791897": [ { "ioc_value": "38.207.178.109:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791898": [ { "ioc_value": "38.207.178.192:40010", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791899": [ { "ioc_value": "43.142.182.140:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:17", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791900": [ { "ioc_value": "206.188.196.221:8081", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:16", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791901": [ { "ioc_value": "113.45.133.173:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791902": [ { "ioc_value": "47.108.79.152:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791903": [ { "ioc_value": "152.32.171.230:65534", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791904": [ { "ioc_value": "117.72.217.16:8767", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791905": [ { "ioc_value": "166.88.97.92:808", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791906": [ { "ioc_value": "192.3.0.168:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791907": [ { "ioc_value": "113.44.152.115:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:13", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791908": [ { "ioc_value": "47.96.87.75:1883", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:13", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791909": [ { "ioc_value": "38.165.21.163:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791910": [ { "ioc_value": "124.223.47.219:4444", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791911": [ { "ioc_value": "60.205.164.207:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791912": [ { "ioc_value": "60.205.164.207:8085", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791913": [ { "ioc_value": "43.142.149.191:6002", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791914": [ { "ioc_value": "173.242.114.162:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791915": [ { "ioc_value": "111.228.55.97:8002", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791916": [ { "ioc_value": "158.94.211.163:18084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791917": [ { "ioc_value": "45.83.140.232:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791918": [ { "ioc_value": "45.77.46.209:1234", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791919": [ { "ioc_value": "64.81.112.22:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791920": [ { "ioc_value": "103.110.221.210:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791921": [ { "ioc_value": "47.111.25.93:40001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791922": [ { "ioc_value": "154.82.110.104:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791923": [ { "ioc_value": "172.245.156.179:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791924": [ { "ioc_value": "43.156.17.196:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791925": [ { "ioc_value": "104.168.145.21:2086", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791926": [ { "ioc_value": "104.168.145.21:2088", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:45:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792033": [ { "ioc_value": "90phutxve.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:44:59", "last_seen_utc": "2026-04-15 12:45:19", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-je4t5agx8r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791929": [ { "ioc_value": "23.94.49.188:10000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791927": [ { "ioc_value": "143.198.56.205:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791928": [ { "ioc_value": "38.60.212.74:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791930": [ { "ioc_value": "47.118.23.79:3306", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:55", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791931": [ { "ioc_value": "103.27.186.74:58084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:55", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791932": [ { "ioc_value": "39.102.125.11:10001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791935": [ { "ioc_value": "104.234.15.90:45662", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791933": [ { "ioc_value": "202.95.17.188:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:53", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791934": [ { "ioc_value": "43.154.134.124:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:53", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791936": [ { "ioc_value": "180.76.121.70:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:52", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791937": [ { "ioc_value": "120.26.119.225:3001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791938": [ { "ioc_value": "107.174.186.201:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792032": [ { "ioc_value": "rophimz.fm", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:44:50", "last_seen_utc": "2026-04-15 12:44:57", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-kg5pwacy4v", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791940": [ { "ioc_value": "1.94.184.17:60001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:48", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791942": [ { "ioc_value": "8.141.88.204:38084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:48", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791939": [ { "ioc_value": "206.238.115.109:2086", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:47", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791941": [ { "ioc_value": "107.175.136.149:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791943": [ { "ioc_value": "45.151.135.248:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791944": [ { "ioc_value": "39.99.156.148:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791945": [ { "ioc_value": "122.51.118.220:61616", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791946": [ { "ioc_value": "103.136.150.48:18083", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791947": [ { "ioc_value": "103.136.150.98:60333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791948": [ { "ioc_value": "103.136.150.98:60334", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791949": [ { "ioc_value": "103.136.150.98:60335", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791950": [ { "ioc_value": "103.136.150.98:60336", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791952": [ { "ioc_value": "103.136.150.98:60339", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791951": [ { "ioc_value": "103.136.150.98:60337", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791954": [ { "ioc_value": "137.220.134.198:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791953": [ { "ioc_value": "45.61.136.92:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:40", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791955": [ { "ioc_value": "114.66.63.237:18088", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791956": [ { "ioc_value": "123.60.57.4:18889", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791957": [ { "ioc_value": "122.51.141.33:9443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792031": [ { "ioc_value": "rophims.vip", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:44:39", "last_seen_utc": "2026-04-15 12:44:47", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-kl64hacz5x", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791958": [ { "ioc_value": "206.206.78.209:2082", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791959": [ { "ioc_value": "154.222.30.199:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791960": [ { "ioc_value": "8.217.179.11:18090", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:37", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791961": [ { "ioc_value": "8.217.179.11:28090", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:37", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791962": [ { "ioc_value": "101.35.150.143:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:36", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791963": [ { "ioc_value": "120.46.151.226:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:36", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791964": [ { "ioc_value": "120.46.151.226:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791965": [ { "ioc_value": "154.222.16.170:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791966": [ { "ioc_value": "1.13.198.88:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791968": [ { "ioc_value": "38.207.178.19:21010", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791967": [ { "ioc_value": "192.238.133.156:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791969": [ { "ioc_value": "115.159.111.226:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:28", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791970": [ { "ioc_value": "27.124.32.209:8888", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:28", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791971": [ { "ioc_value": "39.97.217.114:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:28", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791972": [ { "ioc_value": "45.76.17.176:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791973": [ { "ioc_value": "45.76.17.176:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:26", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791974": [ { "ioc_value": "45.76.17.176:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:26", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791976": [ { "ioc_value": "117.72.197.111:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791975": [ { "ioc_value": "116.211.150.196:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791977": [ { "ioc_value": "47.100.80.108:8888", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791978": [ { "ioc_value": "149.104.29.101:8188", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:22", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791979": [ { "ioc_value": "45.61.136.107:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:22", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791980": [ { "ioc_value": "149.104.29.149:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:21", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791981": [ { "ioc_value": "204.194.51.23:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791982": [ { "ioc_value": "115.190.107.99:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791985": [ { "ioc_value": "154.222.24.78:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791983": [ { "ioc_value": "152.32.169.68:12345", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791984": [ { "ioc_value": "192.3.211.176:19999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791986": [ { "ioc_value": "173.254.211.27:2096", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791987": [ { "ioc_value": "110.42.215.163:53321", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:16", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791988": [ { "ioc_value": "68.64.178.130:8082", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:16", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791989": [ { "ioc_value": "68.64.178.130:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791990": [ { "ioc_value": "124.220.55.115:1223", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791991": [ { "ioc_value": "120.26.208.69:25443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791992": [ { "ioc_value": "110.42.232.120:8086", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791993": [ { "ioc_value": "124.223.193.202:1234", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791994": [ { "ioc_value": "83.229.127.46:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791995": [ { "ioc_value": "107.173.85.228:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:13", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792030": [ { "ioc_value": "xoilacsosa.live", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:44:13", "last_seen_utc": "2026-04-15 12:44:36", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-ntg15afx9z", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791996": [ { "ioc_value": "38.47.239.223:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791997": [ { "ioc_value": "178.104.134.16:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791999": [ { "ioc_value": "143.110.189.209:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:11", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791998": [ { "ioc_value": "104.244.91.64:18082", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792000": [ { "ioc_value": "47.238.155.133:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:09", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792001": [ { "ioc_value": "115.190.123.59:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:09", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792002": [ { "ioc_value": "115.190.123.59:8081", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:09", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792003": [ { "ioc_value": "115.190.123.59:19999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:08", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792029": [ { "ioc_value": "2degvees.za.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:44:06", "last_seen_utc": "2026-04-15 12:44:09", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-mbf6faew6x", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792004": [ { "ioc_value": "203.91.76.75:10000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792005": [ { "ioc_value": "203.91.76.75:10002", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792006": [ { "ioc_value": "203.91.76.72:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792007": [ { "ioc_value": "14.103.168.28:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792008": [ { "ioc_value": "38.38.251.244:8086", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:02", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792009": [ { "ioc_value": "47.57.228.161:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792010": [ { "ioc_value": "202.61.87.139:4433", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792011": [ { "ioc_value": "202.61.87.139:60000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:44:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792013": [ { "ioc_value": "103.213.244.105:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792014": [ { "ioc_value": "82.156.29.15:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792015": [ { "ioc_value": "107.173.10.187:58082", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792028": [ { "ioc_value": "open88a.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:43:59", "last_seen_utc": "2026-04-15 12:44:03", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-mbf6faew6x", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792012": [ { "ioc_value": "103.213.244.104:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792016": [ { "ioc_value": "77.93.157.134:8090", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792017": [ { "ioc_value": "77.93.157.178:3389", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792027": [ { "ioc_value": "100.106.194.93:4782", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 12:43:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-mbhz2aew6z", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1792018": [ { "ioc_value": "117.72.74.158:10086", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:55", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792019": [ { "ioc_value": "45.144.137.235:8085", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:55", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792020": [ { "ioc_value": "45.144.137.235:8086", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792023": [ { "ioc_value": "154.211.89.222:8088", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792021": [ { "ioc_value": "45.144.137.235:8087", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:53", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792022": [ { "ioc_value": "154.211.89.222:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:52", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792024": [ { "ioc_value": "43.143.28.114:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792025": [ { "ioc_value": "124.70.133.212:50070", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1792026": [ { "ioc_value": "143.110.208.51:8084", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.vshell", "malware_alias": null, "malware_printable": "VShell", "first_seen_utc": "2026-04-15 12:43:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.nviso.eu/blog/nviso-analyzes-vshell-post-exploitation-tool", "tags": "NVISO,VShell", "anonymous": "0", "reporter": "0xThiebaut" } ], "1791782": [ { "ioc_value": "http://95.85.238.4/e99c8470d3ebe7696e4a.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.stealc", "malware_alias": null, "malware_printable": "Stealc", "first_seen_utc": "2026-04-15 12:43:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/d4d1f46ee0dcac7bb04ac3689a85c3e9afa4d21f0b96a1ba9ca1383476703ed3/", "tags": "c2,StealC", "anonymous": "0", "reporter": "burger" } ], "1791781": [ { "ioc_value": "needle.knavequest.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 12:33:42", "last_seen_utc": "2026-04-16 10:16:11", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "odiznrio,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791780": [ { "ioc_value": "http://needle.knavequest.sbs", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 12:33:39", "last_seen_utc": "2026-04-16 10:16:07", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "odiznrio,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791779": [ { "ioc_value": "zsj7xqo.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 12:27:42", "last_seen_utc": "2026-04-15 12:30:08", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791769": [ { "ioc_value": "https://remotev2.weedhack.xyz/ws/client", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:22:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "C2,WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791772": [ { "ioc_value": "https://weedhack.xyz/files/jar/elevator", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:22:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791773": [ { "ioc_value": "https://weedhack.xyz/files/jar/component", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:22:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791774": [ { "ioc_value": "https://weedhack.xyz/files/jar/RuntimeBroker.exe", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:22:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791775": [ { "ioc_value": "https://weedhack.xyz/files/jar/module", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:22:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791776": [ { "ioc_value": "https://weedhack.xyz/files/jar/module2", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:22:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791777": [ { "ioc_value": "https://weedhack.xyz/files/jar/security", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:22:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791778": [ { "ioc_value": "sxbrp.bri1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 12:22:28", "last_seen_utc": "2026-04-15 12:24:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791771": [ { "ioc_value": "https://t.me/driotrillo", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 12:17:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/aa85d8c2244084703774d4243e1be0b85c7484eac30b0995e5d2432b43f78b4c/", "tags": "odiznrio,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791770": [ { "ioc_value": "columnapi.dru9vexon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 12:16:54", "last_seen_utc": "2026-04-15 12:21:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791768": [ { "ioc_value": "cha.rapidphonebuyer.co.uk", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 12:14:08", "last_seen_utc": "2026-04-16 11:14:58", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "d0b0p,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791767": [ { "ioc_value": "https://cha.rapidphonebuyer.co.uk/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 12:14:05", "last_seen_utc": "2026-04-16 11:14:54", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "d0b0p,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791766": [ { "ioc_value": "nimblehon.zor4melax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 12:11:06", "last_seen_utc": "2026-04-15 12:13:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791753": [ { "ioc_value": "62.60.148.18:1488", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:09:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://app.any.run/tasks/6e21bee3-5c32-4dbf-9c52-dadb41a7fec9", "tags": "c2", "anonymous": "0", "reporter": "burger" } ], "1791755": [ { "ioc_value": "rivalmods.biz", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:09:21", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "burger" } ], "1791756": [ { "ioc_value": "divinex.at", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:09:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": null, "anonymous": "0", "reporter": "burger" } ], "1791763": [ { "ioc_value": "weedhack.xyz", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:09:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791764": [ { "ioc_value": "remotev2.weedhack.xyz", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:09:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://app.any.run/tasks/e718cca6-c8cd-4085-af62-d321ebaa3a49", "tags": "c2,WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791765": [ { "ioc_value": "remotev3.weedhack.xyz", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 12:09:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://www.virustotal.com/gui/domain/weedhack.xyz/relations", "tags": "c2,WeedHack", "anonymous": "0", "reporter": "burger" } ], "1791762": [ { "ioc_value": "gp0zfju.prax5litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 12:05:17", "last_seen_utc": "2026-04-15 12:07:46", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791761": [ { "ioc_value": "zebi.kozow.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-15 12:01:09", "last_seen_utc": "2026-04-15 12:01:15", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-nl46pacx4m", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1791760": [ { "ioc_value": "zebi.giize.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-15 12:01:06", "last_seen_utc": "2026-04-15 12:01:12", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-nl46pacx4m", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1791759": [ { "ioc_value": "noajadfylf.localto.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-15 12:01:03", "last_seen_utc": "2026-04-15 12:01:17", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-jwqntsct2x", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1791758": [ { "ioc_value": "neo-f0rge.kry6navex.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:59:29", "last_seen_utc": "2026-04-15 12:01:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791757": [ { "ioc_value": "routerwago.tul2qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:55:21", "last_seen_utc": "2026-04-15 11:56:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791754": [ { "ioc_value": "il2l4822.vex8talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:48:45", "last_seen_utc": "2026-04-15 11:51:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791752": [ { "ioc_value": "http://o.cutanddrop.com/forum/viewtopic.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.pony", "malware_alias": "Siplog,Fareit", "malware_printable": "Pony", "first_seen_utc": "2026-04-15 11:45:28", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "Pony", "anonymous": "0", "reporter": "abuse_ch" } ], "1791751": [ { "ioc_value": "http://o.casasferiasacores.org/forum/viewtopic.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.pony", "malware_alias": "Siplog,Fareit", "malware_printable": "Pony", "first_seen_utc": "2026-04-15 11:45:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "Pony", "anonymous": "0", "reporter": "abuse_ch" } ], "1791750": [ { "ioc_value": "gbg.biolinks.com.br", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 11:44:54", "last_seen_utc": "2026-04-15 16:16:32", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791749": [ { "ioc_value": "https://gbg.biolinks.com.br/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 11:44:51", "last_seen_utc": "2026-04-15 16:16:27", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791748": [ { "ioc_value": "m0ss5-watch.nor3liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:43:51", "last_seen_utc": "2026-04-15 11:46:46", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791747": [ { "ioc_value": "http://107.189.24.190:80", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 11:43:19", "last_seen_utc": "2026-04-16 11:13:26", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "gr00n1,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791738": [ { "ioc_value": "139.224.23.63:8866", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 11:39:45", "last_seen_utc": "2026-04-16 10:51:37", "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Agentemis,BEACON,Cobalt Strike,CobaltStrike,cobeacon", "anonymous": "0", "reporter": "whoamix302" } ], "1791739": [ { "ioc_value": "103.217.252.157:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 11:39:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Agentemis,BEACON,Cobalt Strike,CobaltStrike,cobeacon", "anonymous": "0", "reporter": "whoamix302" } ], "1791746": [ { "ioc_value": "ind3-spool.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:37:29", "last_seen_utc": "2026-04-15 11:40:01", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791745": [ { "ioc_value": "dr1ve-trail.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:31:56", "last_seen_utc": "2026-04-15 11:33:04", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791744": [ { "ioc_value": "52.220.247.175:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 11:31:30", "last_seen_utc": "2026-04-16 10:59:07", "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/03ca7bcc97fccc10ac293492afc385f3d50916060d6692a8ccc631176f7fda0a/", "tags": "CobaltStrike", "anonymous": "0", "reporter": "abuse_ch" } ], "1791743": [ { "ioc_value": "emuwa.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:26:40", "last_seen_utc": "2026-04-15 11:27:43", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791742": [ { "ioc_value": "zvdfsddefdfd.cn", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-15 11:24:16", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3ad7da28ef1ba24f7724bf52425bc936f013b94f9e369ad84e1bcb860286f5e9/", "tags": "RAT,ValleyRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1791741": [ { "ioc_value": "http://52.220.247.175:443/jquery-3.3.2.slim.min.js", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 11:21:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/03ca7bcc97fccc10ac293492afc385f3d50916060d6692a8ccc631176f7fda0a/", "tags": "cobaltstrike", "anonymous": "0", "reporter": "abuse_ch" } ], "1791740": [ { "ioc_value": "normarkis2.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:20:41", "last_seen_utc": "2026-04-15 11:22:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791737": [ { "ioc_value": "quordraa.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:14:41", "last_seen_utc": "2026-04-15 11:16:56", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791736": [ { "ioc_value": "gbg.rapidphonebuyer.co.uk", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 11:13:42", "last_seen_utc": "2026-04-15 11:44:08", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "d0b0p,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791735": [ { "ioc_value": "https://gbg.rapidphonebuyer.co.uk/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 11:13:40", "last_seen_utc": "2026-04-15 11:44:04", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "d0b0p,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791734": [ { "ioc_value": "jvrsolutions.com.br", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "win.strelastealer", "malware_alias": null, "malware_printable": "StrelaStealer", "first_seen_utc": "2026-04-15 11:10:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": null, "tags": "StrelaStealer", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791733": [ { "ioc_value": "clusterbright.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:09:13", "last_seen_utc": "2026-04-15 11:11:43", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791681": [ { "ioc_value": "http://134.122.169.42:8888/supershell/login/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 11:04:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "AS152194,CTG Server Limited,supershell", "anonymous": "0", "reporter": "antiphishorg" } ], "1791682": [ { "ioc_value": "134.122.169.42:8888", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 11:04:44", "last_seen_utc": "2026-04-15 11:19:22", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "AS152194,CTG Server Limited,supershell", "anonymous": "0", "reporter": "antiphishorg" } ], "1791684": [ { "ioc_value": "cpanel.theresiliencefactorpodcast.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.fakeupdates", "malware_alias": "FakeUpdate,GhoLoader,SocGholish", "malware_printable": "FAKEUPDATES", "first_seen_utc": "2026-04-15 11:04:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116407697390820430", "tags": "SocGholish", "anonymous": "0", "reporter": "monitorsg" } ], "1791732": [ { "ioc_value": "opt13-mesh.qen7tavil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 11:03:44", "last_seen_utc": "2026-04-15 11:05:02", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791728": [ { "ioc_value": "zenmark1a.bri1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:58:08", "last_seen_utc": "2026-04-15 10:59:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791727": [ { "ioc_value": "47.109.23.77:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 10:52:34", "last_seen_utc": "2026-04-16 10:57:46", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1791726": [ { "ioc_value": "lumnex7os.bri1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:52:29", "last_seen_utc": "2026-04-15 10:54:21", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791725": [ { "ioc_value": "zecyxfgt.bri1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:46:53", "last_seen_utc": "2026-04-15 10:48:55", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791724": [ { "ioc_value": "k3rne-signal.bri1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:41:16", "last_seen_utc": "2026-04-15 10:44:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791723": [ { "ioc_value": "1ndex2-gate.bri1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:35:30", "last_seen_utc": "2026-04-15 10:35:58", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791722": [ { "ioc_value": "ar2ymo.bri1laxon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:30:23", "last_seen_utc": "2026-04-15 10:33:00", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791721": [ { "ioc_value": "tenquarr.dru9vexon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:24:36", "last_seen_utc": "2026-04-15 10:26:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791720": [ { "ioc_value": "lively-obser.dru9vexon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:18:54", "last_seen_utc": "2026-04-15 10:20:53", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791719": [ { "ioc_value": "qu4r9-scope.dru9vexon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:12:58", "last_seen_utc": "2026-04-15 10:13:23", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791718": [ { "ioc_value": "g4th2-mount.dru9vexon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:07:50", "last_seen_utc": "2026-04-15 10:09:55", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791717": [ { "ioc_value": "hpryikjw.dru9vexon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 10:02:06", "last_seen_utc": "2026-04-15 10:04:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791716": [ { "ioc_value": "hardscript.dru9vexon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:56:44", "last_seen_utc": "2026-04-15 09:58:53", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791715": [ { "ioc_value": "xoqairj.zor4melax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:50:45", "last_seen_utc": "2026-04-15 09:53:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791714": [ { "ioc_value": "pwmyu.zor4melax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:45:27", "last_seen_utc": "2026-04-15 09:47:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791713": [ { "ioc_value": "compre-node.zor4melax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:39:38", "last_seen_utc": "2026-04-15 09:40:41", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791712": [ { "ioc_value": "c0rnpute-stream.zor4melax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:33:59", "last_seen_utc": "2026-04-15 09:35:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791711": [ { "ioc_value": "wygb7.zor4melax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:28:29", "last_seen_utc": "2026-04-15 09:30:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791710": [ { "ioc_value": "5pro4-vector.zor4melax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:22:42", "last_seen_utc": "2026-04-15 09:24:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791709": [ { "ioc_value": "tfovt.prax5litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:17:41", "last_seen_utc": "2026-04-15 09:19:08", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791708": [ { "ioc_value": "sprbridg.prax5litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:11:47", "last_seen_utc": "2026-04-15 09:16:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791707": [ { "ioc_value": "bridge0-crest.prax5litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:05:48", "last_seen_utc": "2026-04-15 09:07:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791706": [ { "ioc_value": "trimark4or.prax5litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 09:00:41", "last_seen_utc": "2026-04-15 09:02:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791705": [ { "ioc_value": "observ-phase.prax5litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:54:58", "last_seen_utc": "2026-04-15 08:57:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791704": [ { "ioc_value": "server-vall.prax5litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:50:22", "last_seen_utc": "2026-04-15 08:54:04", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791703": [ { "ioc_value": "27.124.40.62:5247", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-15 08:46:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/d0c5ff295ee23ff33b42061bf533375fc78d7bfbbb0c962454020ed98b258838/", "tags": "valleyrat_s2", "anonymous": "0", "reporter": "abuse_ch" } ], "1791702": [ { "ioc_value": "192.30.242.168:8041", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 08:44:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/c3c850033dd2bf2b3604110e29c7fceed7f8e9743d19dcb0125d9a94ce07fcb2/", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1791701": [ { "ioc_value": "144.172.96.27:8583", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.pure_rat", "malware_alias": "PureHVNC,ResolverRAT", "malware_printable": "PureRAT", "first_seen_utc": "2026-04-15 08:43:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/b6fa39da6c5bd8abd69ce2927457155eda12b99a70875092bbca2dad6d43bdfa/", "tags": "PureHVNC,PureRAT,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1791700": [ { "ioc_value": "vel-markon.kry6navex.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:43:36", "last_seen_utc": "2026-04-15 08:45:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791699": [ { "ioc_value": "27.124.40.62:5246", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-15 08:41:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "RAT,ValleyRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1791698": [ { "ioc_value": "engine-switch.kry6navex.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:37:59", "last_seen_utc": "2026-04-15 08:40:23", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791697": [ { "ioc_value": "181.235.1.253:2404", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 08:32:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/4f569e4456ef1d1b77b84220061d3af7b61c1447b2ed041283af27f38d5b23e5/", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1791696": [ { "ioc_value": "t1de-vault.kry6navex.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:32:22", "last_seen_utc": "2026-04-15 08:34:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791695": [ { "ioc_value": "auth7-core.kry6navex.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:26:43", "last_seen_utc": "2026-04-15 08:29:04", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791694": [ { "ioc_value": "check.nid-log.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.kimsuky", "malware_alias": null, "malware_printable": "Kimsuky", "first_seen_utc": "2026-04-15 08:24:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/a32e2d400bb7feb63d29738d6a31959228530974fe928b9c48787fadaf17d8a0/", "tags": "Kimsuky", "anonymous": "0", "reporter": "abuse_ch" } ], "1791691": [ { "ioc_value": "http://check.nid-log.com/pc/bootservice.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.kimsuky", "malware_alias": null, "malware_printable": "Kimsuky", "first_seen_utc": "2026-04-15 08:24:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/a32e2d400bb7feb63d29738d6a31959228530974fe928b9c48787fadaf17d8a0/", "tags": "Kimsuky", "anonymous": "0", "reporter": "abuse_ch" } ], "1791692": [ { "ioc_value": "http://check.nid-log.com/pc/checkservice.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.kimsuky", "malware_alias": null, "malware_printable": "Kimsuky", "first_seen_utc": "2026-04-15 08:24:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/a32e2d400bb7feb63d29738d6a31959228530974fe928b9c48787fadaf17d8a0/", "tags": "Kimsuky", "anonymous": "0", "reporter": "abuse_ch" } ], "1791693": [ { "ioc_value": "http://check.nid-log.com/pc/finalservice.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.kimsuky", "malware_alias": null, "malware_printable": "Kimsuky", "first_seen_utc": "2026-04-15 08:24:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/a32e2d400bb7feb63d29738d6a31959228530974fe928b9c48787fadaf17d8a0/", "tags": "Kimsuky", "anonymous": "0", "reporter": "abuse_ch" } ], "1791690": [ { "ioc_value": "vtdlwy.kry6navex.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:21:39", "last_seen_utc": "2026-04-15 08:23:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791689": [ { "ioc_value": "geo-r0ut.kry6navex.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:15:40", "last_seen_utc": "2026-04-15 08:18:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791688": [ { "ioc_value": "venom.summertunnel.shop", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 08:15:17", "last_seen_utc": "2026-04-16 11:16:13", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "ozpifus,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791687": [ { "ioc_value": "http://venom.summertunnel.shop", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 08:15:13", "last_seen_utc": "2026-04-16 11:16:10", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "ozpifus,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791686": [ { "ioc_value": "172.245.209.160:2478", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-15 08:12:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/f0ac3f4ba5a01e0d066b935db2c2f1fe42078f8e0882c46f3eb1b9f03add3c39/", "tags": "xworm", "anonymous": "0", "reporter": "abuse_ch" } ], "1791685": [ { "ioc_value": "inn35-dock.tul2qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:09:54", "last_seen_utc": "2026-04-15 08:14:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791683": [ { "ioc_value": "reagent-publ.tul2qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 08:03:53", "last_seen_utc": "2026-04-15 08:03:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791680": [ { "ioc_value": "yil5.tul2qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:58:09", "last_seen_utc": "2026-04-15 08:01:01", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791679": [ { "ioc_value": "njt8hire.tul2qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:52:47", "last_seen_utc": "2026-04-15 07:55:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791443": [ { "ioc_value": "c87x.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:50:34", "last_seen_utc": "2026-04-15 06:02:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "15April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1791628": [ { "ioc_value": "18.168.221.224:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 07:50:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Agentemis,BEACON,Cobalt Strike,CobaltStrike,cobeacon", "anonymous": "0", "reporter": "whoamix302" } ], "1791629": [ { "ioc_value": "47.83.119.244:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "elf.gobrat", "malware_alias": null, "malware_printable": "GobRAT", "first_seen_utc": "2026-04-15 07:50:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "GobRAT", "anonymous": "0", "reporter": "whoamix302" } ], "1791667": [ { "ioc_value": "32cca9d78cffced8d31bd782b76f84e14926752d", "ioc_type": "sha1_hash", "threat_type": "payload", "malware": "win.lumma", "malware_alias": "LummaC2 Stealer", "malware_printable": "Lumma Stealer", "first_seen_utc": "2026-04-15 07:50:29", "last_seen_utc": null, "confidence_level": 50, "is_compromised": false, "reference": "https://mega-nz.orbitdatasync1.lol/roblox+skibidi+toilet+tower+defense+hack+download.zip?c=17762340478595455&s=src2", "tags": null, "anonymous": "0", "reporter": "coleslaw" } ], "1791678": [ { "ioc_value": "lbkonz.tul2qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:47:01", "last_seen_utc": "2026-04-15 07:47:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791677": [ { "ioc_value": "https://signalwarden.icu/ext.a8c1ec20ddbd.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:44:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791676": [ { "ioc_value": "https://signalwarden.icu/ext-b.fbf9747e91fd.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:43:49", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791675": [ { "ioc_value": "http://signalwarden.icu/t.188cfd3975db.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:43:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791674": [ { "ioc_value": "zencresten5.tul2qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:41:43", "last_seen_utc": "2026-04-15 07:43:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791673": [ { "ioc_value": "https://signalwarden.icu/t.js?=site", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:41:33", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791672": [ { "ioc_value": "signalwarden.icu", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:41:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791671": [ { "ioc_value": "https://daemonpath.icu/ext.a8c1ec20ddbd.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:40:28", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791670": [ { "ioc_value": "https://daemonpath.icu/ext-b.fbf9747e91fd.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:39:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791669": [ { "ioc_value": "https://daemonpath.icu/t.188cfd3975db.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:38:55", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791668": [ { "ioc_value": "https://daemonpath.icu/t.js?=site", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:38:17", "last_seen_utc": "2026-04-15 07:42:10", "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791666": [ { "ioc_value": "daemonpath.icu", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 07:37:22", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,EXT", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791665": [ { "ioc_value": "nky0.vex8talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:36:03", "last_seen_utc": "2026-04-15 07:38:01", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791664": [ { "ioc_value": "5.188.86.165:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.netsupportmanager_rat", "malware_alias": "NetSupport", "malware_printable": "NetSupportManager RAT", "first_seen_utc": "2026-04-15 07:30:26", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "NetSupport", "anonymous": "0", "reporter": "abuse_ch" } ], "1791663": [ { "ioc_value": "mcfupmvl.vex8talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:30:10", "last_seen_utc": "2026-04-15 07:32:07", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791662": [ { "ioc_value": "xlknp.vex8talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:24:39", "last_seen_utc": "2026-04-15 07:29:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791661": [ { "ioc_value": "ofhbm4.vex8talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:19:07", "last_seen_utc": "2026-04-15 07:20:50", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791660": [ { "ioc_value": "178.104.90.74:3499", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.smokeloader", "malware_alias": "Dofoil,Sharik,Smoke,Smoke Loader", "malware_printable": "SmokeLoader", "first_seen_utc": "2026-04-15 07:17:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Dofoil,Smoke Loader", "anonymous": "0", "reporter": "abuse_ch" } ], "1791659": [ { "ioc_value": "hazydvs.surf", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.smokeloader", "malware_alias": "Dofoil,Sharik,Smoke,Smoke Loader", "malware_printable": "SmokeLoader", "first_seen_utc": "2026-04-15 07:15:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Dofoil,Smoke Loader", "anonymous": "0", "reporter": "abuse_ch" } ], "1791658": [ { "ioc_value": "xyx.wvxx.dpdns.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.raton_rat", "malware_alias": null, "malware_printable": "RatonRAT", "first_seen_utc": "2026-04-15 07:15:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3dc4e6bae0421dbc3bd7c526e0c42e79a396465b2ef9c2c2cac0d59cc1750054/", "tags": "RAT,RatonRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1791657": [ { "ioc_value": "https://jpsdischool.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791652": [ { "ioc_value": "https://rivoningoeducentre.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791653": [ { "ioc_value": "https://valonmarketplace.fuf.rjd.mybluehost.me/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791654": [ { "ioc_value": "https://veyron.com.tr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791655": [ { "ioc_value": "https://majorleaguemarketers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791656": [ { "ioc_value": "https://dev.kiddiekollege.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:13", "last_seen_utc": "2026-04-15 18:00:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791649": [ { "ioc_value": "https://mydesirecare.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791650": [ { "ioc_value": "https://vskudvarhely.ro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:12", "last_seen_utc": "2026-04-15 18:00:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791651": [ { "ioc_value": "https://elmigaoestapegao.loyalquo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:12", "last_seen_utc": "2026-04-15 17:00:54", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791645": [ { "ioc_value": "https://mobilicreativedesigns.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791646": [ { "ioc_value": "https://ramirocubillan.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791647": [ { "ioc_value": "https://shadescollectivellc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791648": [ { "ioc_value": "https://thyrocareahmedabad.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791642": [ { "ioc_value": "https://shutterandshades.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791643": [ { "ioc_value": "https://tagautomation.site/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:10", "last_seen_utc": "2026-04-15 18:00:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791644": [ { "ioc_value": "https://tattoosnearme.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791639": [ { "ioc_value": "https://deudor.pghseguros.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:09", "last_seen_utc": "2026-04-15 18:00:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791640": [ { "ioc_value": "https://elvonbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791641": [ { "ioc_value": "https://paultanner.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:09", "last_seen_utc": "2026-04-15 18:00:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791636": [ { "ioc_value": "https://amg-doors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791637": [ { "ioc_value": "https://antirungkad77.site/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791638": [ { "ioc_value": "https://bloomindiajourneys.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791633": [ { "ioc_value": "https://shrirakeshrajdev.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791634": [ { "ioc_value": "https://aboveallgarages.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791635": [ { "ioc_value": "https://adeleheyart.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:07", "last_seen_utc": "2026-04-15 17:00:54", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791630": [ { "ioc_value": "https://editionsmolakisi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791631": [ { "ioc_value": "https://housediy.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791632": [ { "ioc_value": "https://karakkhel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 07:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791627": [ { "ioc_value": "104.252.175.169:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.lumma", "malware_alias": "LummaC2 Stealer", "malware_printable": "Lumma Stealer", "first_seen_utc": "2026-04-15 07:13:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/4719eede5ebc81fd2e3d4b7376501e688e48b286111fa0705de1819eaeaf551c/", "tags": "LummaStealer", "anonymous": "0", "reporter": "abuse_ch" } ], "1791626": [ { "ioc_value": "holypriest.gl", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.lumma", "malware_alias": "LummaC2 Stealer", "malware_printable": "Lumma Stealer", "first_seen_utc": "2026-04-15 07:13:49", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/4719eede5ebc81fd2e3d4b7376501e688e48b286111fa0705de1819eaeaf551c/", "tags": "LummaStealer", "anonymous": "0", "reporter": "abuse_ch" } ], "1791625": [ { "ioc_value": "lcr1.vex8talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:13:10", "last_seen_utc": "2026-04-15 07:15:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791621": [ { "ioc_value": "45.9.156.169:423", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791622": [ { "ioc_value": "45.9.156.169:424", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791623": [ { "ioc_value": "45.9.156.169:429", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791624": [ { "ioc_value": "45.9.156.169:431", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791618": [ { "ioc_value": "45.9.156.169:416", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791619": [ { "ioc_value": "45.9.156.169:417", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791620": [ { "ioc_value": "45.9.156.169:421", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791614": [ { "ioc_value": "176.65.150.25:429", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791615": [ { "ioc_value": "176.65.150.25:430", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791616": [ { "ioc_value": "176.65.150.25:431", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791617": [ { "ioc_value": "204.76.203.162:424", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791596": [ { "ioc_value": "176.65.148.55:419", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791597": [ { "ioc_value": "176.65.148.55:421", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791598": [ { "ioc_value": "176.65.148.55:422", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791599": [ { "ioc_value": "176.65.148.55:423", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791600": [ { "ioc_value": "176.65.148.55:424", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791601": [ { "ioc_value": "176.65.148.55:428", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791602": [ { "ioc_value": "176.65.148.55:429", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791603": [ { "ioc_value": "176.65.148.55:430", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791604": [ { "ioc_value": "176.65.148.55:431", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791605": [ { "ioc_value": "176.65.150.25:416", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791606": [ { "ioc_value": "176.65.150.25:418", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791607": [ { "ioc_value": "176.65.150.25:419", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791608": [ { "ioc_value": "176.65.150.25:420", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791609": [ { "ioc_value": "176.65.150.25:422", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791610": [ { "ioc_value": "176.65.150.25:423", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791611": [ { "ioc_value": "176.65.150.25:424", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791612": [ { "ioc_value": "176.65.150.25:427", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791613": [ { "ioc_value": "176.65.150.25:428", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791588": [ { "ioc_value": "176.65.148.206:419", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791589": [ { "ioc_value": "176.65.148.206:421", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791590": [ { "ioc_value": "176.65.148.206:427", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791591": [ { "ioc_value": "176.65.148.206:428", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791592": [ { "ioc_value": "176.65.148.206:431", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791593": [ { "ioc_value": "176.65.148.55:416", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791594": [ { "ioc_value": "176.65.148.55:417", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791595": [ { "ioc_value": "176.65.148.55:418", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791580": [ { "ioc_value": "130.12.180.144:428", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791581": [ { "ioc_value": "130.12.180.85:417", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791582": [ { "ioc_value": "130.12.180.85:418", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791583": [ { "ioc_value": "130.12.180.85:419", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791584": [ { "ioc_value": "130.12.180.85:422", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791585": [ { "ioc_value": "130.12.180.85:424", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791586": [ { "ioc_value": "130.12.180.85:427", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791587": [ { "ioc_value": "130.12.180.85:429", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:11:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791571": [ { "ioc_value": "204.76.203.165:420", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791572": [ { "ioc_value": "130.12.182.175:420", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:43", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791573": [ { "ioc_value": "31.57.216.27:420", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:46", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791574": [ { "ioc_value": "31.57.216.28:420", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:46", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791575": [ { "ioc_value": "46.151.182.245:420", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:47", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791576": [ { "ioc_value": "46.151.182.19:420", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:47", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791577": [ { "ioc_value": "130.12.180.119:420", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:42", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791578": [ { "ioc_value": "204.76.203.162:419", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791579": [ { "ioc_value": "204.76.203.162:417", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:13", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791567": [ { "ioc_value": "204.76.203.162:430", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:12", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791568": [ { "ioc_value": "204.76.203.162:431", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:12", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791569": [ { "ioc_value": "204.76.203.165:416", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:12", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791570": [ { "ioc_value": "204.76.203.162:418", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:12", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791564": [ { "ioc_value": "204.76.203.165:423", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:11", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791565": [ { "ioc_value": "204.76.203.162:425", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:11", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791566": [ { "ioc_value": "204.76.203.162:421", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:11", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791560": [ { "ioc_value": "204.76.203.165:431", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:10", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791561": [ { "ioc_value": "204.76.203.165:427", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:10", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791562": [ { "ioc_value": "204.76.203.162:423", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:10", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791563": [ { "ioc_value": "46.151.182.19:423", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:10", "last_seen_utc": "2026-04-15 07:11:47", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791559": [ { "ioc_value": "46.151.182.19:431", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:09", "last_seen_utc": "2026-04-15 07:11:47", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791558": [ { "ioc_value": "204.76.203.165:425", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-15 07:10:08", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1791557": [ { "ioc_value": "casualquant.vex8talin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:07:35", "last_seen_utc": "2026-04-15 07:10:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791556": [ { "ioc_value": "sol-draet.nor3liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 07:02:03", "last_seen_utc": "2026-04-15 07:03:35", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791555": [ { "ioc_value": "globalotter.nor3liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:56:39", "last_seen_utc": "2026-04-15 06:58:04", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791554": [ { "ioc_value": "serlinear.nor3liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:50:41", "last_seen_utc": "2026-04-15 06:52:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791553": [ { "ioc_value": "b4rk-panel.nor3liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:45:28", "last_seen_utc": "2026-04-15 06:47:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791552": [ { "ioc_value": "trailerbinary.nor3liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:39:53", "last_seen_utc": "2026-04-15 06:42:02", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791551": [ { "ioc_value": "31.57.118.10:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.count_loader", "malware_alias": null, "malware_printable": "CountLoader", "first_seen_utc": "2026-04-15 06:35:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "CountLoader", "anonymous": "0", "reporter": "abuse_ch" } ], "1791550": [ { "ioc_value": "polecy.cyou", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.lumma", "malware_alias": "LummaC2 Stealer", "malware_printable": "Lumma Stealer", "first_seen_utc": "2026-04-15 06:35:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "LummaStealer", "anonymous": "0", "reporter": "abuse_ch" } ], "1791549": [ { "ioc_value": "padaz.pics", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.smokeloader", "malware_alias": "Dofoil,Sharik,Smoke,Smoke Loader", "malware_printable": "SmokeLoader", "first_seen_utc": "2026-04-15 06:34:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/b38fbaae45ea452ead61c91e5baae68be445a7e995cf95d44d062c75f9a2880b/", "tags": "Dofoil,Smoke Loader", "anonymous": "0", "reporter": "abuse_ch" } ], "1791548": [ { "ioc_value": "pebcpxb.nor3liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:33:56", "last_seen_utc": "2026-04-15 06:36:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791547": [ { "ioc_value": "wobble.graftspore.space", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 06:31:40", "last_seen_utc": "2026-04-15 07:14:11", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "ozpifus,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791546": [ { "ioc_value": "http://wobble.graftspore.space", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 06:31:37", "last_seen_utc": "2026-04-15 07:14:08", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "ozpifus,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791545": [ { "ioc_value": "http://prism.ravengarden.space/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 06:28:50", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/75d8b1634e25e24e7aab3c6b5b084cbe102e2818da122dbaa717de1d0e05ca17/", "tags": "ozpifus,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791544": [ { "ioc_value": "sharpreel.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:28:29", "last_seen_utc": "2026-04-15 06:30:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791543": [ { "ioc_value": "prism.ravengarden.space", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 06:28:19", "last_seen_utc": "2026-04-15 06:28:19", "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/75d8b1634e25e24e7aab3c6b5b084cbe102e2818da122dbaa717de1d0e05ca17/", "tags": "dzajdz,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791542": [ { "ioc_value": "https://t.me/doziuzkdd", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 06:26:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/75d8b1634e25e24e7aab3c6b5b084cbe102e2818da122dbaa717de1d0e05ca17/", "tags": "ozpifus,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791541": [ { "ioc_value": "du5t3-forge.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:22:53", "last_seen_utc": "2026-04-15 06:24:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791539": [ { "ioc_value": "187.77.181.20:9059", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.smokeloader", "malware_alias": "Dofoil,Sharik,Smoke,Smoke Loader", "malware_printable": "SmokeLoader", "first_seen_utc": "2026-04-15 06:20:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/0f9c97adc250b2ab1c1b19aa2bd99ac0b8f54e07aaccdfdaf347a258a81ef932/", "tags": "Dofoil,Smoke Loader", "anonymous": "0", "reporter": "abuse_ch" } ], "1791540": [ { "ioc_value": "unseanb.surf", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.smokeloader", "malware_alias": "Dofoil,Sharik,Smoke,Smoke Loader", "malware_printable": "SmokeLoader", "first_seen_utc": "2026-04-15 06:20:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/0f9c97adc250b2ab1c1b19aa2bd99ac0b8f54e07aaccdfdaf347a258a81ef932/", "tags": "Dofoil,Smoke Loader", "anonymous": "0", "reporter": "abuse_ch" } ], "1791538": [ { "ioc_value": "icematrix.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:17:14", "last_seen_utc": "2026-04-15 06:19:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791523": [ { "ioc_value": "rajhuvuz.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791524": [ { "ioc_value": "rcdt1ytgjdgbx3c.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791525": [ { "ioc_value": "rrt37xmb4nu9xdy.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791526": [ { "ioc_value": "skhap18pdspgyk5.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791527": [ { "ioc_value": "syxkv00ly32dytr.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791528": [ { "ioc_value": "t611j3fusibizak.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791529": [ { "ioc_value": "tgeb9e8zwea6o3o.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791530": [ { "ioc_value": "trmrd4mz78xkz0y.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791531": [ { "ioc_value": "ud6i76t3myjmzqc.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791532": [ { "ioc_value": "uzq917181o6p0gr.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791533": [ { "ioc_value": "yj8o0j8w9kct59e.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791534": [ { "ioc_value": "yrvye05yeri0ky8.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791535": [ { "ioc_value": "yxoy6h0suupq4jz.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791536": [ { "ioc_value": "z5tfukf1oayv5zs.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791537": [ { "ioc_value": "z6pdt39zmx2ebc5.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791502": [ { "ioc_value": "h7lof0kdoasxsvr.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791503": [ { "ioc_value": "hc02f2tzgfncn43.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791504": [ { "ioc_value": "hyls9303v59enui.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791505": [ { "ioc_value": "hzs6417zicspfnp.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791506": [ { "ioc_value": "i5p9x6fdqkhioba.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791507": [ { "ioc_value": "ij5j3588auvgokw.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791508": [ { "ioc_value": "jdtql9tmk0qnpr3.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791509": [ { "ioc_value": "jr90r8mh5a4lo1p.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791510": [ { "ioc_value": "jydhfb1qzqcpphi.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791511": [ { "ioc_value": "k6iy3ef0t6luqxb.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791512": [ { "ioc_value": "kcichmmdhjgifme.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791513": [ { "ioc_value": "kkx89c8vegyrq7w.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791514": [ { "ioc_value": "ldmfrht9nltyre4.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791515": [ { "ioc_value": "lr2pxfm48v7wqop.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791516": [ { "ioc_value": "ma8t9n3yzo0jbi9.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791517": [ { "ioc_value": "nna62fgze.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791518": [ { "ioc_value": "np38oq8z7vjy2v6.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791519": [ { "ioc_value": "nsugzw35.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791520": [ { "ioc_value": "pck4vrttfrd0vgc.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791521": [ { "ioc_value": "q59cdvf7px87wnj.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791522": [ { "ioc_value": "qjpmju82a7l4wx5.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791483": [ { "ioc_value": "7jsrg87r8w2hdln.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791484": [ { "ioc_value": "8chzyct4h2xoesu.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791485": [ { "ioc_value": "8qw84bm02cale2g.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791486": [ { "ioc_value": "9klgmf8ebi5sf8n.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791487": [ { "ioc_value": "9y1pse09wsjqfi9.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791488": [ { "ioc_value": "a557ghfiq8rugy1.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791489": [ { "ioc_value": "arpxaimn5xdwgpg.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791490": [ { "ioc_value": "atmn4a1ylmh2329.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791491": [ { "ioc_value": "b8h3jd6ytt1htf7.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791492": [ { "ioc_value": "bd9o4ktsln0zgfu.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791493": [ { "ioc_value": "bke5sn81f383hvn.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791494": [ { "ioc_value": "bnbjzgbz0zkvjs5.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791495": [ { "ioc_value": "byteym1w0dm1h59.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791496": [ { "ioc_value": "c6yvmpf6utu5il2.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791497": [ { "ioc_value": "fggrtewz.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791498": [ { "ioc_value": "fifuvhzw2.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791499": [ { "ioc_value": "fyyfbzhvw22.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791500": [ { "ioc_value": "g5wlryfpmze7moa.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791501": [ { "ioc_value": "gqgbl0mu1p0amep.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791473": [ { "ioc_value": "0yhncp0fxft2660.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791474": [ { "ioc_value": "15l40sforv167mt.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791475": [ { "ioc_value": "1k1d6q8jc5f47we.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791476": [ { "ioc_value": "2dqlovtxlb9a82l.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791477": [ { "ioc_value": "2r5uutmt6ln87c7.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791478": [ { "ioc_value": "3ku2cy87gqif9je.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791479": [ { "ioc_value": "3zabiw1201wd8t0.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791480": [ { "ioc_value": "5i60zo5y3a9877p.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791481": [ { "ioc_value": "5x0gerazbgtnxkn.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791482": [ { "ioc_value": "75cia9fvnmojdc1.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791472": [ { "ioc_value": "0cxwintaip6z6gl.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:13:02", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791471": [ { "ioc_value": "serlineos8.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:11:46", "last_seen_utc": "2026-04-15 06:13:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791470": [ { "ioc_value": "http://uzq917181o6p0gr.top/1.php", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:11:42", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791469": [ { "ioc_value": "thomphon.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-15 06:10:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be/", "tags": "KongTuke", "anonymous": "0", "reporter": "abuse_ch" } ], "1791467": [ { "ioc_value": "sailbreeze.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 06:06:19", "last_seen_utc": "2026-04-15 06:08:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791466": [ { "ioc_value": "phishing.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.njrat", "malware_alias": "Bladabindi,Lime-Worm", "malware_printable": "NjRAT", "first_seen_utc": "2026-04-15 06:05:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fej8yaez5n", "tags": "C2,domain,njrat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791465": [ { "ioc_value": "c168vip9.online", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:04:10", "last_seen_utc": "2026-04-15 06:04:13", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-edgkzses5r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791464": [ { "ioc_value": "afrekqno.za.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:04:04", "last_seen_utc": "2026-04-15 06:04:07", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-edgkzses5r", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791463": [ { "ioc_value": "backdoor.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:04:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fesv3sez6l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791462": [ { "ioc_value": "spyware.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fesv3sez6l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791461": [ { "ioc_value": "trojan.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:55", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fesv3sez6l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791460": [ { "ioc_value": "coppyright.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:52", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fegg2sez5l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791459": [ { "ioc_value": "coppy.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:49", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fegg2sez5l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791458": [ { "ioc_value": "ncsei.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fegg2sez5l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791457": [ { "ioc_value": "ransom.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-femn3aez5q", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791456": [ { "ioc_value": "ddos.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fedq6aat2t", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791455": [ { "ioc_value": "data.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fedq6aat2t", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791454": [ { "ioc_value": "malware.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:35", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fd3znaas9w", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791453": [ { "ioc_value": "virus.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:33", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fd3znaas9w", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791452": [ { "ioc_value": "hacker.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fd3znaas9w", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791451": [ { "ioc_value": "cross.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-gfyndsfv2l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791450": [ { "ioc_value": "bbos.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-gfyndsfv2l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791449": [ { "ioc_value": "malicious.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-gfyndsfv2l", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791448": [ { "ioc_value": "sexually.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fde8laas8v", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791447": [ { "ioc_value": "sexual.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fde8laas8v", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791446": [ { "ioc_value": "csam.achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:21", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fde8laas8v", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791445": [ { "ioc_value": "achievementschooldistrict.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-15 06:03:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-fde8laas8v", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1791444": [ { "ioc_value": "168.222.97.15:8001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-15 06:00:40", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260415-f44c4saw4y", "tags": "C2,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1791147": [ { "ioc_value": "https://thomphon.com/api/v1/telemetry", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.havoc", "malware_alias": "Havokiz", "malware_printable": "Havoc", "first_seen_utc": "2026-04-15 05:59:28", "last_seen_utc": "2026-04-15 06:11:41", "confidence_level": 90, "is_compromised": false, "reference": null, "tags": "clickfix,havoc,kongtuke,sideload", "anonymous": "0", "reporter": "Lenny_3BO" } ], "1791139": [ { "ioc_value": "91.92.243.79:4454", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown_loader", "malware_alias": null, "malware_printable": "Unknown Loader", "first_seen_utc": "2026-04-15 05:59:27", "last_seen_utc": null, "confidence_level": 50, "is_compromised": false, "reference": "", "tags": null, "anonymous": "1", "reporter": "chronobserver" } ], "1791149": [ { "ioc_value": "cdn1-edge.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:59:25", "last_seen_utc": "2026-04-14 21:49:18", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "14April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1791155": [ { "ioc_value": "cfmn.us.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 05:59:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "clearfake,clickfix", "anonymous": "1", "reporter": "tanner" } ], "1791161": [ { "ioc_value": "http://47.76.181.119:8888/supershell/login/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 05:59:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "Alibaba (US) Technology Co. Ltd.,AS45102,supershell", "anonymous": "0", "reporter": "antiphishorg" } ], "1791162": [ { "ioc_value": "47.76.181.119:8888", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 05:59:24", "last_seen_utc": "2026-04-15 07:15:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "Alibaba (US) Technology Co. Ltd.,AS45102,supershell", "anonymous": "0", "reporter": "antiphishorg" } ], "1791178": [ { "ioc_value": "client1-zone.smart-logic-trade.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:59:24", "last_seen_utc": "2026-04-14 22:16:35", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "14April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1791198": [ { "ioc_value": "64.227.67.145:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:23", "last_seen_utc": "2026-04-15 00:18:01", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791199": [ { "ioc_value": "164.92.153.50:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:23", "last_seen_utc": "2026-04-15 00:43:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791204": [ { "ioc_value": "161.35.155.138:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:22", "last_seen_utc": "2026-04-15 00:00:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791203": [ { "ioc_value": "165.22.202.222:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:21", "last_seen_utc": "2026-04-15 00:28:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791206": [ { "ioc_value": "https://soilexcavating.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-15 05:59:21", "last_seen_utc": null, "confidence_level": 90, "is_compromised": false, "reference": "https://clickfix.carsonww.com/domains/soilexcavating.com", "tags": "ClickFix", "anonymous": "0", "reporter": "CarsonWilliams" } ], "1791207": [ { "ioc_value": "174.138.7.184:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:19", "last_seen_utc": "2026-04-15 00:24:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791210": [ { "ioc_value": "165.22.202.17:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:19", "last_seen_utc": "2026-04-15 00:29:52", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791211": [ { "ioc_value": "209.38.34.146:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:19", "last_seen_utc": "2026-04-15 00:23:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791213": [ { "ioc_value": "142.93.133.223:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:18", "last_seen_utc": "2026-04-15 00:40:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791217": [ { "ioc_value": "146.190.234.105:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:17", "last_seen_utc": "2026-04-15 00:35:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791222": [ { "ioc_value": "134.122.49.182:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:16", "last_seen_utc": "2026-04-16 11:30:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791224": [ { "ioc_value": "206.189.13.111:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:15", "last_seen_utc": "2026-04-16 11:27:46", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791226": [ { "ioc_value": "142.93.140.183:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-15 05:59:15", "last_seen_utc": "2026-04-16 11:21:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1791442": [ { "ioc_value": "119.91.254.137:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 05:59:12", "last_seen_utc": "2026-04-16 10:50:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-666666666", "anonymous": "0", "reporter": "abuse_ch" } ], "1791441": [ { "ioc_value": "60.204.171.31:80", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 05:59:02", "last_seen_utc": "2026-04-16 06:48:07", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-391144938", "anonymous": "0", "reporter": "abuse_ch" } ], "1791440": [ { "ioc_value": "175.178.76.144:9999", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 05:58:52", "last_seen_utc": "2026-04-16 06:42:41", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-666666666", "anonymous": "0", "reporter": "abuse_ch" } ], "1791439": [ { "ioc_value": "47.97.192.163:8888", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 05:58:50", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-987654321", "anonymous": "0", "reporter": "abuse_ch" } ], "1791438": [ { "ioc_value": "120.55.190.154:81", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 05:58:49", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "CobaltStrike,cs-watermark-987654321", "anonymous": "0", "reporter": "abuse_ch" } ], "1791437": [ { "ioc_value": "gift1.daily-bonus.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:58:24", "last_seen_utc": "2026-04-15 05:59:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791436": [ { "ioc_value": "gate6.smartchoice.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:52:49", "last_seen_utc": "2026-04-15 05:54:35", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791435": [ { "ioc_value": "user5.smartchoice.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:46:58", "last_seen_utc": "2026-04-15 05:48:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791431": [ { "ioc_value": "202.79.169.251:8443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-15 05:42:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/2caa0eb6a0c179439afc256fb67bd611a70232aabbe11130858554f6b1f249c6/", "tags": "RAT,ValleyRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1791430": [ { "ioc_value": "list4.smartchoice.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:41:36", "last_seen_utc": "2026-04-15 05:42:48", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791429": [ { "ioc_value": "top3.smartchoice.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:36:00", "last_seen_utc": "2026-04-15 05:37:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791428": [ { "ioc_value": "best2.smartchoice.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:30:08", "last_seen_utc": "2026-04-15 05:31:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791427": [ { "ioc_value": "good1.smartchoice.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:24:36", "last_seen_utc": "2026-04-15 05:26:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791426": [ { "ioc_value": "open6.urbanview.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:19:16", "last_seen_utc": "2026-04-15 05:20:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791424": [ { "ioc_value": "https://lumigo-ai.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791425": [ { "ioc_value": "https://onefilmproductions.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791422": [ { "ioc_value": "https://bellacasashade.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791423": [ { "ioc_value": "https://logistics-direct.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:09", "last_seen_utc": "2026-04-15 18:00:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791421": [ { "ioc_value": "https://bacproof.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791418": [ { "ioc_value": "https://pilavyeri.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791419": [ { "ioc_value": "https://provatishopping.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791420": [ { "ioc_value": "https://telefoonboekbedrijven.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791417": [ { "ioc_value": "https://merchantsolutionsepx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 05:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791416": [ { "ioc_value": "news5.urbanview.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:13:23", "last_seen_utc": "2026-04-15 05:14:14", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791415": [ { "ioc_value": "map4.urbanview.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:07:59", "last_seen_utc": "2026-04-15 05:09:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791414": [ { "ioc_value": "blog3.urbanview.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 05:02:40", "last_seen_utc": "2026-04-15 05:05:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791413": [ { "ioc_value": "spot2.urbanview.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:56:43", "last_seen_utc": "2026-04-15 04:58:22", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791412": [ { "ioc_value": "area1.urbanview.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:51:20", "last_seen_utc": "2026-04-15 04:52:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791411": [ { "ioc_value": "site6.fast-delivery.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:45:23", "last_seen_utc": "2026-04-15 04:46:53", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791410": [ { "ioc_value": "city5.fast-delivery.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:39:54", "last_seen_utc": "2026-04-15 04:41:34", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791405": [ { "ioc_value": "total4.fast-delivery.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:34:29", "last_seen_utc": "2026-04-15 04:36:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791404": [ { "ioc_value": "post3.fast-delivery.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:28:27", "last_seen_utc": "2026-04-15 04:30:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791393": [ { "ioc_value": "box2.fast-delivery.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:23:06", "last_seen_utc": "2026-04-15 04:24:42", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791392": [ { "ioc_value": "order1.fast-delivery.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:17:31", "last_seen_utc": "2026-04-15 04:17:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791384": [ { "ioc_value": "https://tareeqalensafgarage.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791385": [ { "ioc_value": "https://jheanelleap.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791386": [ { "ioc_value": "https://joteaches.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791387": [ { "ioc_value": "https://portsolutionsdmv.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791380": [ { "ioc_value": "https://limestonebkrealty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791381": [ { "ioc_value": "https://scaffoldersnearme.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791382": [ { "ioc_value": "https://northwoodsdetail.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791383": [ { "ioc_value": "https://storagecompat.com.pe/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791379": [ { "ioc_value": "https://ipostab.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791376": [ { "ioc_value": "https://jimcleans.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791377": [ { "ioc_value": "https://localtomeuk.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:10", "last_seen_utc": "2026-04-15 18:00:53", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791378": [ { "ioc_value": "https://donmontero.pl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791374": [ { "ioc_value": "https://atlbasements.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791375": [ { "ioc_value": "https://dorlest.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791372": [ { "ioc_value": "https://aashrayaoldagehome.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:08", "last_seen_utc": "2026-04-15 17:00:54", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791373": [ { "ioc_value": "https://livemint.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791369": [ { "ioc_value": "https://kingsroofingandbuildingltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:07", "last_seen_utc": "2026-04-15 18:30:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791370": [ { "ioc_value": "https://aspinwallmoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791371": [ { "ioc_value": "https://merchantsolutionscapital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791366": [ { "ioc_value": "https://jmrblindsinc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791367": [ { "ioc_value": "https://metaa.co.mz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791368": [ { "ioc_value": "https://nuestralechona.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791363": [ { "ioc_value": "https://pymt360.app/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791364": [ { "ioc_value": "https://g3-bizltd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791365": [ { "ioc_value": "https://howtobidet.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 04:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791362": [ { "ioc_value": "main6.puremarket.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:12:09", "last_seen_utc": "2026-04-15 04:13:14", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791361": [ { "ioc_value": "help5.puremarket.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:06:22", "last_seen_utc": "2026-04-15 04:08:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791360": [ { "ioc_value": "item4.puremarket.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 04:00:50", "last_seen_utc": "2026-04-15 04:05:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791359": [ { "ioc_value": "108.187.4.158:558", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-15 03:57:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/e8e9df79257bea763a14fc5493e653f2201a579fb1d7d0e31a56310e41fc5126/", "tags": "valleyrat_s2", "anonymous": "0", "reporter": "abuse_ch" } ], "1791358": [ { "ioc_value": "media3.puremarket.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:54:57", "last_seen_utc": "2026-04-15 03:56:58", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791357": [ { "ioc_value": "108.187.4.158:557", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-15 03:50:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "RAT,ValleyRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1791356": [ { "ioc_value": "guest2.puremarket.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:49:18", "last_seen_utc": "2026-04-15 03:50:48", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791355": [ { "ioc_value": "shop1.puremarket.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:43:49", "last_seen_utc": "2026-04-15 03:45:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791354": [ { "ioc_value": "gate6-link.clear-stream-web.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:38:18", "last_seen_utc": "2026-04-15 03:40:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791353": [ { "ioc_value": "push5-sync.clear-stream-web.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:32:52", "last_seen_utc": "2026-04-15 03:34:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791352": [ { "ioc_value": "file4-path.clear-stream-web.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:26:47", "last_seen_utc": "2026-04-15 03:28:45", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791351": [ { "ioc_value": "sort3-item.clear-stream-web.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:21:22", "last_seen_utc": "2026-04-15 03:23:35", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791350": [ { "ioc_value": "view2-data.clear-stream-web.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:15:52", "last_seen_utc": "2026-04-15 03:17:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791349": [ { "ioc_value": "https://2ppinmobiliaria.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791345": [ { "ioc_value": "https://the3pete.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791346": [ { "ioc_value": "https://pctjanitorial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791347": [ { "ioc_value": "https://brandbrighten.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791348": [ { "ioc_value": "https://kovaconstruct.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791342": [ { "ioc_value": "https://perthpost.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791343": [ { "ioc_value": "https://christianereichwein.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791344": [ { "ioc_value": "https://inlandnwwindows.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791339": [ { "ioc_value": "https://allhomeliving.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791340": [ { "ioc_value": "https://riveautohaus.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791341": [ { "ioc_value": "https://infocus.tn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791336": [ { "ioc_value": "https://homelawthai.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791337": [ { "ioc_value": "https://premierballetacademy.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791338": [ { "ioc_value": "https://nuyumedispa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791333": [ { "ioc_value": "https://paveny.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791334": [ { "ioc_value": "https://a-artisan.ru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791335": [ { "ioc_value": "https://acrepairingdubai.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791330": [ { "ioc_value": "https://kfsfencingltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791331": [ { "ioc_value": "https://thehealthsite.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791332": [ { "ioc_value": "https://superalloytechnology.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791327": [ { "ioc_value": "https://anovyalifestyle.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791328": [ { "ioc_value": "https://healthkart.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791329": [ { "ioc_value": "https://epicmusicevent.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791325": [ { "ioc_value": "https://alderonbtw.pabrikatap.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791326": [ { "ioc_value": "https://scientificlabs.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791322": [ { "ioc_value": "https://mashable.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791323": [ { "ioc_value": "https://usshuttersandblinds.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791324": [ { "ioc_value": "https://africn.earth/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791320": [ { "ioc_value": "https://airshipman.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791321": [ { "ioc_value": "https://moniquetoonen.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791317": [ { "ioc_value": "https://mail.edwinmsarmiento.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791318": [ { "ioc_value": "https://learnwithmusnad.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791319": [ { "ioc_value": "https://melbournejurnal.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791316": [ { "ioc_value": "https://taylorshappyhome.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 03:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791315": [ { "ioc_value": "flow1-open.clear-stream-web.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:10:25", "last_seen_utc": "2026-04-15 03:11:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791314": [ { "ioc_value": "drop6-main.speed-route-track.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 03:04:21", "last_seen_utc": "2026-04-15 03:06:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791313": [ { "ioc_value": "pack5-unit.speed-route-track.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:58:44", "last_seen_utc": "2026-04-15 03:00:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791312": [ { "ioc_value": "36.50.135.229:25014", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.raton_rat", "malware_alias": null, "malware_printable": "RatonRAT", "first_seen_utc": "2026-04-15 02:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "RatonRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1791311": [ { "ioc_value": "load4-byte.speed-route-track.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:53:40", "last_seen_utc": "2026-04-15 02:55:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791310": [ { "ioc_value": "park3-area.speed-route-track.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:47:34", "last_seen_utc": "2026-04-15 02:49:58", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791309": [ { "ioc_value": "100.113.210.8:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.cobalt_strike", "malware_alias": "Agentemis,BEACON,CobaltStrike,cobeacon", "malware_printable": "Cobalt Strike", "first_seen_utc": "2026-04-15 02:44:45", "last_seen_utc": "2026-04-16 10:47:17", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "CobaltStrike,drb-ra", "anonymous": "0", "reporter": "abuse_ch" } ], "1791308": [ { "ioc_value": "ship2-move.speed-route-track.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:42:28", "last_seen_utc": "2026-04-15 02:44:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791307": [ { "ioc_value": "trip1-road.speed-route-track.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:36:30", "last_seen_utc": "2026-04-15 02:38:53", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791306": [ { "ioc_value": "call6-root.brief-point-sync.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:30:59", "last_seen_utc": "2026-04-15 02:34:01", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791305": [ { "ioc_value": "mail5-send.brief-point-sync.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:25:19", "last_seen_utc": "2026-04-15 02:26:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791304": [ { "ioc_value": "sign4-icon.brief-point-sync.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:19:49", "last_seen_utc": "2026-04-15 02:22:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791303": [ { "ioc_value": "https://nerdfitness.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791299": [ { "ioc_value": "https://encuentronudista.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791300": [ { "ioc_value": "https://redpalace.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791301": [ { "ioc_value": "https://coffee-roasters.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791302": [ { "ioc_value": "https://tintsolutionstn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791296": [ { "ioc_value": "https://cvfloorsandblinds.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791297": [ { "ioc_value": "https://clarksoutpost.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791298": [ { "ioc_value": "https://mybuzzacademy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791294": [ { "ioc_value": "https://solotravelgirls.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791295": [ { "ioc_value": "https://bestchildrenstories.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791292": [ { "ioc_value": "https://justmoluxuryhampers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791293": [ { "ioc_value": "https://youandlittle.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791288": [ { "ioc_value": "https://scrapmycaruk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791289": [ { "ioc_value": "https://order.lawrys.com.sg/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791290": [ { "ioc_value": "https://uaemoverspakers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791291": [ { "ioc_value": "https://appliancescalgaryrepair.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791286": [ { "ioc_value": "https://xn--e1aapbihgng7hh.xn--p1ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791287": [ { "ioc_value": "https://xorlest.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 02:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791285": [ { "ioc_value": "note3-base.brief-point-sync.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:14:17", "last_seen_utc": "2026-04-15 02:14:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791284": [ { "ioc_value": "card2-fast.brief-point-sync.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:08:46", "last_seen_utc": "2026-04-15 02:10:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791283": [ { "ioc_value": "link1-wire.brief-point-sync.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 02:02:50", "last_seen_utc": "2026-04-15 02:04:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791282": [ { "ioc_value": "base6-door.local-vision-hub.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:57:09", "last_seen_utc": "2026-04-15 01:59:18", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791281": [ { "ioc_value": "mark5-logo.local-vision-hub.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:51:37", "last_seen_utc": "2026-04-15 01:56:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791280": [ { "ioc_value": "site4-info.local-vision-hub.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:46:00", "last_seen_utc": "2026-04-15 01:47:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791279": [ { "ioc_value": "zone3-view.local-vision-hub.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:40:30", "last_seen_utc": "2026-04-15 01:41:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791278": [ { "ioc_value": "area2-find.local-vision-hub.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:35:10", "last_seen_utc": "2026-04-15 01:36:37", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791277": [ { "ioc_value": "city1-spot.local-vision-hub.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:28:36", "last_seen_utc": "2026-04-15 01:28:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791276": [ { "ioc_value": "work6-host.active-phase-net.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:23:11", "last_seen_utc": "2026-04-15 01:24:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791275": [ { "ioc_value": "goal5-list.active-phase-net.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:17:33", "last_seen_utc": "2026-04-15 01:19:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791272": [ { "ioc_value": "https://homedit.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791273": [ { "ioc_value": "https://texaswindows.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791274": [ { "ioc_value": "https://salek.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791267": [ { "ioc_value": "https://iabethel.edu.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791268": [ { "ioc_value": "https://soareproductions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791269": [ { "ioc_value": "https://insideautomacao.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791270": [ { "ioc_value": "https://pgatbu.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791271": [ { "ioc_value": "https://sdanmtckwadaso.edu.gh/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791264": [ { "ioc_value": "https://ceramiclonghau.com.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791265": [ { "ioc_value": "https://cakramakmurabadi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791266": [ { "ioc_value": "https://discoverystudio.bio/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791260": [ { "ioc_value": "https://phcnepal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791261": [ { "ioc_value": "https://tipsbythecuracaobible.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791262": [ { "ioc_value": "https://sarvagun.life/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791263": [ { "ioc_value": "https://mincometsal.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791257": [ { "ioc_value": "https://m1-ma.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791258": [ { "ioc_value": "https://bestcareservices.co.ke/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791259": [ { "ioc_value": "https://ruouchat.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791254": [ { "ioc_value": "https://farmersfamily.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791255": [ { "ioc_value": "https://funtoast.com.sg/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791256": [ { "ioc_value": "https://kusskuss.wien/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791251": [ { "ioc_value": "https://fggcumuahia.sch.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791252": [ { "ioc_value": "https://airxpresstesting.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791253": [ { "ioc_value": "https://siddhamenthospital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791248": [ { "ioc_value": "https://cakrawalainfo.co.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791249": [ { "ioc_value": "https://siriosfm.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791250": [ { "ioc_value": "https://geely-tunisie.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791245": [ { "ioc_value": "https://rumahcetakundangan.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791246": [ { "ioc_value": "https://digimarket.link/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791247": [ { "ioc_value": "https://istnets.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791242": [ { "ioc_value": "https://terminalhall.co.il/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791243": [ { "ioc_value": "https://mayabeachclubphuket.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791244": [ { "ioc_value": "https://krishivoils.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791240": [ { "ioc_value": "https://sf-fabrication.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791241": [ { "ioc_value": "https://mjdaccountants.ie/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791237": [ { "ioc_value": "https://sanfrancescos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791238": [ { "ioc_value": "https://diazyasociados.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791239": [ { "ioc_value": "https://intranet.digital.maceio.al.gov.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791234": [ { "ioc_value": "https://radarr.africa/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791235": [ { "ioc_value": "https://job-bank.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791236": [ { "ioc_value": "https://ourdailymannaworldwide.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791231": [ { "ioc_value": "https://typehuman.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791232": [ { "ioc_value": "https://man2ska.sch.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791233": [ { "ioc_value": "https://bayrestorationsct.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791229": [ { "ioc_value": "https://goldnestresearch.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791230": [ { "ioc_value": "https://pompiliomartinez.edu.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791228": [ { "ioc_value": "https://opportunitiesforeveryone.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-15 01:15:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1791227": [ { "ioc_value": "term4-text.active-phase-net.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:12:00", "last_seen_utc": "2026-04-15 01:13:08", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791225": [ { "ioc_value": "plan3-item.active-phase-net.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:06:15", "last_seen_utc": "2026-04-15 01:08:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791223": [ { "ioc_value": "step2-flow.active-phase-net.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 01:00:42", "last_seen_utc": "2026-04-15 01:01:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791221": [ { "ioc_value": "task1-core.active-phase-net.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:55:05", "last_seen_utc": "2026-04-15 00:56:42", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791220": [ { "ioc_value": "cover6-link.daily-report-flow.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:49:37", "last_seen_utc": "2026-04-15 00:51:16", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791219": [ { "ioc_value": "sheet5-view.daily-report-flow.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:44:09", "last_seen_utc": "2026-04-15 00:44:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791218": [ { "ioc_value": "table4-data.daily-report-flow.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:38:30", "last_seen_utc": "2026-04-15 00:39:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791216": [ { "ioc_value": "topic3-base.daily-report-flow.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:33:14", "last_seen_utc": "2026-04-15 00:35:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791215": [ { "ioc_value": "event2-log.daily-report-flow.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:27:59", "last_seen_utc": "2026-04-15 00:32:02", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791214": [ { "ioc_value": "news1-wire.daily-report-flow.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:21:37", "last_seen_utc": "2026-04-15 00:22:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791212": [ { "ioc_value": "front6-gate.prime-sector-unit.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:16:13", "last_seen_utc": "2026-04-15 00:16:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791209": [ { "ioc_value": "piece5-load.prime-sector-unit.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:10:31", "last_seen_utc": "2026-04-15 00:13:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791208": [ { "ioc_value": "layer4-show.prime-sector-unit.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-15 00:04:58", "last_seen_utc": "2026-04-15 00:09:25", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791205": [ { "ioc_value": "frame3-work.prime-sector-unit.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:58:50", "last_seen_utc": "2026-04-15 00:00:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791202": [ { "ioc_value": "part1-head.prime-sector-unit.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:53:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791201": [ { "ioc_value": "block2-text.prime-sector-unit.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:53:40", "last_seen_utc": "2026-04-14 23:54:21", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791200": [ { "ioc_value": "jobs.maanas.in", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "win.strelastealer", "malware_alias": null, "malware_printable": "StrelaStealer", "first_seen_utc": "2026-04-14 23:53:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": null, "tags": "StrelaStealer", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791197": [ { "ioc_value": "place6-hub.urban-motion-app.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:47:00", "last_seen_utc": "2026-04-14 23:48:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791196": [ { "ioc_value": "cycle5-time.urban-motion-app.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:41:20", "last_seen_utc": "2026-04-14 23:43:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791195": [ { "ioc_value": "store4-data.urban-motion-app.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:35:48", "last_seen_utc": "2026-04-14 23:36:31", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791194": [ { "ioc_value": "track3-info.urban-motion-app.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:30:05", "last_seen_utc": "2026-04-14 23:32:21", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791193": [ { "ioc_value": "point2-map.urban-motion-app.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:24:15", "last_seen_utc": "2026-04-14 23:25:06", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791192": [ { "ioc_value": "route1-path.urban-motion-app.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:18:46", "last_seen_utc": "2026-04-14 23:20:41", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791191": [ { "ioc_value": "fan.sequareeus.online", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 23:13:15", "last_seen_utc": "2026-04-15 16:16:43", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791190": [ { "ioc_value": "https://fan.sequareeus.online/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 23:13:13", "last_seen_utc": "2026-04-15 16:16:38", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1791189": [ { "ioc_value": "stage6-main.global-export-base.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:13:06", "last_seen_utc": "2026-04-14 23:15:04", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791188": [ { "ioc_value": "brand5-post.global-export-base.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:07:26", "last_seen_utc": "2026-04-14 23:09:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791187": [ { "ioc_value": "total4-view.global-export-base.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 23:01:44", "last_seen_utc": "2026-04-14 23:03:53", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791186": [ { "ioc_value": "brief3-form.global-export-base.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:56:18", "last_seen_utc": "2026-04-14 22:58:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791185": [ { "ioc_value": "stock2-item.global-export-base.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:50:48", "last_seen_utc": "2026-04-14 22:53:03", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791184": [ { "ioc_value": "order1-list.global-export-base.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:45:08", "last_seen_utc": "2026-04-14 22:47:25", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791183": [ { "ioc_value": "entry6-site.smart-logic-trade.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:39:32", "last_seen_utc": "2026-04-14 22:44:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791182": [ { "ioc_value": "staff5-help.smart-logic-trade.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:33:57", "last_seen_utc": "2026-04-14 22:35:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791181": [ { "ioc_value": "media4-file.smart-logic-trade.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:28:19", "last_seen_utc": "2026-04-14 22:30:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791180": [ { "ioc_value": "index3-page.smart-logic-trade.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:22:36", "last_seen_utc": "2026-04-14 22:24:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1791179": [ { "ioc_value": "guest2-area.smart-logic-trade.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:16:55", "last_seen_utc": "2026-04-14 22:19:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791177": [ { "ioc_value": "svc5-rule.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:09:40", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791176": [ { "ioc_value": "http://192.210.229.56/uVgKYZKNG167.bin", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:06:48", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791175": [ { "ioc_value": "http://192.210.229.56/piecea.txt", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:06:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791174": [ { "ioc_value": "http://192.210.229.56/pi-psi.txt", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:06:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791173": [ { "ioc_value": "http://192.210.229.56/demo.exe", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-14 22:05:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix,Remcos", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791172": [ { "ioc_value": "vault4-key.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 22:04:06", "last_seen_utc": "2026-04-14 22:05:03", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791171": [ { "ioc_value": "http://192.210.229.56/Wanny.cmd", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:04:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791170": [ { "ioc_value": "http://192.210.229.56/Sminker190.asi", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:03:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791169": [ { "ioc_value": "http://192.210.229.56/Quittor.asd", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:03:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791168": [ { "ioc_value": "http://192.210.229.56/NdfGSLF242.bin", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:02:31", "last_seen_utc": "2026-04-14 22:02:50", "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791167": [ { "ioc_value": "http://192.210.229.56/Kvilibrists.mso", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:02:08", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791166": [ { "ioc_value": "http://192.210.229.56/Infinitated.wsf", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:01:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791165": [ { "ioc_value": "http://192.210.229.56/HqHegXUhMScq148.bin", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:01:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791164": [ { "ioc_value": "http://192.210.229.56/Highlife.wsf", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:00:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791163": [ { "ioc_value": "http://192.210.229.56/HUfyIHIHIiLV160.bin", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 22:00:17", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791160": [ { "ioc_value": "http://192.210.229.56/Eurhythmic.cmd", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:59:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791159": [ { "ioc_value": "http://192.210.229.56/Antibiotikaforbrug.cmd", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:58:51", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791158": [ { "ioc_value": "http://192.210.229.56/Afsnringens.xtp", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:58:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791157": [ { "ioc_value": "host3-peer.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 21:58:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791156": [ { "ioc_value": "http://192.210.229.56/Afbrndings.msi", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:58:06", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791154": [ { "ioc_value": "http://192.210.229.56/11a.txt", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:54:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791153": [ { "ioc_value": "http://192.210.229.56/11b.txt", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:54:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791152": [ { "ioc_value": "api2-node.xel7morax.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 21:52:40", "last_seen_utc": "2026-04-14 21:54:29", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791151": [ { "ioc_value": "http://192.210.229.56/an1.txt", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:48:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791150": [ { "ioc_value": "http://192.210.229.56/an2.txt", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:48:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791148": [ { "ioc_value": "host3-link.scanda1visibil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 21:44:46", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791146": [ { "ioc_value": "api2-node.scanda1visibil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 21:40:52", "last_seen_utc": "2026-04-14 21:42:03", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791145": [ { "ioc_value": "http://192.210.229.56/wa1.txt", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:39:14", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791144": [ { "ioc_value": "http://192.210.229.56/wa2.txt", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:38:40", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791143": [ { "ioc_value": "https://securitynote4458652318.com", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:37:36", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791142": [ { "ioc_value": "securitynote4458652318.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 21:36:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ClickFix", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1791141": [ { "ioc_value": "view1-core.scanda1visibil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 21:35:07", "last_seen_utc": "2026-04-14 21:36:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1791140": [ { "ioc_value": "137.220.140.38:9000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-14 20:57:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/dfb59fcee8102cd4055b29396a0a3b3d7d23c113b94ac37517ad24038b50e7ca/", "tags": "valleyrat_s2", "anonymous": "0", "reporter": "abuse_ch" } ], "1791138": [ { "ioc_value": "gate6-way.bri7tanon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:58:06", "last_seen_utc": "2026-04-14 20:16:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790981": [ { "ioc_value": "api2-cert.bri7tanon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:56:39", "last_seen_utc": "2026-04-14 19:36:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "14April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1790983": [ { "ioc_value": "134.175.171.137:10001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.extreme_rat", "malware_alias": "ExtRat", "malware_printable": "Xtreme RAT", "first_seen_utc": "2026-04-14 19:56:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ExtRat,Xtreme RAT", "anonymous": "0", "reporter": "whoamix302" } ], "1790987": [ { "ioc_value": "relay.scryyuiopp.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-14 19:56:38", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "connectwise,screenconnect", "anonymous": "1", "reporter": "tanner" } ], "1790988": [ { "ioc_value": "svc5-task.bri7tanon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:56:37", "last_seen_utc": "2026-04-14 19:57:48", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "14April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1791128": [ { "ioc_value": "truronnil86.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791129": [ { "ioc_value": "trutal.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791130": [ { "ioc_value": "vadinminpaz.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791131": [ { "ioc_value": "vadintum.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791132": [ { "ioc_value": "vafil.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791133": [ { "ioc_value": "vaguntum.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791134": [ { "ioc_value": "vasom.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791135": [ { "ioc_value": "vatar.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791136": [ { "ioc_value": "vawinmonvaz.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791137": [ { "ioc_value": "vazinpanpor.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:03", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791127": [ { "ioc_value": "truroncol002.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:02", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791103": [ { "ioc_value": "strinal.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791104": [ { "ioc_value": "stripanfincol.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791105": [ { "ioc_value": "strisantez.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791106": [ { "ioc_value": "stritancil.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791107": [ { "ioc_value": "stritez64.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791108": [ { "ioc_value": "stritonpaz51.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791109": [ { "ioc_value": "stroim75.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791110": [ { "ioc_value": "trelannal.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791111": [ { "ioc_value": "treronbel.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791112": [ { "ioc_value": "treronbenjal.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791113": [ { "ioc_value": "trevaz.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": "2026-04-14 19:56:57", "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791114": [ { "ioc_value": "trexoncal.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791115": [ { "ioc_value": "trexontunral.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791116": [ { "ioc_value": "tricanfel.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791117": [ { "ioc_value": "tridengoncol.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791118": [ { "ioc_value": "tridenlinmol.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791119": [ { "ioc_value": "tridenpaz.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791120": [ { "ioc_value": "tridensintal.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791121": [ { "ioc_value": "trigem8.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791122": [ { "ioc_value": "tritonriz.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791123": [ { "ioc_value": "tritonvaz.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791124": [ { "ioc_value": "tritum.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791125": [ { "ioc_value": "trujanpunbil.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791126": [ { "ioc_value": "trunanhal.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791077": [ { "ioc_value": "scrovinvel.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791078": [ { "ioc_value": "sprofil566.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791079": [ { "ioc_value": "sprolenfincal48.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791080": [ { "ioc_value": "sprominpor.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791081": [ { "ioc_value": "sprotil.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791082": [ { "ioc_value": "sprovinconrol6.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791083": [ { "ioc_value": "sprudor.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791084": [ { "ioc_value": "sprumanim.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791085": [ { "ioc_value": "sprumannal.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791086": [ { "ioc_value": "sprusom.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791087": [ { "ioc_value": "sprutenim6.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791088": [ { "ioc_value": "sprutentum.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791089": [ { "ioc_value": "sprutil.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791090": [ { "ioc_value": "stacinlhar.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791091": [ { "ioc_value": "stakinlhar40.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791092": [ { "ioc_value": "stakinransar.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791093": [ { "ioc_value": "staval45.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791094": [ { "ioc_value": "stazinim.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": "2026-04-14 19:56:57", "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791095": [ { "ioc_value": "stralhar.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791096": [ { "ioc_value": "stratenim.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791097": [ { "ioc_value": "stravinpanfar.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791098": [ { "ioc_value": "stredor.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": "2026-04-14 19:56:57", "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791099": [ { "ioc_value": "strelenmonsal.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791100": [ { "ioc_value": "stresonlingor.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791101": [ { "ioc_value": "stretar7.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": "2026-04-14 19:56:57", "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791102": [ { "ioc_value": "strilenmonvir75.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:56:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791051": [ { "ioc_value": "propinmenpal.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791052": [ { "ioc_value": "proronmenpal.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791053": [ { "ioc_value": "provaz.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791054": [ { "ioc_value": "prudintum.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791055": [ { "ioc_value": "prumintil.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791056": [ { "ioc_value": "pruninlhar.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791057": [ { "ioc_value": "prutendiz.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791058": [ { "ioc_value": "prutentonsil.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791059": [ { "ioc_value": "pruval.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791060": [ { "ioc_value": "pruwintanpaz.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791061": [ { "ioc_value": "pruzinim.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791062": [ { "ioc_value": "pruzinpanpaz.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791063": [ { "ioc_value": "scredinlencil.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791064": [ { "ioc_value": "scregunconriz.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791065": [ { "ioc_value": "scregunvir.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791066": [ { "ioc_value": "screzinlhar.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791067": [ { "ioc_value": "scribil.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791068": [ { "ioc_value": "scrigungem.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791069": [ { "ioc_value": "scriwingem.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791070": [ { "ioc_value": "scroder.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791071": [ { "ioc_value": "scrogunim.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791072": [ { "ioc_value": "scrotar.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791073": [ { "ioc_value": "scrotentanfar.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791074": [ { "ioc_value": "scrotentanpor.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791075": [ { "ioc_value": "scrotentonriz.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791076": [ { "ioc_value": "scrotentum.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791026": [ { "ioc_value": "ploral5.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791027": [ { "ioc_value": "plosul.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791028": [ { "ioc_value": "prafinbel.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791029": [ { "ioc_value": "prafinhenkil.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791030": [ { "ioc_value": "prananhal.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791031": [ { "ioc_value": "prapaz.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791032": [ { "ioc_value": "praronsonbil.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791033": [ { "ioc_value": "prepaz.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791034": [ { "ioc_value": "prepinfel850.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791035": [ { "ioc_value": "presar08.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791036": [ { "ioc_value": "presinqual0.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791037": [ { "ioc_value": "prial73.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791038": [ { "ioc_value": "pribanhennal.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791039": [ { "ioc_value": "priconvaz742.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791040": [ { "ioc_value": "pridenvir.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791041": [ { "ioc_value": "prigir.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791042": [ { "ioc_value": "prilanfunxil.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791043": [ { "ioc_value": "prisonpaz.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791044": [ { "ioc_value": "prisonrongor.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791045": [ { "ioc_value": "prisonronmol.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791046": [ { "ioc_value": "prisonsal.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791047": [ { "ioc_value": "pritez607.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791048": [ { "ioc_value": "pritez.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791049": [ { "ioc_value": "procanjankil0.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791050": [ { "ioc_value": "procantal82.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791001": [ { "ioc_value": "plansonval.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791002": [ { "ioc_value": "plasonsil.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791003": [ { "ioc_value": "plemindor.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791004": [ { "ioc_value": "pleninnal.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791005": [ { "ioc_value": "pleninrangir.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791006": [ { "ioc_value": "plenongunnal41.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791007": [ { "ioc_value": "plenonsandiz4.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791008": [ { "ioc_value": "plenonzol4.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791009": [ { "ioc_value": "plepal240.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791010": [ { "ioc_value": "plikinal.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791011": [ { "ioc_value": "plilinlhar.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791012": [ { "ioc_value": "plilinvintez.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791013": [ { "ioc_value": "plinil33.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791014": [ { "ioc_value": "plinindor.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791015": [ { "ioc_value": "plininransar.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791016": [ { "ioc_value": "pliqual28.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791017": [ { "ioc_value": "pliqual.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791018": [ { "ioc_value": "pliral5.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791019": [ { "ioc_value": "pliral.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791020": [ { "ioc_value": "plisul.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791021": [ { "ioc_value": "plogunconrol.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791022": [ { "ioc_value": "plolintar.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791023": [ { "ioc_value": "plomanvel.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791024": [ { "ioc_value": "plominsom.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791025": [ { "ioc_value": "ploral5.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:57", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790989": [ { "ioc_value": "grugoncinnal.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790990": [ { "ioc_value": "grugonwinnal.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790991": [ { "ioc_value": "grukil33.balancoexpress.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790992": [ { "ioc_value": "grunonmanvel.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790993": [ { "ioc_value": "grupunzol332.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790994": [ { "ioc_value": "grural.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790995": [ { "ioc_value": "gruval.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790996": [ { "ioc_value": "plalenmonsal675.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790997": [ { "ioc_value": "plaminpor.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790998": [ { "ioc_value": "planal.contabilsmart.cloud", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790999": [ { "ioc_value": "planbel.contabilfacil.sbs", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1791000": [ { "ioc_value": "planmol.contabilidadeonline.top", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.astaroth", "malware_alias": "Guildma", "malware_printable": "Astaroth", "first_seen_utc": "2026-04-14 19:55:56", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182/", "tags": "Astaroth,Guildma", "anonymous": "0", "reporter": "abuse_ch" } ], "1790986": [ { "ioc_value": "box4-file.bri7tanon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:47:18", "last_seen_utc": "2026-04-14 19:49:13", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790984": [ { "ioc_value": "mn.manicottiearring.cfd", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.acr_stealer", "malware_alias": null, "malware_printable": "ACR Stealer", "first_seen_utc": "2026-04-14 19:46:25", "last_seen_utc": "2026-04-14 19:46:25", "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/59c71bceca62f570b146021b3f51b55d28a5323c4106350ee4d5f5514c4549d9/", "tags": "ACRStealer", "anonymous": "0", "reporter": "abuse_ch" } ], "1790985": [ { "ioc_value": "cdn-1415.brightcanvas.digital", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.acr_stealer", "malware_alias": null, "malware_printable": "ACR Stealer", "first_seen_utc": "2026-04-14 19:46:25", "last_seen_utc": "2026-04-14 19:46:25", "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/59c71bceca62f570b146021b3f51b55d28a5323c4106350ee4d5f5514c4549d9/", "tags": "ACRStealer", "anonymous": "0", "reporter": "abuse_ch" } ], "1790982": [ { "ioc_value": "node3-list.bri7tanon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:41:20", "last_seen_utc": "2026-04-14 19:46:25", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790979": [ { "ioc_value": "paymentsv2.mysynology.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 19:34:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/e226ad9057d1241cee7c084f8c80d8f0a83b14444ad5057b916a1a7fd26ba64a/", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1790980": [ { "ioc_value": "pay.hostingshared99.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 19:34:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/e226ad9057d1241cee7c084f8c80d8f0a83b14444ad5057b916a1a7fd26ba64a/", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1790978": [ { "ioc_value": "web1-host.bri7tanon.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:30:32", "last_seen_utc": "2026-04-14 19:30:50", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790946": [ { "ioc_value": "gate6-zone.dru9laxen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:26:58", "last_seen_utc": "2026-04-14 18:51:11", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "14April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1790976": [ { "ioc_value": "download-version.1-8-3.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-14 19:26:07", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/suyog41/status/2043944154250784858", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1790977": [ { "ioc_value": "jpbassin.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-14 19:26:07", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/suyog41/status/2043944154250784858", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1790974": [ { "ioc_value": "mail-svr.co", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.sidewinder", "malware_alias": null, "malware_printable": "SideWinder", "first_seen_utc": "2026-04-14 19:25:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/SinghSoodeep/status/2043571382601289736", "tags": "SideWinder", "anonymous": "0", "reporter": "abuse_ch" } ], "1790975": [ { "ioc_value": "www-unocha-org.mail-svr.co", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.sidewinder", "malware_alias": null, "malware_printable": "SideWinder", "first_seen_utc": "2026-04-14 19:25:15", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/SinghSoodeep/status/2043571382601289736", "tags": "SideWinder", "anonymous": "0", "reporter": "abuse_ch" } ], "1790973": [ { "ioc_value": "gate6-area.nor4vexil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:24:35", "last_seen_utc": "2026-04-14 19:26:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790972": [ { "ioc_value": "204.12.236.177:9628", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.crimson", "malware_alias": "SEEDOOR,Scarimson", "malware_printable": "Crimson RAT", "first_seen_utc": "2026-04-14 19:21:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://x.com/Cyberteam008/status/2043891889842291024", "tags": "CrimsonRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1790971": [ { "ioc_value": "uk176video.live", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 19:20:16", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://x.com/suyog41/status/2044030629684367478", "tags": "SHubStealer", "anonymous": "0", "reporter": "abuse_ch" } ], "1790970": [ { "ioc_value": "svc5-edge.nor4vexil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:19:15", "last_seen_utc": "2026-04-14 19:23:52", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790968": [ { "ioc_value": "204.76.203.162:428", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-14 19:16:14", "last_seen_utc": "2026-04-15 07:11:45", "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/5ec30eee79375992113484eb74be32aa78cbc2ddc1f7d59cd1f06c54cd916d4c/", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1790969": [ { "ioc_value": "64.89.161.178:484", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-14 19:16:14", "last_seen_utc": "2026-04-15 07:11:48", "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/5ec30eee79375992113484eb74be32aa78cbc2ddc1f7d59cd1f06c54cd916d4c/", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1790967": [ { "ioc_value": "94.232.41.96:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.tofsee", "malware_alias": "Gheg", "malware_printable": "Tofsee", "first_seen_utc": "2026-04-14 19:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/5ec30eee79375992113484eb74be32aa78cbc2ddc1f7d59cd1f06c54cd916d4c/", "tags": "Tofsee", "anonymous": "0", "reporter": "abuse_ch" } ], "1790966": [ { "ioc_value": "salt4-byte.nor4vexil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:13:25", "last_seen_utc": "2026-04-14 19:14:27", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790958": [ { "ioc_value": "91.199.163.124:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790959": [ { "ioc_value": "91.84.123.231:3334", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790960": [ { "ioc_value": "91.84.123.231:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790961": [ { "ioc_value": "87.121.79.21:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790962": [ { "ioc_value": "179.43.159.106:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790963": [ { "ioc_value": "31.57.166.134:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790964": [ { "ioc_value": "178.16.55.142:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790965": [ { "ioc_value": "185.196.11.63:3334", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790952": [ { "ioc_value": "66.90.86.58:3334", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790953": [ { "ioc_value": "66.90.86.58:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790954": [ { "ioc_value": "185.196.11.63:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790955": [ { "ioc_value": "94.154.32.112:3334", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790956": [ { "ioc_value": "94.154.32.112:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790957": [ { "ioc_value": "91.199.163.124:3334", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 19:12:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790951": [ { "ioc_value": "node3-view.nor4vexil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:07:36", "last_seen_utc": "2026-04-14 19:12:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790950": [ { "ioc_value": "api2-test.nor4vexil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 19:02:20", "last_seen_utc": "2026-04-14 19:06:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790949": [ { "ioc_value": "181.235.1.253:4000", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 18:59:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/9b99747d1b73fbca15dbc14f2cd30f2d6fc12362ba78f271d30c2b5351945c2b/", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1790948": [ { "ioc_value": "auth1-user.nor4vexil.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:56:35", "last_seen_utc": "2026-04-14 18:57:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790947": [ { "ioc_value": "107.172.135.18:4449", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.nworm", "malware_alias": "nw0rm,NWorm", "malware_printable": "N-W0rm", "first_seen_utc": "2026-04-14 18:55:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3e0429ba1bb7bb27751b7bf7d1f6c9561ffe5dcd41dd9ef7ef6d17f0b0a29b90/", "tags": null, "anonymous": "0", "reporter": "abuse_ch" } ], "1790944": [ { "ioc_value": "195.177.94.94:3334", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 18:50:36", "last_seen_utc": "2026-04-14 19:12:55", "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/d0d91ff020800f60ddb2cbded3c79fb9de0fc261e4468fa2a7d283985470bc68/", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790945": [ { "ioc_value": "195.177.94.94:3333", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.snappy_client", "malware_alias": null, "malware_printable": "SnappyClient", "first_seen_utc": "2026-04-14 18:50:36", "last_seen_utc": "2026-04-14 19:12:55", "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/d0d91ff020800f60ddb2cbded3c79fb9de0fc261e4468fa2a7d283985470bc68/", "tags": "SnappyClient", "anonymous": "0", "reporter": "abuse_ch" } ], "1790943": [ { "ioc_value": "svc5-info.dru9laxen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:45:21", "last_seen_utc": "2026-04-14 18:50:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790942": [ { "ioc_value": "palyholy.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:45:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790941": [ { "ioc_value": "138.124.231.40:4324", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown_rat", "malware_alias": null, "malware_printable": "Unknown RAT", "first_seen_utc": "2026-04-14 18:44:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3f7552684f1f8547631e002bbf97058e6ee79408855104770cee7d1825aababb/", "tags": "RAT,SheetRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1790940": [ { "ioc_value": "quietjourney.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:42:58", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790939": [ { "ioc_value": "sakkoscarped.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:41:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790938": [ { "ioc_value": "tmp4-root.dru9laxen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:39:59", "last_seen_utc": "2026-04-14 18:44:53", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790937": [ { "ioc_value": "yellowsp00n.digital", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:39:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790936": [ { "ioc_value": "silverhorizon.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:37:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790851": [ { "ioc_value": "64.95.12.251:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "js.kongtuke", "malware_alias": "TAG-124,js.LandUpdate808", "malware_printable": "KongTuke", "first_seen_utc": "2026-04-14 18:35:30", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "js.LandUpdate808,KongTuke,TAG-124", "anonymous": "0", "reporter": "whoamix302" } ], "1790852": [ { "ioc_value": "151.59.35.87:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.sectop_rat", "malware_alias": "1xxbot,ArechClient", "malware_printable": "SectopRAT", "first_seen_utc": "2026-04-14 18:35:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "1xxbot,ArechClient,SectopRAT", "anonymous": "0", "reporter": "whoamix302" } ], "1790853": [ { "ioc_value": "149.12.67.197:139", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.extreme_rat", "malware_alias": "ExtRat", "malware_printable": "Xtreme RAT", "first_seen_utc": "2026-04-14 18:35:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "ExtRat,Xtreme RAT", "anonymous": "0", "reporter": "whoamix302" } ], "1790873": [ { "ioc_value": "54.38.153.252:7777", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 18:35:28", "last_seen_utc": "2026-04-14 18:46:39", "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/3fa264b936c1c55741804d8a939adb64a6bd538ccc160f6dbbc47031b2ba48c4/", "tags": "c2", "anonymous": "0", "reporter": "burger" } ], "1790875": [ { "ioc_value": "124.198.131.194:5555", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "elf.evilginx", "malware_alias": null, "malware_printable": "Evilginx", "first_seen_utc": "2026-04-14 18:35:28", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "124-198-131-194-5555", "anonymous": "0", "reporter": "BlinkzSec" } ], "1790889": [ { "ioc_value": "https://www.azaleaart.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 18:35:27", "last_seen_utc": null, "confidence_level": 90, "is_compromised": false, "reference": "https://clickfix.carsonww.com/domains/www.azaleaart.com", "tags": "ClickFix", "anonymous": "0", "reporter": "CarsonWilliams" } ], "1790890": [ { "ioc_value": "https://www.kargoflowlogistics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 18:35:27", "last_seen_utc": null, "confidence_level": 90, "is_compromised": false, "reference": "https://clickfix.carsonww.com/domains/www.kargoflowlogistics.com", "tags": "ClickFix", "anonymous": "0", "reporter": "CarsonWilliams" } ], "1790897": [ { "ioc_value": "http://185.183.35.120", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 18:35:26", "last_seen_utc": "2026-04-16 06:01:27", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,REMPROXY", "anonymous": "0", "reporter": "BlackLotusLabs" } ], "1790918": [ { "ioc_value": "185.35.139.147:8001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "elf.aisuru", "malware_alias": null, "malware_printable": "Aisuru", "first_seen_utc": "2026-04-14 18:35:26", "last_seen_utc": "2026-04-16 11:35:00", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "Aisuru,c2", "anonymous": "0", "reporter": "Bitsight" } ], "1790930": [ { "ioc_value": "api2-stat.dru9laxen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:35:25", "last_seen_utc": "2026-04-14 18:29:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "14April2026,ClearFake,Commandline,Windows", "anonymous": "0", "reporter": "Gi7w0rm" } ], "1790935": [ { "ioc_value": "sixthgoods.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:34:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790934": [ { "ioc_value": "node3-pack.dru9laxen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:34:12", "last_seen_utc": "2026-04-14 18:38:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790933": [ { "ioc_value": "sockspaint.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:33:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790932": [ { "ioc_value": "olamicgiglio.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:31:45", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790931": [ { "ioc_value": "doucevie.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:30:18", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790929": [ { "ioc_value": "petitmoment.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:27:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790928": [ { "ioc_value": "tcp1-join.dru9laxen.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:23:10", "last_seen_utc": "2026-04-14 19:01:55", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790927": [ { "ioc_value": "ic0n1cvalley.com", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:22:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790926": [ { "ioc_value": "goldenpromise.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:20:59", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790925": [ { "ioc_value": "sunnygarden.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:19:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790924": [ { "ioc_value": "gate6-link.xel2mavor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:17:20", "last_seen_utc": "2026-04-14 18:21:08", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790923": [ { "ioc_value": "troyonsatine.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:14:49", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790922": [ { "ioc_value": "mathworks.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:11:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790921": [ { "ioc_value": "svc5-base.xel2mavor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:11:36", "last_seen_utc": "2026-04-14 18:15:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790920": [ { "ioc_value": "calmatelier.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:10:54", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790919": [ { "ioc_value": "simplepleasure.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:10:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790917": [ { "ioc_value": "bonnechance.today", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:09:34", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790916": [ { "ioc_value": "gakabie.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:09:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790915": [ { "ioc_value": "glaciarhaven.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:08:19", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790914": [ { "ioc_value": "jobs.betastuff.de", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "win.strelastealer", "malware_alias": null, "malware_printable": "StrelaStealer", "first_seen_utc": "2026-04-14 18:07:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": null, "tags": "StrelaStealer", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790913": [ { "ioc_value": "prairequell.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:06:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790912": [ { "ioc_value": "git4-repo.xel2mavor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:06:11", "last_seen_utc": "2026-04-14 18:08:47", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790911": [ { "ioc_value": "47.238.140.52:22", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-14 18:05:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-r5prwsdx2k", "tags": "AS45102,C2,rat,triage,valleyrat", "anonymous": "0", "reporter": "DonPasci" } ], "1790910": [ { "ioc_value": "47.238.140.52:443", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-14 18:05:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-r5prwsdx2k", "tags": "AS45102,C2,rat,triage,valleyrat", "anonymous": "0", "reporter": "DonPasci" } ], "1790909": [ { "ioc_value": "47.238.140.52:8080", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-14 18:05:17", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-r5prwsdx2k", "tags": "AS45102,C2,rat,triage,valleyrat", "anonymous": "0", "reporter": "DonPasci" } ], "1790908": [ { "ioc_value": "heatherquarz.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:05:00", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790907": [ { "ioc_value": "cedar2glanz.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:04:22", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790906": [ { "ioc_value": "lovebackshastri.in.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 18:04:08", "last_seen_utc": "2026-04-14 18:04:14", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-p7a1eaex6s", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790905": [ { "ioc_value": "jquery.js-library-host.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 18:04:04", "last_seen_utc": "2026-04-14 18:04:06", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-rfbhzacw6k", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790904": [ { "ioc_value": "ceajip.za.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 18:03:56", "last_seen_utc": "2026-04-14 18:04:02", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-snljkshy4s", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790903": [ { "ioc_value": "trainingmatters.uk.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 18:03:51", "last_seen_utc": "2026-04-14 18:03:54", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-tbvgdsft7k", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790902": [ { "ioc_value": "88.90.102.107:4782", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 18:03:50", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-s5m4qsfs3m", "tags": "AS2119,C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790901": [ { "ioc_value": "bookus.in.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 18:03:46", "last_seen_utc": "2026-04-14 18:03:48", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-vhzkcsgw2p", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790900": [ { "ioc_value": "oakenfjrod.ru", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown_stealer", "malware_alias": null, "malware_printable": "Unknown Stealer", "first_seen_utc": "2026-04-14 18:03:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Fake Claude", "anonymous": "0", "reporter": "HuntYethHounds" } ], "1790899": [ { "ioc_value": "instafashion.in.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 18:03:42", "last_seen_utc": "2026-04-14 18:03:44", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-vhzkcsgw2p", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790898": [ { "ioc_value": "fxcm.in.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 18:03:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-wdlclsgz3k", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790896": [ { "ioc_value": "bunnea.duckdns.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-14 18:01:47", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-r7k7gsg15y", "tags": "C2,domain,rat,remcos,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1790895": [ { "ioc_value": "egym7md-64674.portmap.host", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-14 18:01:35", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-rt9mxsc18q", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1790894": [ { "ioc_value": "kokymrgy2000.hopto.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-14 18:01:32", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-r2hjeagy5w", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1790893": [ { "ioc_value": "hacker76413312-39033.portmap.host", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-14 18:01:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-sr3x2ahz5t", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1790892": [ { "ioc_value": "sdlpsajdioasjd-60039.portmap.host", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-14 18:01:26", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-te451aay61", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1790891": [ { "ioc_value": "45.83.31.50:7658", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-14 18:01:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-vm262sgw5q", "tags": "AS210558,C2,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1790888": [ { "ioc_value": "node3-flag.xel2mavor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 18:00:31", "last_seen_utc": "2026-04-14 18:05:42", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790887": [ { "ioc_value": "api2-path.xel2mavor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:55:11", "last_seen_utc": "2026-04-14 18:00:09", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790886": [ { "ioc_value": "ops1-view.xel2mavor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:49:04", "last_seen_utc": "2026-04-14 17:51:08", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790885": [ { "ioc_value": "gate6-hub.prax6tolin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:43:50", "last_seen_utc": "2026-04-14 17:45:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790884": [ { "ioc_value": "svc5-mesh.prax6tolin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:37:58", "last_seen_utc": "2026-04-14 17:39:22", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790883": [ { "ioc_value": "db4-cache.prax6tolin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:32:50", "last_seen_utc": "2026-04-14 17:34:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790882": [ { "ioc_value": "node3-fast.prax6tolin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:27:01", "last_seen_utc": "2026-04-14 17:28:44", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790881": [ { "ioc_value": "api2-meta.prax6tolin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:21:07", "last_seen_utc": "2026-04-14 17:23:27", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790880": [ { "ioc_value": "run1-task.prax6tolin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:15:52", "last_seen_utc": "2026-04-14 17:16:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790879": [ { "ioc_value": "wsh.sequareeus.online", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 17:14:51", "last_seen_utc": "2026-04-14 22:13:36", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790878": [ { "ioc_value": "https://wsh.sequareeus.online/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 17:14:48", "last_seen_utc": "2026-04-14 22:13:34", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "a10fsw,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790877": [ { "ioc_value": "gate6-site.kry8navel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:09:57", "last_seen_utc": "2026-04-14 17:11:48", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790876": [ { "ioc_value": "svc5-relay.kry8navel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 17:04:34", "last_seen_utc": "2026-04-14 17:06:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1790874": [ { "ioc_value": "bin4-swap.kry8navel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:59:00", "last_seen_utc": "2026-04-14 17:00:43", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790872": [ { "ioc_value": "node3-read.kry8navel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:53:01", "last_seen_utc": "2026-04-14 16:55:20", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790871": [ { "ioc_value": "api2-port.kry8navel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:47:41", "last_seen_utc": "2026-04-14 16:50:00", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790870": [ { "ioc_value": "mon1-audit.kry8navel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:41:47", "last_seen_utc": "2026-04-14 16:47:50", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790869": [ { "ioc_value": "gate6-pipe.vex3litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:36:33", "last_seen_utc": "2026-04-14 16:38:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790868": [ { "ioc_value": "svc5-send.vex3litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:30:30", "last_seen_utc": "2026-04-14 16:32:58", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790867": [ { "ioc_value": "file4-path.vex3litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:25:04", "last_seen_utc": "2026-04-14 16:27:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1790866": [ { "ioc_value": "node3-unit.vex3litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:19:49", "last_seen_utc": "2026-04-14 16:21:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790865": [ { "ioc_value": "ctl.rapidphonebuyer.co.uk", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 16:16:46", "last_seen_utc": "2026-04-15 11:44:14", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "d0b0p,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790864": [ { "ioc_value": "https://ctl.rapidphonebuyer.co.uk/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 16:16:43", "last_seen_utc": "2026-04-15 11:44:11", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "d0b0p,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790863": [ { "ioc_value": "api2-info.vex3litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:13:55", "last_seen_utc": "2026-04-14 16:15:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790862": [ { "ioc_value": "net1-flow.vex3litor.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:08:42", "last_seen_utc": "2026-04-14 16:10:47", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790861": [ { "ioc_value": "pk.tweethost.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 16:05:00", "last_seen_utc": "2026-04-16 11:10:49", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "o0_1,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790860": [ { "ioc_value": "https://pk.tweethost.com/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 16:04:57", "last_seen_utc": "2026-04-16 11:10:45", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "o0_1,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790859": [ { "ioc_value": "lts.cloudvaly.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 16:03:14", "last_seen_utc": "2026-04-16 11:12:20", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "ho0r1,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790858": [ { "ioc_value": "gate6-root.tul7moran.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 16:03:13", "last_seen_utc": "2026-04-14 16:07:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790857": [ { "ioc_value": "https://lts.cloudvaly.com/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 16:03:10", "last_seen_utc": "2026-04-16 11:12:17", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "ho0r1,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790856": [ { "ioc_value": "svc5-site.tul7moran.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:56:50", "last_seen_utc": "2026-04-14 15:58:39", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790855": [ { "ioc_value": "blob4-host.tul7moran.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:51:41", "last_seen_utc": "2026-04-14 15:53:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790854": [ { "ioc_value": "node3-core.tul7moran.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:45:56", "last_seen_utc": "2026-04-14 15:47:54", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790850": [ { "ioc_value": "api2-call.tul7moran.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:40:30", "last_seen_utc": "2026-04-14 15:42:25", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790849": [ { "ioc_value": "lb1-state.tul7moran.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:34:49", "last_seen_utc": "2026-04-14 15:36:46", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1790848": [ { "ioc_value": "gate6-main.qen4varix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:29:00", "last_seen_utc": "2026-04-14 15:31:42", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790847": [ { "ioc_value": "svc5-step.qen4varix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:23:27", "last_seen_utc": "2026-04-14 15:28:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790846": [ { "ioc_value": "disk4-data.qen4varix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:17:59", "last_seen_utc": "2026-04-14 15:19:07", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790845": [ { "ioc_value": "node3-peer.qen4varix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:12:18", "last_seen_utc": "2026-04-14 15:12:32", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1790844": [ { "ioc_value": "system.latitudeprevalent.cfd", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.acr_stealer", "malware_alias": null, "malware_printable": "ACR Stealer", "first_seen_utc": "2026-04-14 15:06:52", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/9d33d30438c80adf72eed6bef7b2868a2ad651ec642fa97bf7f637a97c331aaa/", "tags": "ACRStealer", "anonymous": "0", "reporter": "abuse_ch" } ], "1790843": [ { "ioc_value": "api2-dns.qen4varix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:06:35", "last_seen_utc": "2026-04-14 15:08:25", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1790842": [ { "ioc_value": "atlas.navalforest.store", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 15:05:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "kdozia,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790841": [ { "ioc_value": "http://atlas.navalforest.store", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 15:05:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "kdozia,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790840": [ { "ioc_value": "cdn1-fast.qen4varix.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 15:01:06", "last_seen_utc": "2026-04-14 15:02:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790839": [ { "ioc_value": "gate6-post.zor5liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 14:56:03", "last_seen_utc": "2026-04-14 14:56:52", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790828": [ { "ioc_value": "0e723233c9ad0a9b0fd7f27622bdf53704a0a2a22b5f86bda8ac2a6a289e2f98", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790829": [ { "ioc_value": "636c33acef02ce821e506200d9051350b56ad63c18683cf389e2e9aba7ae912d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790830": [ { "ioc_value": "a00de33c41dfa9ad1a98f7e6957e5d52e0007b8c96e5578ed10e4c10eaadf103", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790831": [ { "ioc_value": "bb0a7d4f95e19a2987acb542afd07ba2864c375a902c8d95f8260ced76adffb6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790832": [ { "ioc_value": "4287d85a6ca50252a0c322be451f76336c4e925136d210548a4f669e0c01a420", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790833": [ { "ioc_value": "e6d5f59d5ece1a7615e96961264bcd62cf95960725ea0c9674bd15f57beb2128", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790834": [ { "ioc_value": "44e8b37c229499f6ba7ac6a9584f4ec1fcb806236a55eb168fe1ab326d0da50a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790835": [ { "ioc_value": "d1020d62fc78a0788873d31b905fbfd037f58a1f9b538999c7212fe34c7019f2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790836": [ { "ioc_value": "91e13cb1ca412c32bb26c07ff822dc77218b576c585df63bf7f866779edabd3d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790837": [ { "ioc_value": "f6f9bdf93cda1f2ced89a6bd183a7c6fbf753de1a5d91a861ed11b38fd9950a8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790838": [ { "ioc_value": "4777c8fd9d900b1ebdbb77360a66bd34f0ca67fd087253e813b72325f1c842fe", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790810": [ { "ioc_value": "630d9dddcf2cc5c18f17de8ac99fd44622e76e18f4a17385157c08213db7ef5e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790811": [ { "ioc_value": "662b5c83e83e399186a8cc04446d295643b95c40e37a5bc5a39f84158f626d63", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790812": [ { "ioc_value": "f042f4e9b1b9f44902d92e1f3460905c3e9457ec64ed72eff011f00b494ec04c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790813": [ { "ioc_value": "1b7d5568856cb4d24770d1d1c5d45e522063b0218f8af763891551df06037dd9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790814": [ { "ioc_value": "d0cb7740ffabf3a2a43b94b337e6b124ac95a1d4131673a0f50ed133d2739262", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790815": [ { "ioc_value": "72a583db13387623b345998bfb8edd4bb5a2fea06001fc3a9e677843a8a5e993", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790816": [ { "ioc_value": "7a326252bacc0fd06ca168c8f89389f6bd89058385e6b07d7cd9676612bd93cd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790817": [ { "ioc_value": "265bfa951002bb3a761d275841c1ae0b4381739db014bbc33c6d4dbd858b6861", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790818": [ { "ioc_value": "b49c6e3d3aec8f9f5e5f32ca8a82f31d26fd8a5120043c632c4fef606a606a73", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790819": [ { "ioc_value": "679ff53fa8eba6f4f036c72f7d4d91ed2ef039a9db1adae39a824488f6a9f623", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790820": [ { "ioc_value": "3abd4e032706064d3eb32b96ea852cff29b907b5f0b9b0a41b043f935900cbac", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790821": [ { "ioc_value": "787c74bc3747161b09a2a36ad3e5006e64cfc70ff57325b66cc63493b0b8a7e6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790822": [ { "ioc_value": "011318826723959e3a7d389119404c4dd9ea731708fe36236c49bd8660ba3499", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790823": [ { "ioc_value": "66d27d414c7a6623d4afc06dcd3068d3054082d38e0f1ecba44b7275c0ac5f1a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790824": [ { "ioc_value": "9aba27c850f38021710e78b701bb3f0730313fa0fe0b5e382af7e64e57088946", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790825": [ { "ioc_value": "62ec6272bf20bf401288f11aabb125974a73e75e13d033b2146135e2cd4c88c1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790826": [ { "ioc_value": "58d437f63b18bac689563e4140820cc1d14882fa5dcfbce2fe24fa80e18b90e1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790827": [ { "ioc_value": "f474f014be364142b49e49e9157ae35f1a8b0931e82499ca87a1896ef089e473", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790793": [ { "ioc_value": "eb1fc7227f96efd9c4e0156b5494fbbe674175087b1cc425502fd72d04329300", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790794": [ { "ioc_value": "1e9c9da45b513d099fe3e8dcc1a0ff08a916fb949a8c46c2a59e35fca7359184", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790795": [ { "ioc_value": "585b2e63ed9c29fa5fa9ca927f0d292f56a253fd9d28601b8934d297b876526a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790796": [ { "ioc_value": "7e18c67707bb428b51b4eeebb69d0d9570b7057f6e1d10a811efeb4d98e8e9b2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790797": [ { "ioc_value": "602cc31ffc3332b47378c1157df1c4f514c2340de1052b8ad2da876522889a8d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790798": [ { "ioc_value": "77ac17d879391aac03443542420bcd3fee8ac653b7e8f6091dc8cddba3776510", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790799": [ { "ioc_value": "7b9210d36a17d17eebf268a6a3ed306f546e4c0bb8b5cd8007064f87cffaaa44", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790800": [ { "ioc_value": "47fbd33b88e7bc044eb217134cfb94a998082c94f7952b8a08e89c43a0a6fe22", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790801": [ { "ioc_value": "d81be1cf34326ef572ba21c10a40e057beb13e8088f38076c51163c113ca3ddc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790802": [ { "ioc_value": "ca73c7945c4d3321129492929de3f23fea894193cc42fcc2938585e5a980150c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790803": [ { "ioc_value": "9cd9e630d1113f57e6f0dcc6164bac77282e172b8f69a289008a7a5065e8331c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790804": [ { "ioc_value": "fb615bb66ec1ed62aba557dea4cf92d221799b8fa3e4af8872f61e1e0500924e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790805": [ { "ioc_value": "0db4ff50455ceda71dc43f44b5eb73ea639b7acf7a5bd6a745aa31db44a70fac", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790806": [ { "ioc_value": "372c52eb6af2a53f5ab8305cb0f4462f3982b0b13206723bf409e1b80b45fbbd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790807": [ { "ioc_value": "eebbdf9aa8c356e9a5567d56a73a1dde5ecdf0252b30ede01d217759da7f67bc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790808": [ { "ioc_value": "363c07367d4426c1844d9bfcb07f0bcc9667e4fbc96f0e583ecf12938e1bcf74", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790809": [ { "ioc_value": "48356f4abadce11f1e9e118d3564e1038794fe3321f250395dd15297dc328299", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790782": [ { "ioc_value": "b624cb5dcca78d09c0c5770d58ab05a9da8cd2a365cae2c5fa13dc5a4e7084fc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790783": [ { "ioc_value": "d32de66e0a038228b48c9d5748338c93b37e1cc1766d7e709a667896be85de27", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790784": [ { "ioc_value": "d91ca97202f21a7a4999986010178cd78007c8d59f41ea57847570565e5570b8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790785": [ { "ioc_value": "7b796cc394178db86cfe9c5ea249fcf2bfd5371a7ec1f65d69f6ea3ccb12a17b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790786": [ { "ioc_value": "2de4e7c1961e07f88b76aa950c9944a0c86e23b81a02222b80a0a73e9206f93a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790787": [ { "ioc_value": "bfb94d73b3795d1df8b19b6932e89eff83bea931461ebdf1c99723203caa2490", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790788": [ { "ioc_value": "341fdbaf82f7c48497c6c2e9e370dc75eeab4dccfc963dc693b0965e86886289", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790789": [ { "ioc_value": "5d4bedac71c38a2a90a32d1a40afd4d204c71da0cf9206a2aa767ecca37255f9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790790": [ { "ioc_value": "28841801683af0258ff7283261dcbc41cca2af163c730db9057f5e9b947e5fec", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790791": [ { "ioc_value": "155da40d99790b973c85db891b0860e89979ae241637db97148f90c2b33d8cc7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790792": [ { "ioc_value": "d90f96aa27e90b9884d37ae452272e08a1e65405dd216ca000edbd3541381641", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790764": [ { "ioc_value": "3ec9db4904d06d1a93bacc929b3cc954c6e45ac2bfe96e6a53be7d091294e86e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790765": [ { "ioc_value": "a1dda51dd47f4557cb204913aff01cc19f580946cdee0468f34ebda8f232bb02", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790766": [ { "ioc_value": "b44c75461a7efbc1ee593fc8ef1e9e198a2f697cd313cf4e1cdc59df00debfdb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790767": [ { "ioc_value": "487c3402a8763796f6516871e0eca8d24a245cede859387eebf1df1c235455a5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790768": [ { "ioc_value": "a1c9618c90cf25566cb3cb16fdc5ca8d189934287f109b883bd07d643717ee78", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790769": [ { "ioc_value": "afbbd8692dd1dd4d6aeff40675c5811d6790e8b27b32dbb5ef9ae4b0b3cc649f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790770": [ { "ioc_value": "5c656138aae2a37f73a76f95f4c7dc8e9ac73ded751e5fe5489c4044163cda38", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790771": [ { "ioc_value": "bb736e80512b58c13154d3576bca3d4b65dbe022564e63a611e6aa61fa36aabc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790772": [ { "ioc_value": "6c9df68fa1643296bd865e027de57aec08d4416c4ebd848d9e72c2a55c1ac123", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790773": [ { "ioc_value": "8f23caa5eaf2a198729951da86198a11e144cb64adcd808f41971396ebf8e59a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790774": [ { "ioc_value": "d6b8e6401b503ece672fa29134289cd32b6bf779a0910ba7d4550800a2ff66df", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790775": [ { "ioc_value": "9eaf0d8774109fe97daa13b6594d2118eac541ef94f5bda99dbef4b747f481ce", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790776": [ { "ioc_value": "995e4a4fe5a343fc2a28df7e8652b59d66490e5e309def58141c1612feb7102c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790777": [ { "ioc_value": "c505405153bf214ee43c642bc15c0cc7c0ca291e0e2fe855458c6360f19d9c60", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790778": [ { "ioc_value": "d28dd6e05e6a1379389a67efb2ed150b1f26a7ff9b244104950c6385c005d8a9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790779": [ { "ioc_value": "16dbd031962bfd17049a9c9eb3613a6618d223dc38cb29dce1b3e1d671f8797b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790780": [ { "ioc_value": "5a300e2a483411cecc0a51b097acfdb9c19fe62077671f6b17af346713702fc6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790781": [ { "ioc_value": "43b13b0bc26a48550955dfde2f9f59c9518b6cc485c9cd181edade9e42f1cc24", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:53:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790745": [ { "ioc_value": "954c14a100eef6d9a12dc8fdf837de456fd93898a415ea6d77d0acbbec0d2089", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790746": [ { "ioc_value": "fccd5ef5b3fe6c06d9c7c43d9ce8b7eee1b63232f613a9d45803630affa71753", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790747": [ { "ioc_value": "44e5e47010fc0d308c4c77a77845e9672a4b24b14bff708003f76897b9606033", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790748": [ { "ioc_value": "bf2791591fe09c8ae1512dc325745618d50da6d285e3656c02bdc9e1df1b243f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790749": [ { "ioc_value": "18f2c692aad43141ee6c11597f9c924c5e19b575c9a7f06f2f249e1d93073876", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790750": [ { "ioc_value": "ef2e94ac7f7c70548068b99c3dc93a6c43f8d09b708936f16250eadf7ecd1287", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790751": [ { "ioc_value": "6b55985441b7d4d3fb7fda450b640184fc9e3d78b9da89f462e2579ebc1075e8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790752": [ { "ioc_value": "26a9d0573ac93fa505b2155909e0ccab11845eb128f33ddb83f1db8a49d8673a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790753": [ { "ioc_value": "479c6769092b99678f1eb6c0a4225ba1aff4606a3f6104b2eccb76de03eabd0f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790754": [ { "ioc_value": "359f9ca568b7525fa41e8ce63450ef4fe1f5c4ba5a334d1473ef93867b21f8a5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790755": [ { "ioc_value": "bdba3fc6a723d0f5d5ee2afa41f1fd9166b9e43488251aab882f430e0385fb0f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790756": [ { "ioc_value": "ea8a437b3231ed5f279a715da799cf32f5fe0e11d9854cdf49105a7716999b58", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790757": [ { "ioc_value": "3f202641b8d9af497bac377bb4153d046667161d79f0851804b45aa2eeb9d8e0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790758": [ { "ioc_value": "b4e0932942830dcb694b548a4cabcc68c705903269426bb15d412bc874613250", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790759": [ { "ioc_value": "77031374cdea17f98c90834b0503774382fb6766d2df310cd7d26a50c8143a80", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790760": [ { "ioc_value": "ac581233900f3de15ad6ea475a5085d29d972fb5700800052ca8b8e42014b1d5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790761": [ { "ioc_value": "bf226333b5b32eca85694f3495427137404fdae78a6cc236398c82a52b18b0f9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790762": [ { "ioc_value": "cc30a0f10e9672ffd26b3788b25b3e1c7b8652443694c6d5060a8795b560ddc2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790763": [ { "ioc_value": "78bdf40e56a1f089965a24f2d852be4f9bc40322d4696f810f2c45309678ab42", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790728": [ { "ioc_value": "bcc28c42dd4accc6cf496d0eb53bd1cfa91e9cc2065c4f7510e269d2efce0629", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790729": [ { "ioc_value": "b6e2eec25b956401810c1b9b446ae126469b75609f62d2ab416501ea573a501a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790730": [ { "ioc_value": "b9d458c95a3edc681a54ace465ba89343d1670dd1d36cddbde9b4bf8aef5f7d1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790731": [ { "ioc_value": "1137bd2c5dfb99e27f82c1094dd7e9daefc77d97f0c12c69c8fb479807117139", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790732": [ { "ioc_value": "fccb7b55008744e3d2a574997c442f3163bade352fe176a44991fc21134871d3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790733": [ { "ioc_value": "4bdb6d4eb97e7033e5924174b2d1f033a966d30a0bb3463f7a53fc1f2d11c9d4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790734": [ { "ioc_value": "9cbbba4d63338aa7c3c3e4c483afab2eb04478c9e13487651971d0da4d01f854", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790735": [ { "ioc_value": "336f3f519931e020b6d3414a8fb9f03847ea1340e94be7491bda0e22a4655cca", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790736": [ { "ioc_value": "1df60c5601bd66e532a0faf052cb6d7a63494becf3de5142e81f8eea54d335e3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790737": [ { "ioc_value": "ee78ed25c624f491e7e4b8534bd1a0f575fe5d5782c8be1930118786e4f3cb7e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790738": [ { "ioc_value": "1c7657ec81699fb63358ca655a72523b791b4fe6efb6f4f16775038bcf279a87", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790739": [ { "ioc_value": "d57b217240986bb99b4fafd26f7eb15bb89b987d14ecd2badb123d9151bd9c3c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790740": [ { "ioc_value": "231609e9629428125d6aec61ba86bad72703fdc23b42e0632fe53c748dbc627b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790741": [ { "ioc_value": "09766dfde5ab5ce88b6d796b499d37f08f19c0f991a72a44bedc88e6bb85936c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790742": [ { "ioc_value": "257282972a749285e5e6e71581d672cff3c04f1e08663765650ea243686cba2f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790743": [ { "ioc_value": "86aaf672fd909f0ce6a331261613d0c0eef02c0902f3c9f6cc4acc2724718e1c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790744": [ { "ioc_value": "cbac574e6ea8e4fda1d860d94fdf2e4ecc81685eae650b82d7a264fe3e8cc013", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790709": [ { "ioc_value": "bf614c956924d2dace39b9cd350b117f328ae82977e1632c538049366ac783ce", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790710": [ { "ioc_value": "618171c2a93cc9df42ad9f3b9d9cb4615089875f5fca511462b6503ac7bf2e38", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790711": [ { "ioc_value": "308dd05e8f58c874ebb111efe56bec7d9500d11d49efd78b472aa61b6ae2ce15", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790712": [ { "ioc_value": "e72fde909ba5d3cb6f7e05eb8303bd19a74d105268cc99291c502373141ac70e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790713": [ { "ioc_value": "1d6b57e8a845d4b1f6decc9f40948955f05f0b5df5213883f59b6f8ff84bcd1a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790714": [ { "ioc_value": "2397fe9ed227ac1af89c9484218073431c9408246631c2eb39660267f4823241", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790715": [ { "ioc_value": "7ff07934f64284104cb2ece18186cdbab34b71ff19c8f3e1a2db4da6c336c25c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790716": [ { "ioc_value": "3348cd2ce67cfa4ac76f86c322e4a68efff1e65d123a5ec2511a09a54da414f5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790717": [ { "ioc_value": "8d96f2e378a9dc692a13f6854776e35d02d6edb1b5ac2b7e243b88258eb2e8b8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790718": [ { "ioc_value": "78ef657b8c8315bacfe0f0d7900a5cd03b4f42c7984980ac506157639a556d2a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790719": [ { "ioc_value": "f6e2f8d8713888cd6173df6d04e211de6aa957ae918e72f962d275228ac1be36", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790720": [ { "ioc_value": "73f83901114f4da36247db5558086bf8c19d08f13163b3fdba85c3e28781b412", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790721": [ { "ioc_value": "bed21fa8721288707092739ce3167ae6afc01623e594c17179becf5cbee39020", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790722": [ { "ioc_value": "eee2f16dd3e316ac6e7c78faff0b7177cab2fc13e6f6e69e74d23f4c85a16d91", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790723": [ { "ioc_value": "8bb09b3bc96b91439b148087ebfadb0ab17f0e598519786e35f70b9aa822bb74", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790724": [ { "ioc_value": "91b35dcd63c6e7c20fe2f114c40be05ba72051e201f04a118d7ecb3852e6d872", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790725": [ { "ioc_value": "414186225c89d27e648859f7c7cf34d0771a800cb04bd7289e0454e3bd687673", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790726": [ { "ioc_value": "aa5caa9e42deb4f0bd32898755f1f7f8fde2f1809e7caa0aa7bfbd1c17883367", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790727": [ { "ioc_value": "8ea56f4825eb026329ef1a3642bcea00c1492e238b13b68a4cf710a081aa1861", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790691": [ { "ioc_value": "8fc6c8214beb02bd883c1b96245c7bce308a73f686354f7b590571743ef4fc13", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790692": [ { "ioc_value": "31e03f8e181d051f2eda14bf72f3442b3ec4565626cf2ee8727ddc2e536f639f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790693": [ { "ioc_value": "850b6487840c85506895a593c568d5e96bb5e0326bef8917a92ee75f4489f89e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790694": [ { "ioc_value": "c3146e047c8d15aa1e781a926bef1ea2a6acf516c1e88991dd0cb48ed429ae73", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790695": [ { "ioc_value": "497e64ab1dbab73d7e6a730858c2fd61bff18185cf29f7b3b841ff3d78b77863", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790696": [ { "ioc_value": "a25585727761c0263f4f7ea08867e5c3de188eca4a35f9e7a23d8a0211e67392", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790697": [ { "ioc_value": "e2297e29934d70e7e82b91d1bf0212f596268f4ffa102a78c64734d5a3f70b5f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790698": [ { "ioc_value": "60f581310c213ce29268e411ac1ce9e6f0341cfdc8cabc4c11baab09cc16a58e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790699": [ { "ioc_value": "ac26e3e805b4441046d5bbf57c3a894ea1ccdaa842980ee4ec92a3190bee6970", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790700": [ { "ioc_value": "34bd4c89af94394fbbc9125c5a08e97838d16b16abd7a5859064a8eee40f0f64", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790701": [ { "ioc_value": "3ed319ec2e1a98bf6a8cf9f329514eb36f290344fe07add4a81432193f0e36af", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790702": [ { "ioc_value": "2f8529f2953971b8f9f8e9dad4b71271819d527f83afba40f59ab8865a564ce1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790703": [ { "ioc_value": "a73994ca59abf595b0b1162d3b2513bf036b092b93450c4a2bc2ae192b50526d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790704": [ { "ioc_value": "26347a1d8958f98e1f58a0c1ae7eaf3908234de519fc02ca00d4616ef7f48b28", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790705": [ { "ioc_value": "ab79c8510eee55b4ffd74bc8507408e4aa19fe12f0a71a47902b4aabbd0f7b53", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790706": [ { "ioc_value": "0b804b6c84e142d31333467fa6e8672f9715159ab639ad40c8109925636008bd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790707": [ { "ioc_value": "4a31aa13fb8e2483bdcb5f9ad077e4f5f65c19539fab3deb6d924d0c608bd61f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790708": [ { "ioc_value": "a78419397b5b2d84f2bcbe4923b7c0696ad2cc3cb9b4feaf87d02dda75d9b015", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790672": [ { "ioc_value": "416954ed4515214b883c239a96e95f7dddc5e0f2ae9aac587f30572c6857f693", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790673": [ { "ioc_value": "1be32d85b3561498cc3a95978f8783cea2c64dd181e7587a4b8e51cfb04cf8cc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790674": [ { "ioc_value": "19d4a6a11fee96f3c9e4a1b00d9b71782e744114e718c14cd91c784c7fd0cd89", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790675": [ { "ioc_value": "12b277490d25cb47a9400832739dcbdcd2f3ac5e08353c969c35a464bf676c73", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790676": [ { "ioc_value": "9ce6f519604b422c69ee2589021427f214eadfe7c19c1ab0276636d2cb140727", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790677": [ { "ioc_value": "e24b4952a9421a13d7c94f280bd03f8683e22da39af8012505f71efc93941f88", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790678": [ { "ioc_value": "296f95b5a848e7d90638bef2a4b2ade7721b203a25030e094daa8dfe3f8aa5ab", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790679": [ { "ioc_value": "7d231db440b4b613bd22c3abdd131470cafab57ddbd20adff7fa5396f7540e3d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790680": [ { "ioc_value": "ef7b52cf780d99b4eafefae0bcb2a85563f7f6511c2b853fadaacd3991562207", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790681": [ { "ioc_value": "b248afa121daa31462df813c4d72ad3931db75a5f92b47ae39263e191d7fd77f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790682": [ { "ioc_value": "2940e8ed93864419ebee40e1d3f887536e9f697279c789fd2add4106cea8b956", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790683": [ { "ioc_value": "7a10d6aaf2cdcf5ff803e59c92ffa70925191b6fd0d1ab92f574df62fdad7ce9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790684": [ { "ioc_value": "2670b5c883b696d322b7ae236330d74b4ecc2508d00abc6cd8acba65c131c727", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790685": [ { "ioc_value": "74cf3c71ac594da6d1d70b6a80287cecddc09b7048c1d42b55a000e4e34b654d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790686": [ { "ioc_value": "257373f15f5f9d1b590d8d39ad197af3052326553bef9a4ffa02beba86423e97", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790687": [ { "ioc_value": "08cd02ced5a523b9c35b5274d916f68c8fef076a780bac5ecde03e13083f0ce7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790688": [ { "ioc_value": "4157560b6de83029d2e125f7050c951e53a7495d0b8c89fb5b09820b225c06ea", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790689": [ { "ioc_value": "659d23714f98e249a39e523cb7b0be8ef74257b9cf631ee10247aa327021dfac", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790690": [ { "ioc_value": "43aca0edff8150b327884167b6cd7934b515bfdc420bdeb789cf427eb0ce3c45", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790653": [ { "ioc_value": "956ca6ee42a69d74eea979206bc519792704d809faac56bde61157dd3fb3de49", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790654": [ { "ioc_value": "c097c301aae3f44f6352aad3e9980f3d1489774da73d087e776ae9ac2dbe4721", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790655": [ { "ioc_value": "de4f797a3ada0bd9a054fbee7f946730870394d915902ba8a8f1ae83bbc321a2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790656": [ { "ioc_value": "ffcec2604e326d44e16105107a9a50d129e6a96c7184cad461d65ded56aa4dae", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790657": [ { "ioc_value": "c9c2182a7ddd496cee2de6abc06ad2eb78460ac1e3c3e886a9a267d9537c13a8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790658": [ { "ioc_value": "a710f925cb62487fb73ed1a3a4c17ff775ff91db40eb1a6d1e695845d3f92daf", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790659": [ { "ioc_value": "a9db9d5f68cc806cb77f7d9c62384288789c6d4c2819cac3491f00ed80067b00", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790660": [ { "ioc_value": "65b8518561053d06a946a2b54b17b9144e30a3b1327dfa1e4c627fca3e8344ce", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790661": [ { "ioc_value": "4cd1a31a50733cef18e9e2f00e81c0288657f46a9dd0e1bf857e099239e5e2db", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790662": [ { "ioc_value": "724a709a132441370c3907ee88ee471ffc649d9e6fe4214eeb7382ae95ed42a6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790663": [ { "ioc_value": "b843c78c712892725a29d15d7c11ac5a553e30ba3234a9e8f81a69a20429aab5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790664": [ { "ioc_value": "407f27dabb3390d43b319f5c2a9fdbbcd275170ddefffb952c770f9657cc586d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790665": [ { "ioc_value": "e398932f5e4d2c436ae7b22556afd78d2375dc26cbc7359a526d8cc9360a0f69", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790666": [ { "ioc_value": "5ff5e7ecc2ee789b01ecff018757094086f64f4d39faff27b0c1b691117b3cad", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790667": [ { "ioc_value": "eac709c6a8d18327c58418b2999210edb1e21f072e1e24560904874f73724616", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790668": [ { "ioc_value": "9dd3268772aef06796532bf9418b6612e0b4a663ea4cf3a14e581e6d436874b6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790669": [ { "ioc_value": "52b44b13661414f3284d92ccebf08021446aad8c74feba49be71e511bc079a61", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790670": [ { "ioc_value": "611a838d4c732f7b65f66e4fa85dc4e1d4feb550be3ce2353cff9b6d6e936f9e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790671": [ { "ioc_value": "23e35e817de083f00d570e029e5fe48543351e85c674db5e5684d637df13624c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790633": [ { "ioc_value": "ed578e221ff75ed5138f307744bec6201ab72fa00b95576a693552c01db9b701", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790634": [ { "ioc_value": "9d8aee3fd134338d0d8aedd7ebc6832120844a205b9c295b9a22adb292c103d3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790635": [ { "ioc_value": "801e89cdb0b18ad755d024b057c77d1e2d7317624ca1096e3b30650fefb251db", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790636": [ { "ioc_value": "8f448c0666574dae644e52a480031d6e644248640081bd2b7392d64e61a7d2b9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790637": [ { "ioc_value": "acdfc551fa2d138b0190284264d00bb3d76a3571661e2d97ea2dbb9e61d85ecc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790638": [ { "ioc_value": "9659677d867dfd521414f05f3c5c6a18991541b6387b949e00f2f4f376012aa0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790639": [ { "ioc_value": "366d978cba362a2a6e8473fb8c9d20eabec172f5b5a57b9e65004d7a6812da45", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790640": [ { "ioc_value": "c3acbbd908792a7f80c12e0b0e2c1e08bf929e05c16e77a8e4a03226ea88db92", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790641": [ { "ioc_value": "8e66f76c68af7f549fce3b4310e0dc711b15114ad5e3961c89de0136cfe81d59", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790642": [ { "ioc_value": "d607b4a42877a1d5acc33f254e1f571a8b1a3acab4c5ee40e71e478498ad9c9e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790643": [ { "ioc_value": "75e16b81a60b20a58e3e8cca4e6b8428187daf36f5e3d0e906ae0529be4869ab", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790644": [ { "ioc_value": "6aef734e88911ff7f1acc1799912be85e332d6f9197a213ba7952a777ec39eeb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790645": [ { "ioc_value": "91e600af27c930ba411fc155dfcac7c6bd70b784fdee44aab4b3b0f0d3c661f8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790646": [ { "ioc_value": "4c9344cb21df4df9830c303298760a7e96809aca999bc2bb2e8e36f269fa5499", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790647": [ { "ioc_value": "2d4c1ee989c428775eae9579613958fab864538ddef56d7f52f211738b8e78de", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790648": [ { "ioc_value": "c641ed87fececc0d69283e3b7ece6a45bf35e6a726517e3455edd633bb2d3cca", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790649": [ { "ioc_value": "d15234a5f9e233745ff3365408b472f22bbba42efcf75b6cae20ce5664e94e6b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790650": [ { "ioc_value": "6462827fa723e8139f15e4c6de637aefb58fb00040e680e870140ee035e4e974", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790651": [ { "ioc_value": "55a8338ad1a83ed66fe23ac156921eade6eed5f8d49fe0c1719ecb862cd66fd6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790652": [ { "ioc_value": "d82d5a7b872112dd5aaa4e341e7587557a2e5a86b31a875ef687b394071e5945", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790615": [ { "ioc_value": "41e308b2fc5456f4bc1615aab98db90553a015f88e790abc2416d41d45a0c633", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790616": [ { "ioc_value": "a48e674562e50e9ecd444afd232edca57bbe90511c048be601e706b80a5542ef", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790617": [ { "ioc_value": "15191047be2096f18d211a91f3accad98edc8279d78f2567894ea3a1f4c2806e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790618": [ { "ioc_value": "dfa9c7cebabd7c4d0678279bccb4514122cb600a19e6938c9f6b3fd9c56d8d39", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790619": [ { "ioc_value": "5eafc8c176e629139fae733ec4aa6f5bc8f4573696e11e3cbeca9eeefbcd7602", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790620": [ { "ioc_value": "d444926f9992c369549b2b496ee56106a86eb195283d1b756e649335ba64a996", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790621": [ { "ioc_value": "284ef665e9d2f91593bd7dac89a703d1a11b5aadf7604684ef3d461498798cd9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790622": [ { "ioc_value": "a51c0be246dfb3aaef8c3a829c1e9f53135e72d1e3f46a7b3cbbf4f3dbd3b224", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790623": [ { "ioc_value": "66382d685c9ed7ab21c3d40f9f9d0d74785709ba449da7b0dd935ef42924ff6b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790624": [ { "ioc_value": "d9fd4aa91028a0a729684735ca02402b9fb8fdf3ed5bfdc24d4c0babe7045826", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790625": [ { "ioc_value": "bbefdadeab53a211f3b36dfecc4029ba62a1dc179f9ebf01154cdae31868c1c0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790626": [ { "ioc_value": "a1e085e6035f3fbfc6857f20502f891da0b5df4c59a2ab762c833c65590f076e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790627": [ { "ioc_value": "128e9a83842405714288b8f5f74b0f4236cc9c62220332517bba35e4416cc9e0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790628": [ { "ioc_value": "622d92d8f567118e1f4b2e7f401bf84144554034232f22cd725d5f13d9dcee16", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790629": [ { "ioc_value": "ffc311faa60a3952e30c1e72997d8c58bd64b40ba5ebd710af68616b9e96ac7e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790630": [ { "ioc_value": "29a8a530f4836cd08aa1b9322fe7bdd8201044b50cc2ec1a34a9a3d446cb925d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790631": [ { "ioc_value": "fafee50f5dcad1a4722287169f44264f19c81a1a775e148415c513466a604607", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790632": [ { "ioc_value": "3630e3e09b3eb3c6f013abeeb220710993b64dae471feaae3c0ed0c4f5295617", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790596": [ { "ioc_value": "2e0d07e1453171ef8d370707d69fcee9b09c5a99649be10a95bfb632d59765c5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790597": [ { "ioc_value": "4d3b956e4f8fc44970ba484be40cfa7c523a626cfe4d8dbce601ca1975a5f93f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790598": [ { "ioc_value": "d8591480fc4356299f56b632e9e252e21c71a33166b0e3b14a225946b4c8fa08", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790599": [ { "ioc_value": "2796640deb62222ecb4642cc01399b813310c9d072560b5c0100dd53033d72cd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790600": [ { "ioc_value": "987e453f15b43e2a9f367139b9e35138bd45b32aa73ef86452e19f631b2608e3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790601": [ { "ioc_value": "b0a725b58fed9e8052ac814993360aedfcada6576cf163b1f1ab1e95a597877a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790602": [ { "ioc_value": "60945dad0c917f8948826e6abab08d43d3d8be2ed8dd5430ed388308f46c33e4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790603": [ { "ioc_value": "9ee1ce5589416a3ff00bc8a8766992e4a461d9c7cb55e3beceed61b03e920d6d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790604": [ { "ioc_value": "592f53dc44d7bf555168c5b08524b77f07c12bab1b58281a450b5e6554e8c21b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790605": [ { "ioc_value": "c83487a14b642f24935effbb229fdc1be8dd5f39e44bc52bec0bd1caa5b09444", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790606": [ { "ioc_value": "9832cbb9a8b74a1810577ad3274031affcf608a8be99cdb53d40d4d36ba2235f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790607": [ { "ioc_value": "39ac984110b366549bbf2892f4cce3ef6be23269ba3c16e668619057ec5f3838", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790608": [ { "ioc_value": "f6e0ba510c7aa4cea2f2cbd444993d6158fd0a948f2b8ef94042b96529089586", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790609": [ { "ioc_value": "8e9365039f62b406258597f488261760e1c561d4290c5f4b1577ef8356bcfd11", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790610": [ { "ioc_value": "c98def0754e87aaf8f066b2f5b8956457b124dc2f2511105f1a2da0a6342161d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790611": [ { "ioc_value": "742ecb5c28ede0ace4197ff66fc548d200b42d28345de9dd27cdb92b1cb26188", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790612": [ { "ioc_value": "e538337eda9a9fa2d71975d9b1cf78e102a4ea8ab303773baa9e0c5e89e24491", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790613": [ { "ioc_value": "eb852ee1f5f11420e5914b4f476be12b80b5427461ee9fb0260c1b97b3912437", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790614": [ { "ioc_value": "5f0cd0731c0e1a8c9b65e5c1357eaab8dc43c7e40ec8a6959181270383d634cb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790577": [ { "ioc_value": "2ac71b8131bdd962873205a3dc189448a534845e05e8f0843d2e42eb83c0995d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790578": [ { "ioc_value": "19a22f2df546a3726a4be2221887a84feae024877975d00474504a476916150b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790579": [ { "ioc_value": "3e2eae839b18f31fc99f762a4e552e183825a8d39e5f6e01a6095e895665efad", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790580": [ { "ioc_value": "ea91b118c7a13b1fe015ece8f216c7a4d15162139a9b49aa784ad856fb6ce529", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790581": [ { "ioc_value": "731f898853226cfc19744ce4fda47bbf3b742f364b4962ba3b235260bbefeb46", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790582": [ { "ioc_value": "b6cb56e920325007d1e0db42e28e1a2e5bf85883ed5c3d714fa190f912a914bf", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790583": [ { "ioc_value": "bc2d3be90753aee770f00820edd0548a570f030a26a67a3bc9dc65564f5da592", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790584": [ { "ioc_value": "2c4f2852edffb718bd01881a4045994b793a604b5c1af7edefc7bb815605cad0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790585": [ { "ioc_value": "fedd4c3ad5dd3f2c9fef0af60272bec7ffc3e22f6701af844f73ce1d78e187ac", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790586": [ { "ioc_value": "bc6cac67ebfdd24e5b6ffa8c48b45b123044da0ea4abc2ec9a88e9caa0dbc819", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790587": [ { "ioc_value": "102ecfc518870c8df7b818c623fa4702d101411f846ef77c7ffecb66e60eb606", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790588": [ { "ioc_value": "a7f3cdb5c6c0ad6005f6f41cddfa7b6b689b72bd655de9f6d54400a8d9fe1e72", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790589": [ { "ioc_value": "ca3593b2c04c413636222066f1998b543030aff47c709b51b74c7bfec3d0d49e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790590": [ { "ioc_value": "dd1d43e3c41e0e3f2ab131ef20f8c9bcb8cffaa657949772511cf464dd6de1d0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790591": [ { "ioc_value": "6a34ce311620fc6ff8479e7cd0d5620aa268dfab3bd2fdf07c26b722bbcafd7b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790592": [ { "ioc_value": "07f1101674bbc93f0a939522a632405683dbb82d4d7267009cf9333c998e2379", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790593": [ { "ioc_value": "b3ce92bddc023b1c0452d42197655b1753bb0fff6b17fd273229863e059d306a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790594": [ { "ioc_value": "66f526f014cf302dd61b4b77a23bbd93b3b3b178eee4ddf660ab3d228c0649b1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790595": [ { "ioc_value": "7096ec6c0de765caf80ab9fcd7554d9533956c4581ab5110c52c9f32576c71cc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790559": [ { "ioc_value": "78173e2f18469995ab801369420485c229fd27069d2c4b5992a5bff03d8a6758", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790560": [ { "ioc_value": "694b17a63fca94864c3946fd36b58b2904ba6c0622c446f415fc3c42f76b198a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790561": [ { "ioc_value": "0dc846553b982d61e5fd7fac0887c225de94a8fbcf844c0e70b1ecb8a59240e3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790562": [ { "ioc_value": "ca0bd67d840e9f48b5093730720fd1f545fb649688458a5632e3693d3cb6fcf3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790563": [ { "ioc_value": "433cf63214db6c94fdbd12f4c4170952000ff3194184ff9ea12ae28f7afcbb1a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790564": [ { "ioc_value": "22adee49e905bee22ee83663634542e13a687d4dd5d23be63264fe183f22319c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790565": [ { "ioc_value": "00edfb5468593cdaa25dab8a10f35654289206f80325228a44139bd144c2c65f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790566": [ { "ioc_value": "244017290d1490cf9ee97c7c5347e987f9cb17a2f60c15921ee6d080104c3440", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790567": [ { "ioc_value": "9ac24a73c61ab678966525ee09d8b88de134010634cadb9b2d89f641e6dcaebd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790568": [ { "ioc_value": "66689d14c15db420a7e0c3b17695441807db14b942d119f657333e70f734c483", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790569": [ { "ioc_value": "a7245f8617ba4c0783c3328b15c924c36e4acea789cd81979a75473ff8469f53", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790570": [ { "ioc_value": "bab55452b32b07b914a0831883db07902b3060f4bb4bcdc76ba6d001d4e771a5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790571": [ { "ioc_value": "4bc2c435ae4448d77175744003acc53d7293f5f502a683f4286cb4862aa2d651", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790572": [ { "ioc_value": "7ad8ca26065046435d5eb1affbcc2337c00d4c6a4202b3c103fca72e3feb3c01", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790573": [ { "ioc_value": "1b22f01e0fdb9a8d9c20197a3725c4bb74f8a80d0aac994d1f6703f5ce4e3ed6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790574": [ { "ioc_value": "0ded254547602bb00c0f3e66da673746aa88f91989b2c04bebca750f81dfbb81", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790575": [ { "ioc_value": "2c8271ff7ae819ab07dccd7c6c24b90d16e6f79886e96bce90fbf3d938565f7c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790576": [ { "ioc_value": "3f3121e8f949e8c8deaea98360b8b91f600f5fa9aa3658c7f89414c82bc84a76", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790541": [ { "ioc_value": "653706f0f5b4dc594b07fb97384c20a0fab052f1d846ea6ff4d1b6d7622106b3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790542": [ { "ioc_value": "fbe03055933401feae2a81d7ed3d68b74e7c72be4e59c6322a67dd30b2915918", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790543": [ { "ioc_value": "f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790544": [ { "ioc_value": "d8ab50511930fa735b3dd4e5a09664bfdd683620570b0869c33b2f09f154e916", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790545": [ { "ioc_value": "113bb103b3e3f071f55a187b53763963a7f358fd21041afafc88b3b59f7d41fd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790546": [ { "ioc_value": "76e70ee1e8174c41061c7722e95f3e8a0c05a35a2b5ac1743bbab8db9e404970", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790547": [ { "ioc_value": "0615e94534f5a975629f657b8e90402362976e353b614dab70b280c0e0596aa1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790548": [ { "ioc_value": "525e53c4c7f0dcef3e132a9ed12572ee6f67c447f5d9bfab6c360d5e618e6d60", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790549": [ { "ioc_value": "e93f2f5032b55a53a885b596226c8377f275656056a44d0bec9e91fb5ee91692", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790550": [ { "ioc_value": "e081f826045686b3e94c59b565459161d8a8ead1179a28646b4ae8e2daf422bb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790551": [ { "ioc_value": "d42e353aaf86e9e14438b456b16cb4d35f80e17727738ac1496f1b549c384797", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790552": [ { "ioc_value": "866f1737f131a7a71e230e72da83fc6aeefa8cf74c91bf959f5f92460fcc6553", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790553": [ { "ioc_value": "bb239589e0238cc2b840d08c428f3086342823775108c43e26eb6f2c0a107b8d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790554": [ { "ioc_value": "5fb7abc3fdc1c604a5c93bbe113a23d007e05b06b8694a5d30c2c5e206da60fa", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790555": [ { "ioc_value": "64e5738d890997314ea0fe8ae829dc6d9d9b9985119a1d2237115ac99e5550b8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790556": [ { "ioc_value": "49bdb5cf698b879d787ef83991bd8fe21bcd9c213184a5dfc827f4dbc9194733", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790557": [ { "ioc_value": "76245cca72124a0c45d5f83dd5f3ae7f07d99550d1e7ff43f898cafe6db75bee", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790558": [ { "ioc_value": "361f80280bf26dbe8805181d9fdc0fa249f330153968b3ed28cf54ed53c5cd5a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790539": [ { "ioc_value": "275ebea5125381d105804eda474197d5e5b3a2ef2dffc9ea3dc76ab66b7580ba", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790540": [ { "ioc_value": "cd74fbc4cc6d97fd020c10f451253a10685601b2c2303a99f89a010f56f69888", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:52:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790538": [ { "ioc_value": "svc5-rule.zor5liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 14:49:52", "last_seen_utc": "2026-04-14 14:51:21", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1790537": [ { "ioc_value": "vault4-key.zor5liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 14:44:13", "last_seen_utc": "2026-04-14 14:45:45", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790535": [ { "ioc_value": "3aad0fb62efdca4599d98b58f5f497b80f71fb6aaa0cb9eb9f521a0e4b15f7df", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790536": [ { "ioc_value": "70c4529ae5621d6e6eaafc642c76b8d59e6fa9c5d9dfa8d3fab60c2fc9c2c66b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790514": [ { "ioc_value": "36bd7e1abfe59b5ca7d8740655b734c4b537db0469ce2ef8bb048984948edbc2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790515": [ { "ioc_value": "c303f6c8728a7b80bfb88f50bfb5f9dcc0040447dfdead9d1b5c011bf8149bcd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790516": [ { "ioc_value": "e713b0a5748a7b8332121f638462b2f5cef38a61f2b5ce0a7cd2c90922265397", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790517": [ { "ioc_value": "3e2d6e33c493206365d20e3d494a4363a79b438c543a5e57e1e72842b3240f96", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790518": [ { "ioc_value": "3144f966ff63c1fbdf2143524b3944586650dc34a06d7a5356777d94b7b18ab9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790519": [ { "ioc_value": "bc0537a76eb2d88ea3d7a16560ec75d1c15d6a5408106d2e0e739db99477004d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790520": [ { "ioc_value": "e94406e57743e01ffebcdb632930455811c1be584b235a2db24097e095eb3775", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790521": [ { "ioc_value": "ccf169aa46eded35dfb01e44ef5ca87ae7a505af98be5e121f20077b835e24f1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790522": [ { "ioc_value": "01c40fb0878da9f05e79436285fcdb3b065f0700944c6357e595966c7c85322f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790523": [ { "ioc_value": "767e8a842259f0d138c20f58403719a18b70e46361b490a752c75f0a99d8b1db", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790524": [ { "ioc_value": "1ef8b6632e877e6a30e9325a245b8191fc3ede126b233234ff93bbee04e3cbaa", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790525": [ { "ioc_value": "cba075478aecdf6512d88b05f2deba168bcbab704ae32886993c7a20a15f509b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790526": [ { "ioc_value": "37d4849eca4c949ae02781074e0256c1c3493bc684d73edb1e1de1c82900fcf8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790527": [ { "ioc_value": "dee0011d95efc81761e6b9e2f685d3d5e0214e85ff2a05c6792565737efb4ecb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790528": [ { "ioc_value": "a3c4b5591d8d691db8a911abd6677a87d17b044c523f041e58e4024bdad834eb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790529": [ { "ioc_value": "ec941a8eb7ad2340a8d93299912fba17ebfbb6d88c850434b6d49f43564dfbf1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790530": [ { "ioc_value": "e09fb72e8008b4e79c95930a71009a036158a439d81b66f262243712b9546ca1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790531": [ { "ioc_value": "9b7db832bd3724c4589e5999bba036e2dbdc9aa4644ffbab36defa534d3c00df", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790532": [ { "ioc_value": "a9674d6ee1ee80b2cf7ef8dcba5e38fce8a0d97c4cbb71da6e9d48285f30f5b6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790533": [ { "ioc_value": "d25a55c0267dbda1c0318f2ea96563dd50ea638ba72d73e3f0d74d426cea0d71", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790534": [ { "ioc_value": "ff14c6669032552b6f8f8a584d7704cecd1f7b3dad462399f89ce2cb814ac43b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790494": [ { "ioc_value": "98cea96671bf86986dceed4226190d387f6e55e74fa71b30b6fc16cba8a9955c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790495": [ { "ioc_value": "b72536301ba0b8834cc027b2c9d0bfa887d91c832e04802f96d81778a4c38766", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790496": [ { "ioc_value": "ffd9b899877617db55d5431be243cd7d3281f514f1ab9a9a970291d6feee4eef", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790497": [ { "ioc_value": "78c73db492ddbf09ac6b398b09bad1e7c5c3f6a8db9ba0ea28e3a88d8a829692", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790498": [ { "ioc_value": "8c6b033a3afeef0a0479603b9e6788c060c68ed8571ebc098aa072a4c9889c44", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790499": [ { "ioc_value": "c39a55e6816350483e0f488fd819d1372a5f41dd7344e9efe52f33b3e6ea5e1e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790500": [ { "ioc_value": "af85d0c47243bb0d6663892b72cd701316b0bcdd986a3286de229a13faac8402", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790501": [ { "ioc_value": "05ff054e92f76d5da78a553f4d511055754aae33ba9dac7e006043480cd0ddef", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790502": [ { "ioc_value": "e59d4245d8450d61b49138d7919ca8284ab12f03ca5fbd1597d3a4af55b902cf", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790503": [ { "ioc_value": "44228cbe3a454c23f3e9b80e8f45a70b77fca1fefcd7e577a2457a6f03c034c1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790504": [ { "ioc_value": "a387914b50b46126e448d20e152cd09b7d26130b6ee49a0abbde533180548bc1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790505": [ { "ioc_value": "e4a1b9af880cb6bc9387b3598a43ce68428767dc99cf1c7d719a02c9f83adbe8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790506": [ { "ioc_value": "18fc7705750da542237bd0a53e04b4be61709145dd6e9cd952647c5541cb5249", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790507": [ { "ioc_value": "decfe219e566cae5ccbe2657b1d8965f4e5636602e51053fefde5e7263cd5aca", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790508": [ { "ioc_value": "d74ca209602b826a31b465db561ac9b4f457786ed2c67d6fbd3ab496c35079d9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790509": [ { "ioc_value": "adb7edf3a5881a2d1014f62b56e9fabf62fd818165392b07307b71e2056b9ec4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790510": [ { "ioc_value": "f68061197e009c7253e1ff2e8f263a0ec216821c289f3f0ad25b9d3600d08a5e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790511": [ { "ioc_value": "11bb01fa65404fc6193ca5ed51a7e0991bdb57385bb0ac9d787e420908f18eae", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790512": [ { "ioc_value": "8b1cdcafd673fa875ba370649a851ca2d438d175a6c427310dc69e6659e89831", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790513": [ { "ioc_value": "8165c7be5db8f236775ea066e460182ab41640117c9c9cd630a47dfb458019a6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790476": [ { "ioc_value": "ca6fb0bda654388a24f0e844b26a9fa7b48d5e94dd9573fdd619c978b7336df5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790477": [ { "ioc_value": "f850739bc8cc177cb4d5eb1f5d2c6bc8bbb2b38c8e7c1709566aa9c7830072f5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790478": [ { "ioc_value": "a0aaf7f85180158380c403cc17563cad13adf88a00ccf23ca40dd80d944993ca", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790479": [ { "ioc_value": "742dac704026ba55f6697ec8041b9631ed24091170dbfa07c314c2f0057a4917", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790480": [ { "ioc_value": "22ee69a070962d0e1652600ba582daa02013e1dbe6edbcf7bb98f943f0bdadfc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790481": [ { "ioc_value": "e93b2cf6a936043245ebed6f24aaa3ecbdc15eb931cbb3627a9b9301c5729af0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790482": [ { "ioc_value": "873822257427d07c59a1830ffac6632df5d569d2c18a9aa768112cca06bae8ed", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790483": [ { "ioc_value": "e3ff350e7b3e2478fc399ab26de5e96698661085695c1fd05c5de4b8a110948e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790484": [ { "ioc_value": "2fbd4d15f479009307e3114e743907c52e753302d8443eba3c832be4e1950d6d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790485": [ { "ioc_value": "4dde91ab380c2c74709a9fddd642c8402ab1be075c857c99e98b1be7f0f9c0f7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790486": [ { "ioc_value": "4975103c5f14d268473c71252074792d0fdf110fc72b27a3d9b7b0c9c7f0fb4f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790487": [ { "ioc_value": "2ca5a3f846c73a14e188ac2e29821e2f1b53fb2eff414821bdaca20322019a58", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790488": [ { "ioc_value": "96b2ca084ddaacb69a6e5ee6d91b3416ae68400bf04527be6e682d447be7b217", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790489": [ { "ioc_value": "b3596af300a659cf4c53e845f137b5851729288f6590ae98c7291ec091022f62", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790490": [ { "ioc_value": "7e3e601b42098d53744e61bf2d4cfbcd80ff8f91cb0644d7ab7b2705b0f0cee1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790491": [ { "ioc_value": "81340d84cf56fbaf8f0c4b82b92810c3e2b23a211eafa5fbef4bfa269c3e426b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790492": [ { "ioc_value": "95abe3748cebed5c88b4656b596becf2cc3daac303a7d5dc3db6ee37a5575048", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790493": [ { "ioc_value": "57fd668f04207b3bd9f838e1b4ee82986fd62144bf2ef5bbe8f4bd4d97c9b859", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790457": [ { "ioc_value": "8b116447d45cc1d40e1b2646743a7744f94ee2f943faf888ddb396012693d0f7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790458": [ { "ioc_value": "a917cc653cf790c0f9057902b831607687c8afee80e9587b45a9c5bd5bc7e189", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790459": [ { "ioc_value": "77582b7d6e516b3047db0a06f0e26c481bdc392063676aa64140d44d79af1ea8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790460": [ { "ioc_value": "f3c82e243756589999670c625b8bc4897ee5066c6e6262703fc5618dcc8f9c18", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790461": [ { "ioc_value": "f4c929f05ee154ef259f0577d71b4c686c56844bc8c11d2e34b6036078b42c5e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790462": [ { "ioc_value": "c371ed604e8becb336a9f49c71c539c4f6aa37fb6f60d726c7369a3b5ef95886", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790463": [ { "ioc_value": "8c99433ffeb0845b053989801b460188ae55bc15febac433bc4654f7c840550e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790464": [ { "ioc_value": "163e97e3720a3eee0d3451907a39c100b208dd615ea071d84264baf591802cf4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790465": [ { "ioc_value": "83a472f26b622daf0a6464d0e50a2fec1242ff1cec7de62df658b77b07dce16d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790466": [ { "ioc_value": "15af2ea1b36d68a05e34d941ec0c5ac364b13f00fd04bc861ce0a1b8e19b673e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790467": [ { "ioc_value": "01333054c880470654894d223da2dcd40f8e236a619cb1816e878f2bad5242cf", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790468": [ { "ioc_value": "6923073fa637469ca24da3cbcc15e145dc51f325ad499ba55f3fbf8d1493c533", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790469": [ { "ioc_value": "7d94586b5929fedd75a4fffe2749713b16aaa3de2a9c5ca7483bf87fd76890a0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790470": [ { "ioc_value": "1ef491fc0e9f2e6fedd0ec5a3750fa7ba63936573bc6f90f045478f9f4b7b3b6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790471": [ { "ioc_value": "8787475f43a57d10674fc8882f1ad331bd4ba997a60ef9a6e4128fc60537c509", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790472": [ { "ioc_value": "ec553eb6053c351355d85cded34f599b15739816d688e74b077f82d85059d2c6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790473": [ { "ioc_value": "99a0ddd5d71dedd834c20f348ae3ea9907c1576e4a0d2cda34413d28f483c5e1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790474": [ { "ioc_value": "15b179da54fce28a029d83cb5bc2e54bf6dea1ceb74305b75fbc2c78e1ebd5e5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790475": [ { "ioc_value": "d5c847bf9df7bffbcac3856951c40e050b72a27b464e9483e59411edd1420f9d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790438": [ { "ioc_value": "cb84ba5e96e98f8b38bab970ef401b163ef5b73dbd3b128ad35b294f1125d747", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790439": [ { "ioc_value": "29327fe908b1f43bf876a91661729cdf309f9ba755c89108e146093dac1fbf96", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790440": [ { "ioc_value": "25ade8b447c6ca333e0867b624d948a7b43495dd54525a1272d2b5ade8e0f7e5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790441": [ { "ioc_value": "911758ca538c7355828637d790e057c6a109600f0d4801956b78576825b099aa", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790442": [ { "ioc_value": "a58292b77011484593a092872379a11296bd957809cf7c3d0d1b1574c3e0fa6b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790443": [ { "ioc_value": "bb8dc24ad3f5a0f062230061e6acb4833f643409a35704aae9b6ad1a9fadda30", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790444": [ { "ioc_value": "91d5c3c950291c4413f343df3e4c4b6342f436308d22d1f16d9605915fc8efe3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790445": [ { "ioc_value": "5aaab868b79b67aa641748fed1761db72d5a461ef69ba5671e7dabb14dbf7465", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790446": [ { "ioc_value": "80996ecd7255db6b4856e702e3e2a83504e224d66280a816dd768b4f05f4e0f7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790447": [ { "ioc_value": "fe69468053531a45768604b4ff5822c719147286d54cc143eb867ec9f225b360", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790448": [ { "ioc_value": "da9166a7d70015cae033bced7517c39972fcde7e25eddbfb7a70f75eb64da30b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790449": [ { "ioc_value": "0c90634b92414dd68a9565023c862a8cc008a591d7b7e7d2f7e9473dd1c4044b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790450": [ { "ioc_value": "8a1ca6070ca9551b510a314b98dbfd210a1813035f590461e909bd8fe3c7bede", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790451": [ { "ioc_value": "11eef97cf5b984e5967e5cc787925752d6f9b31da600e5d5dcfd1c25ce96b2c4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790452": [ { "ioc_value": "a75111d0e2fbeadbbf768d7e4294366a572608b67781cf82bca1a4a9ca09fdae", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790453": [ { "ioc_value": "35e1c7986127558d63a499eef96f7138ff04dd8095ea89460bfd477716f77200", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790454": [ { "ioc_value": "682322dfee8d301af6b079d126ec1179e7f90243a3524bc1cce7222a15816b68", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790455": [ { "ioc_value": "674a2798744f15dd875a76eb16f05feaf1f558b9137b61c1d201290e32070ebb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790456": [ { "ioc_value": "e2c023fd04372606376eee04566bfe3c0fa833cc8eea4e3ac9a7a5d1dc9e69ee", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790418": [ { "ioc_value": "32cc6751c7ded48b24e321252b10e058f28ed5bc4e2e4ff6f0b7712960bef835", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790419": [ { "ioc_value": "6ba5691968475b9358a5dc71a693b79fde2fa5d936ddc083604a2fe3b2cebe75", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790420": [ { "ioc_value": "5417b83e760fda641777b02dfe18779c0f010e1cc421c46b2405ccace3319e1d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790421": [ { "ioc_value": "f85c8aad94bc7b6b5c034cdfaba7b499d7b8b687a883e0a9dff500a68822bd1e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790422": [ { "ioc_value": "58819d78f02c9170e186fc7b00d4343483d7475a0310bcea2f9ae57f9299d478", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790423": [ { "ioc_value": "ceee77bc0912be99d2a6e30db206a3d40d1122ed0b4899eb92d7037faa01e812", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790424": [ { "ioc_value": "43fbf7d4be3c24641c3761857164bd668059d63bc8b4fb65b5a4db89d258823d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790425": [ { "ioc_value": "c19acd93293adae4a69fe9bdf7f386e12dc5a946cbbdd44f9c7663ea5380b24a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790426": [ { "ioc_value": "49d4030e55c0ed24e3a2ae57224244d91649eb512707f3ce89d883f1f92a53cc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790427": [ { "ioc_value": "36da35a99082bead0e0142362a6af7489887a3061ad53f53789368c60b574d26", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790428": [ { "ioc_value": "6a82c3aadbd70dd0f0bace9085e657e37e8d76604cea1c634d40f925202d19fa", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790429": [ { "ioc_value": "eabf8d0231380c01c191a4e63a1f4edcd68843d49bb6ec8fefcdcd01580c3066", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790430": [ { "ioc_value": "2a7277d6effd4cdf777e2d86d1e0cc4dee1b3b48302757bd97f2783b64c4b82f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790431": [ { "ioc_value": "69a72779ba985c61cfdde3574c32ded0384fed2acea88d186fd01d0b8e227ef2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790432": [ { "ioc_value": "ef25fb6b2b56e8a3a2cd55591d760ba1272805f61cb9b2e73cfdd975d1fe8160", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790433": [ { "ioc_value": "1788e7afbee667b96ac76c46032f58e5a429b47b863605594f6dd97d2037b2ef", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790434": [ { "ioc_value": "79326544757d48a9f0fc0cfd9628df712a92271fa85e1194c5132fa465896e72", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790435": [ { "ioc_value": "1142ffd9d911872a92af906355bb6243f76861d478123e780ecfdf7065ad61fa", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790436": [ { "ioc_value": "d250d9ff81e7d9463a3f4a5f4f4c8cc9f5fecc0b9892324f82a900a382f92609", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790437": [ { "ioc_value": "f3f0b3fb62bd30eeb481a1e51fcf4f974ba0582c2c42d107aad672aa7766107e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790399": [ { "ioc_value": "d00de75e87ccc9c234f1e0148657aeed1f649ab2f916568bf17e204800b43f50", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790400": [ { "ioc_value": "7e197dbbb49fe9bd6de50b0306c96f826584dba15895264c2c23ce68c9a29a68", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790401": [ { "ioc_value": "8b7c59f42d9efe93528e29cfdc644bc3a3bfb2fb23b101fd1352e2aa8db8c793", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790402": [ { "ioc_value": "29488883395bdce89334ea0faa86a6b9f8e20db80a8e64b0be4ec9e75a1f03bc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790403": [ { "ioc_value": "20fef2001f5c8fcb55f3667939d79c658d60ebcad105e2392d4fb857d63ac1d3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790404": [ { "ioc_value": "79061da891e7596c69904c63dd8776e4b2485130732b770a48c118ee7f55cef5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790405": [ { "ioc_value": "c86e52522aadba8d7f626d8eef5102a44f934ff949b57ba77e01a70115a256bc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790406": [ { "ioc_value": "7e711efa13f77c0653f380612569e3b94f33a6ff0d445f456325e4b7359b793f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790407": [ { "ioc_value": "8b7b6c8d21a68a5685bb36709603398e543a2c5201cc20dd9d409dfdd10d93eb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790408": [ { "ioc_value": "8fa727eae2a0f6de0fac5c38eb768eb7a58edcd569b78101d37cb68e5ea4ea01", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790409": [ { "ioc_value": "eaaa0892a404ea017cc4fdcd2b65567f9f3b9faf9e8dd2dbd0a59bcdaeef9943", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790410": [ { "ioc_value": "bbf2101c7b18261afc21ceec7e288a3d8d3cc906be88fad69b31f9ef2f95a6b5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790411": [ { "ioc_value": "1a8d86f5cf229c2425aed3099bdeb799312fcba40684bc35738482596a373a56", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790412": [ { "ioc_value": "2bcb0c078db9b2c2dd1c0306eea58dff62b81e308471ef2ab598f2b1fb611102", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790413": [ { "ioc_value": "9e1c178d634285c44b532682293f3b2470eb12f46fb2bf9abd6c42dc23f9b842", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790414": [ { "ioc_value": "c5ebfa96f3c3f4f4eddba65fe0dca9795195c524958fc2901e1b50dce0880e78", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790415": [ { "ioc_value": "5a3f74d9e67a2b1f8b8b1642739de9841c01e0fb9de5fa24e67cf88e20548799", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790416": [ { "ioc_value": "4ae999919ba793381024cfcbd2c9aa3895963cb4f7631eddbc9595402a9cd77a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790417": [ { "ioc_value": "1af5aad4a5f22146539a05ccae2a7a18cfe49ff9e9a6a1dbf10a9cde0bd0957f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790381": [ { "ioc_value": "55995c6d03fd532fa6092ac5e37a73e9e4175a305e86e9af92b44d23143be2b8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790382": [ { "ioc_value": "b9333dc71ac337c17f31752c76f59715350d0d344e2f3bb5c8c6840bfc05fadf", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790383": [ { "ioc_value": "10f4d19a457e845cad29b7a9942462d89841c814f008ec4633b86007ea690580", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790384": [ { "ioc_value": "1c5a20c4461a27c5fa7666b349662196e1f2efa9fd80de65f548817d77c95f7f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790385": [ { "ioc_value": "cf2ecb74212e101a871b2969b3528f2f4754172c13b4586b4780eb1f050a19b0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790386": [ { "ioc_value": "845a763524c212368f974499ab1739e954db5967557faed609228f8412bbc783", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790387": [ { "ioc_value": "6addfdd67bb9d4bee1c92406c11ff05e35edf495d55cd642a50610e39fca8bb0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790388": [ { "ioc_value": "4ff2b24e6509cca367217962faa6d72de206fb373db61b994ae6bdec0cfcbe47", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790389": [ { "ioc_value": "9ca461a4341c6de3091ec0e1d571ffdd257ad23632dccb13b7417c06ae245930", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790390": [ { "ioc_value": "40d196f874cc780eb289bad86fdc871378d236a4bd7531e61e45bcd7bf812a65", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790391": [ { "ioc_value": "c6ae0631b8b6fe000f97a2c85fcb449f0f4873bd907d870f45bcc50442ba0277", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790392": [ { "ioc_value": "85f748294ed760dcad99fa111161349070a1b456af5a86ee74056dd265fe6115", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790393": [ { "ioc_value": "85ea344c1eacef06cc40f1aba8cc13d1bf4a2f7f1ecec1be1fe0d5e3cfacbcc7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790394": [ { "ioc_value": "0a113ee0c0d69ce266e3aa8cb9a8acbe0d6728534941f64e19106f9f2ea15bc8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790395": [ { "ioc_value": "a75d4d1f4b759a431b51d860d43fdaa0de879784dac4053401871da5626dce37", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790396": [ { "ioc_value": "4d6411d373496d5d30cbd70f05f0ebd55d50be803e59b9797815e1eb4a421e0a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790397": [ { "ioc_value": "58e70ee8633282988dc8d21eb85cf1e0611d7f9d09b9d4bd9ffe53eb61e34d7b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790398": [ { "ioc_value": "2e3e020f27b30e33aa65c6ea95bad413c3787f1a2395be6514430c3f7b4124a4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790362": [ { "ioc_value": "8413589841dab938fe3070d1f4e66657c2ae71bbbc2cf48426627540aa1ab87c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790363": [ { "ioc_value": "483a0c3bcc30c8f1144342d59d5edff57eef3607e6f69abb5c8ab339ebcad1a3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790364": [ { "ioc_value": "d16291e1a584d25151a24fda5ac24deb0979cd6150b63690cfe2c3ea656293e4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790365": [ { "ioc_value": "ce93d2b9b942c5fc4a251e764c4e933d4cc3e8311bcbf7806d9438fc85ab045c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790366": [ { "ioc_value": "921bc86dbc7224f9eb85eea33ca2b4c69bb44622c212543e5d44f69489b066aa", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790367": [ { "ioc_value": "1373c33742f02dda7b52f2ce18cdd80b8fcb4c200dd17729d02e9d17d4b1c7c6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790368": [ { "ioc_value": "1f3ed31fe00f321f36549bf508683bced58c87eb49c35ff1f4fa0917f9af6f2c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790369": [ { "ioc_value": "3bb3fad854bc13d3c6c5b91bdcc91e8a2b704ab8608687f9643b266aa6a8a837", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790370": [ { "ioc_value": "662435300304f5b1a75e577909ce65e24e483763342aa2eecfb1486911969b35", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790371": [ { "ioc_value": "67e9483cbd61ab4369abf7e285037304f277158c81cd8190b2c5534c4eabf464", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790372": [ { "ioc_value": "d3c04e503c0453658e7fe383594bb0978dd8f527c49a26eeed5deecf1c5db899", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790373": [ { "ioc_value": "1941cbf3b6e705550f373990b5702220b2c1db0dceaf252ded42cdaff295c54f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790374": [ { "ioc_value": "136fcb59b2e12f3bd5c5a943737731f7c9a808fbf550b9b729b06c5bb36556b2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790375": [ { "ioc_value": "1ecb6cebc56983fcbee15fc018ff1a1d2553ae9a95a0c4f000c4fd42d3b4af76", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790376": [ { "ioc_value": "31bbac0ede381c40bddd1e69e32911ca18fe1c22f5ea7cf4285c82ad58c11977", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790377": [ { "ioc_value": "d572ce30e9c3b0177cf863708c5a8351a6c39081a54b9d1ad48c7344cf503303", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790378": [ { "ioc_value": "8e78c59dce314b9235e356960236fff561d8233b47f9935806cf53e30a43e8d1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790379": [ { "ioc_value": "926a19019bf1881a6b881a5c0b5e77baba95b068635e1463993c9fbf2a3107a2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790380": [ { "ioc_value": "ff05563eabb5872c2d4b73d7d8861afd7902b96d26880c7b1efa82e9c703a4c5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790350": [ { "ioc_value": "af959189167d7be709f757607d8135c0f15cdfc61bfcb1d55ebefae0b4855812", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790351": [ { "ioc_value": "c34b4b67cb0a3ae2f44f8e83e6b3f39ced52ea7126bccc0889a6417d8a290dbe", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790352": [ { "ioc_value": "0234b365f7d15a605cb2c36c667f04ecf9369934977cac90a91b8e45d656fbe2", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790353": [ { "ioc_value": "91fd1356ba2e8b07323de52a841559d0f8bbd45d1be454ec9cfc664d59190ad7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790354": [ { "ioc_value": "95e4c4fe050b748a2b4e6efefb1b1a1439bd50465441546c21a1545f42db9787", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790355": [ { "ioc_value": "e82a8bc23ddbb2d41206a1bdd2c0ca0c6c5f53bfa62a1b791171d617effee4db", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790356": [ { "ioc_value": "9bf3b67af5dad417bcbf7b445478e85ec0ee6b617d3f73be5f55f0ad4f7766ff", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790357": [ { "ioc_value": "41fb7b8b34bdcd51d2758a667ccaa7c97270c946e1e7d4080bc6f03af2665767", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790358": [ { "ioc_value": "e66c72845232ec528bd8b234d4854e00181885f904a2012e95c81b330c232b09", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790359": [ { "ioc_value": "f49a804f124cf7199a8d1286f8c830eef5ec66dee59c1cf76921c80e8886075e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790360": [ { "ioc_value": "1110071af42489c931c542d62b1d0a66fc9d7f7ed84ba0217b9cc12f2b48a905", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790361": [ { "ioc_value": "c1b3943a050dbe9dce7b0f60619767371e1c3f7726f556484142f71550c686b1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790332": [ { "ioc_value": "4b3d1a59329d1efe4d6c72be7f740d010467746f3e738f976ea4be96b715618f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790333": [ { "ioc_value": "cdfbfe172bcb984576084babcd26215c0c2b783ce6fc5a36297290ff4c3b4ac6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790334": [ { "ioc_value": "f5816cba1c1b40996a2d05622447e403b0cdd45e21e1588f226b3fb4cb507c56", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790335": [ { "ioc_value": "fbfb72e6e6e92dee6086a4654ad8a00f05f58b33ebc990b52af885fde50ff575", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790336": [ { "ioc_value": "8c8b732e5f2392627f3aacb8124dcdd60fa009666bfc63aa8c20decb866203a6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790337": [ { "ioc_value": "efbf25481c6ab0f69b0b9585aaac21e1f623ea958f3f530dad8accee23802f8f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790338": [ { "ioc_value": "1c159647900ec47ef85edc39fe408da1d501824df10be64014c07d2d2b7f6cc5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790339": [ { "ioc_value": "93a688c91bc57417e8bca89c8ebfed11597196bc882d3ff9ff491c6063408ddd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790340": [ { "ioc_value": "0135095c37ace9a4fd0a05d92d3cf020c556c35b2219efbd7eb0d463e40b95cc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790341": [ { "ioc_value": "d30a24f8632e43f71ca4abda6ef6e618289aeffaa5f191000009fa83b33b1532", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790342": [ { "ioc_value": "cf5eb99e32ce4b08c2b0966ebed5b6ece219037c513931b2838208f96cababc0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790343": [ { "ioc_value": "0a81d64b221bb082c517e3a19534885a133c91344bfb310ff628ec973213e34c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790344": [ { "ioc_value": "4498dfe9ecceb012be43b331dd35192a5a00167e0bbd8c98c6d70a7fa5f0b3bd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790345": [ { "ioc_value": "c0e27f5faead4b0920bf1e6232e505a713252d804626124d18d8780ea1b5b753", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790346": [ { "ioc_value": "cea9f6932c506550bcb0b66cf0d1e53dad22ca73dd79f14a1772f9f2edc61b41", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790347": [ { "ioc_value": "956fc9515bab51ddf550bdec0be053dae8997043e3f9979244e95925788cf53c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790348": [ { "ioc_value": "9126057eb5bdf1e6e132d453e541b0c1c1a09366b4c02351ed9fbb6d002ec5f9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790349": [ { "ioc_value": "5ead45bc83c4fee8955212a5d8fc987164b13d149f6752d463381dddc444c5bd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790314": [ { "ioc_value": "38256cb1132a3f201c9abf6dc15a94d9b662797af0eab843dc4bc68170ee9ede", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790315": [ { "ioc_value": "294ecd3bbab9a1329d9e492a6e518b50d7220a0855c5e0fd80045abe6e0c4357", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790316": [ { "ioc_value": "1161f2aaede4428d7c5ad55c68d14531c7459a2a946e9b946553027db4087b9e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790317": [ { "ioc_value": "d906d265edbdc56a728ab405860fd542e85f3014cac9a68dc9d8fc3196aba43b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790318": [ { "ioc_value": "935cc9f96dc2894229ad0aa67ff4a3170cde652778986ca0b2b213fb5617b2aa", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790319": [ { "ioc_value": "7d2bd8f47335908121d94f4938ca4b54400067ba0953f07ce93647a0e448fb45", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790320": [ { "ioc_value": "3768bff5453b43af925c7953f1f56e5c1c35a1a7860b8c2c3ae95b0e44ca903c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790321": [ { "ioc_value": "a03a6eacb52410725dc56cf5724417b990aa7323626da046c4c6f53ea98d782f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790322": [ { "ioc_value": "9882b6a8ca3919b6ef9805e91baeba080a787690070e9086d3fc13277c36f71d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790323": [ { "ioc_value": "1447c5823df96c2b88827aa82d13c107b16fcb103e244dacc7acc1cb37a2b0da", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790324": [ { "ioc_value": "bd0bacfc6cbb24b2efe0ceab15470303a56aee44b1202c181f12310fb93fce42", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790325": [ { "ioc_value": "6578390db4fd14dabecc22177108f2ca7f1176b1c8d442fd3eb2b72fd98c599c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790326": [ { "ioc_value": "2d429576afc207be56e13a36a3f534dee9affe0b4315f37933695b0146f527ac", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790327": [ { "ioc_value": "d78eb768c4fbeff9b1a1541ea860f2da433a23b7d25a7c36550aea2cd67f9313", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790328": [ { "ioc_value": "e99f54ca9e976bb684bd4de43c86a252335a1cf3c9e3181b24fd346f55c5be94", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790329": [ { "ioc_value": "a9703fd7c71d2888ee8b428e649d968b37a0df6dd653d41525aee81baa86198e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790330": [ { "ioc_value": "f61d22d83af663ba07935fb7fc40dccdbd07557461c90e82a7c688b7b8d590f0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790331": [ { "ioc_value": "9a753bcb21043e91ce77e0720eb9f0303417d175542b2683508e804267a5bdf0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790295": [ { "ioc_value": "8f3f248cb6ca21bcfe2a89d21f45a73229506104632030b05c84e6392393fa4e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790296": [ { "ioc_value": "c1254cc9f811db9aff2632b69370aa4c8a49954a0dcb47154b3a4ee17b55d672", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790297": [ { "ioc_value": "c0d2b6fe913779d11d9c9db0552316771fcd34bd215207e119dbc7d862df5ccf", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790298": [ { "ioc_value": "f7f0c88ec89a4e80fabb902af02380901c171aca21c417a8aaeb7d88159598e0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790299": [ { "ioc_value": "0f77f6ef331cf6db3bddddb99e2019f53e04d6f6bd6fd92b17c3de5897b3857d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790300": [ { "ioc_value": "babe39994b3e1c1d0a91215f00b75b034dab501d099c8211e4b86ce702088806", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790301": [ { "ioc_value": "e1c04fc82c92f529c7d18d180b01cdcb22e4e0118d27f75d0d7c63bdd4f4b552", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790302": [ { "ioc_value": "a6960965188dc4104eb794f689fb728b178ed49398aafcc79edf112b18896eae", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790303": [ { "ioc_value": "e35dae41bd5c3041083e7c5247aef2fafd5a56bd90ecb7c07962e5063a6acefe", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790304": [ { "ioc_value": "8550148408eebe4510401da648b56a88b80e93ef955739a59e9fc5bf66559ca0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790305": [ { "ioc_value": "dcb8cd5e83127b0fb38180370b6cbe7619e24a4461e7e52238100103c2ad60a0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790306": [ { "ioc_value": "b204318188b271528aa00794e3b21bab7b02a218c96ab69ad63185157e931148", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790307": [ { "ioc_value": "76d07f31cce5d58cb8688cfdf21aa3544bbed50d807d07fbadf45bb0aac7e299", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790308": [ { "ioc_value": "4ee9caffb5980c29ad62516ab09593d8ec51c336be715cff411b5633981b8c15", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790309": [ { "ioc_value": "6e547a221bdf8120ea6a4e576cac37a8ebc8adbc381d20976d9ec959ec69239e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790310": [ { "ioc_value": "49d2db40ea065698f1fadf5b41f941f46d48754eb81c148249e0090caca48225", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790311": [ { "ioc_value": "7499e5f2d7ec245e12681ce605fe493398f2c3df2a72cd683853ad1be2721fe5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790312": [ { "ioc_value": "6834844aca9d737c9a98c5f7cf54c0d58537fc3c0d511af62fc8b3e588b66770", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790313": [ { "ioc_value": "5717aa18d278c4b185ba299a3f34bbe061dd317e7c0d161b4614aed98270f96f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790276": [ { "ioc_value": "0bb937c03b15859b150864e26ee1b0cc7e62e50b708a2792d4032e2d4c9bddb8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790277": [ { "ioc_value": "d7eac67cca3b803a4bdf194632dfcc2d1bace20a3f08a10da1bd6619abf87731", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790278": [ { "ioc_value": "722b88eda2e968309158f56dd72894c088a6a9f7c41c897ce55ec79a03ed0900", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790279": [ { "ioc_value": "78458b9aa5c75560410f0b0c4098830d5b82cb3b6c8269fc1360e373880613c6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790280": [ { "ioc_value": "a4f3bed939becb91cb104dc61bcf9e58314de9858b9d07125a3d3312ee40f0cb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790281": [ { "ioc_value": "2622ae609ba08a0a60230fba11787adf85e5801318f2259ee5ce233a0f7c5f4e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790282": [ { "ioc_value": "c85fb0890574e328427843890e9d66fc7d18282db852cbba8e8a3e25593730db", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790283": [ { "ioc_value": "c3bf19cf70b4c3094ce9c2f18f1d3eb47d08684dca7dec794339f52fdde8b069", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790284": [ { "ioc_value": "af7b1b0080533ad5839a25282a96f96d842e3dc3a07068e0c58cfddcf3b10e6f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790285": [ { "ioc_value": "31c17f9d3909a74cd700db4869526ebabe64dbbcb0d85574324a04d333ae7928", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790286": [ { "ioc_value": "739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790287": [ { "ioc_value": "1c033eae7730220660104f66bde8f52231ab6140e04da315821970e242aed290", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790288": [ { "ioc_value": "0bee944a61b604c455ffb28a0a5863b784b790962683adcafd51d8a1f0a69172", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790289": [ { "ioc_value": "73bbac84a5eed29db3e53d01298eef42716017974157431545f76964f584c10d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790290": [ { "ioc_value": "4cd6a1248457e22452c328bc05401a24a29271384ccd7a9a5b41890bc3eb36ed", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790291": [ { "ioc_value": "deb589bc3f13aedcd3438e950ea1444b6a085532d47f5ffdb66f9a32d72aad6d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790292": [ { "ioc_value": "dc8ea6cdaaf099777bd13cb2098b5e39fa17e070cd070b60aa0ba683630aa9e8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790293": [ { "ioc_value": "8a19f682c50c5512fa57c17a33d56fa780f2063cf54350a9e3e532956a76fa01", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790294": [ { "ioc_value": "c671f1b1752e7fe98877a829ddd799291a0c6fbcd6e60ddcd8624ae762221eca", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790257": [ { "ioc_value": "a6bbd8ed2af44cb598d6b2532c8ef9d8a17114534e816ce4962ec3dd3689b48f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790258": [ { "ioc_value": "d12c7a7f43f0c1c66e527558fc694fee169968f2ceefd99c966ad934258de005", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790259": [ { "ioc_value": "fa7edcb40de5a57e63b9ba02908295c0e7850e6c2e342044ad8bc38b4353dff5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790260": [ { "ioc_value": "69bb2a74a9975e28225a60dd686e0f0e36cc5f4576a1930e8706a65e998aef12", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790261": [ { "ioc_value": "78afe63cd6e9e5682bf1f9ed5019bc765dc02e360123e0557bf9818c97513844", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790262": [ { "ioc_value": "fe6a28b34070436d59309f0ebde27ac7c8e439e30efb799b2446141e40740922", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790263": [ { "ioc_value": "9286a4be6e73d76857d81a2d044d81228b77896cf8e0795afa7bcf6952416436", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790264": [ { "ioc_value": "9df8e2d12fe1dbc7fe79809219eb815d6611b6c29361638be13b0125ed63a505", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790265": [ { "ioc_value": "360a081c4df96f009b73c843a522ff483eda25f0e21b1c69c273dba1a6c37bf1", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790266": [ { "ioc_value": "8921defb04f5834ce207840989fc84ec84799ab35ebda1c37f1a0c4184358476", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790267": [ { "ioc_value": "836e564628c1c50f80211b4d5c7f12a76f98f7e0cc14c486cb1f0a2bf3f89278", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790268": [ { "ioc_value": "93d5150899a4428a04821603a83b7ab96dc05b24902d0b368cc9912e35c016bc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790269": [ { "ioc_value": "feb34d0f9481afa7f26338c19050b5fe62821c07be4604887987fd1e50c91d44", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790270": [ { "ioc_value": "45cbc9886966f49e290a7ee14de24dea927f6af06d9674c4ff616d589315ea45", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790271": [ { "ioc_value": "5adc38b70464da2946c5bbc2d4d6a0285db1e0fbd4d2eeb5e9c6477544a38162", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790272": [ { "ioc_value": "b8e3f6a937d1ad634c93aea6f3705bfba18a58c9218b5b54f4d46e56bef66c75", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790273": [ { "ioc_value": "a3a980413d3ccccf489d80e500735e9d12bc5cb416a0fec61ca9b72b4b4b0df0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790274": [ { "ioc_value": "47fd50016dd4b2b8ee27532f93c2a136c29540217ad3a463b60aa6a3aa00a6eb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790275": [ { "ioc_value": "4e02397f33c4cc417842871092f5d18e7bddb24fa37ba77dca897c35a439de25", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790238": [ { "ioc_value": "dd6eab2156f1fe42a92d4a677e9708d5475c2d3fe93a4fb94dc24c2d8140999b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790239": [ { "ioc_value": "b483fe7d29ce8eedcb3e1ec061e0f45bc44d0b48e4f21eaaf67a063388314ff7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790240": [ { "ioc_value": "060bc75878c5b20da56a0845551e933ed8eda426a91b1c9f34f763a25b5f79da", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790241": [ { "ioc_value": "0f0dcf3b13dc6de210fad351395ee5abc973797af36bf155f292b701dd9d7626", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790242": [ { "ioc_value": "d1456fd10caa2572750ccc24df39d7ad8543e7b6a0e9188785cddfc33f46b1d9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790243": [ { "ioc_value": "dcefea9b5172555836f7f5dd34bb45d6be1d220acae0e3409ae5a49eba3d2007", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790244": [ { "ioc_value": "7f3a51d0624ebf838a483be1e6e463702f742e21e64548a0de99845270647965", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790245": [ { "ioc_value": "bb1b1ecd3a0209535db17c15b38c33f514ecb82feb1fb0b025e909cd32c11b01", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790246": [ { "ioc_value": "5391e8f599a78e204dc6de15a8cb7b5349d1f5c665f422d92b4c1e0048ec3d5c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790247": [ { "ioc_value": "f7a78704ed231d0b08089bd4c6191627813b3027a44ac3046bbde0b3cb135891", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790248": [ { "ioc_value": "1347e41fd5ac4631241dbafc944129d817b16072e95cd35835ef4257cef2302b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790249": [ { "ioc_value": "f532f72e8dafa0818a977718ce4d55a5e25823258fd51f0b0d5ebd723b7bf2be", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790250": [ { "ioc_value": "3ea89f2f1dff46e65210b3d4ee457bde6aa05199f47b0fdab496bab13a3ac77d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790251": [ { "ioc_value": "a906f16b6aa6f9256b24404be8a58bcb20bd4c3e9a636b02ef3c71e74d90a5de", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790252": [ { "ioc_value": "68278d073206df8a1c44de89daafe74b78a0dbabf05fc15512ce3fbcbbb1f5f8", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790253": [ { "ioc_value": "bb3eadb0f7d63144fe546ffb24f20a55a91d1f25e6302c045a8c12d2018c8885", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790254": [ { "ioc_value": "cc190c40f09b2cd0f6aa53a3b79efaa7a9ceb92a6aaae1609581526f21a86f29", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790255": [ { "ioc_value": "cd812e9b612eb40354106cdadcf01ccda6011f42cfb4ca7d13211d32dc86fa72", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790256": [ { "ioc_value": "605cf97701ddf0bbbdd71be7f8a8527efe203fbc8648a61c362347d69e9cd237", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790218": [ { "ioc_value": "06bce9facd3a5b839273de11eea8910e3408e404a924b334023fdd49bb6275b0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790219": [ { "ioc_value": "9e7e75757a836d6d57214490b190bd2705ad4ba7e4e014460bbbbd6e1d51f43f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790220": [ { "ioc_value": "7066ae51e6092e2acf834068cb4d342d056bb39e076f6aeb7ab71fb8c6caf409", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790221": [ { "ioc_value": "ae735b645e655042b08fa4a8c638a5dbad57c94f1ade8ce77509702bcabdf36e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790222": [ { "ioc_value": "9918e7cdb36e5350dac513133846998aee987f68f72509cdd27577ef72f8b808", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790223": [ { "ioc_value": "f9987ca8cdb3cdf2372e383553bf0e2deacddf1d243466079becb239bea6e863", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790224": [ { "ioc_value": "dbe3330e0970ee186b792df104e18f3090a19d675fdc17e0df72b81c85145fb0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790225": [ { "ioc_value": "3265edc9fc9087627b455c871a657283f06ae0c9009b5195754a9ac866cfe916", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790226": [ { "ioc_value": "55209a3e30e6c616dc233d091db339a87715036a54e0db211893baffd7d22a18", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790227": [ { "ioc_value": "f5b34f4788bdafcf236d28259d53ed2002c0c8577adc0fe1d2bf8a6bfedc7cc5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790228": [ { "ioc_value": "6c0a664dc5b6141af13fc379d3b973e1c9cd6a949f0f6627a1f3d61acc9c693b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790229": [ { "ioc_value": "18771aab0d37ea21e0176445b17b75d145d9fc688a185e50293242c829566a73", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790230": [ { "ioc_value": "9eb8f629f1dabb9864321786f3440d80ffc4401bc86e9bf7260a92cce0b818f4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790231": [ { "ioc_value": "3b0c736483a0c19a667d995d5105e53bae47746818966ec2999e605f8392d357", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790232": [ { "ioc_value": "4f33cec0aecf8e23494c330855a005ab6c3a8d5aa863de4773f4522c1ab0a2e4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790233": [ { "ioc_value": "1f955e0bfd665227c010b4470e6674974caa6c09fe96dfe5a61ccc2617302695", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790234": [ { "ioc_value": "d700038016eed46fbefb23f9846d029f5105001b0900ff4c4ba3d3c25f9a4bb0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790235": [ { "ioc_value": "60369e96d15ea4379df395600aee511277782017f1f82bf0072180c21648614f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790236": [ { "ioc_value": "fce3e4c7ae18a004e319459e81dbe36356d78d33af7c5653859fef42cb198609", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790237": [ { "ioc_value": "e286c5b1c83634d4b40e4589492713e933df1b218a326ffdb941624c7c32c2f9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790201": [ { "ioc_value": "cab3ac66513f09b99fc148b0e48e9a9f5b5e67e2e250265584a4c376822b225e", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790202": [ { "ioc_value": "5e7abfc1d63910f5a4dd45e6ee440799304d3a72f72abb8e6abb48a5364599bb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790203": [ { "ioc_value": "e9bc91b1f34c3cecafa295bdb5d43eacd134e0aaae971c4d97db6faa3a83f3c4", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790204": [ { "ioc_value": "53506c01dcbfc76d0ce7d9de079bc7789577d0775d02dcf2c5a283f6b42814ac", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790205": [ { "ioc_value": "0d63f2c44029f49f8aa11474b3b4f6720e1ceb878c5dfa54b832f1fd3d6497eb", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790206": [ { "ioc_value": "e48b74e6581bc75080e571970ca0462f504ade3fdf7c2637f50844feafddb0dd", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790207": [ { "ioc_value": "ab8b27c503c2193ee2a98ff7c7c26690e67b7150d999f9359a5f2c48a5cb209a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790208": [ { "ioc_value": "7c74398a5ebfba20116c1fa14f638b6ea2bd2c401b5a3593dcab54a332a0459c", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790209": [ { "ioc_value": "48a2ae3c7956e66150100c6fe8bcfb77d5f23cc1ea36fbe5f5df185de463eed3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790210": [ { "ioc_value": "952899ad2e3862eddc52d87aa69c85011037ea5c741649abd445ef83cc5088d3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790211": [ { "ioc_value": "e9b406f4fa100430004776fb6211c25056ece6c4d4ce0a3303e08976eed08e4d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790212": [ { "ioc_value": "77227b667f5cd74963793cda1cad94c60f3cd1a02e76677f690f683af537f749", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790213": [ { "ioc_value": "419d84ea0cbca1b972ba8f64aae0256104c7b5c9fa1fb938674ede05864451db", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790214": [ { "ioc_value": "5ea489b7b68e341859baaae9b24ef2d91800a13082dccded030532b2c9e10605", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790215": [ { "ioc_value": "4faf059a4a4925e4b8ae05ce39164131738dc9b7693e74d08e8301398ffdd885", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790216": [ { "ioc_value": "e0c5e5c7e3b414cf11f2b0423e399bba10eeed0069b21b399a3caf886ac2cd3a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790217": [ { "ioc_value": "ca3cd9e585698771e60e2b7e5c128d670a9a95d60e781eed57c2642792690e64", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790183": [ { "ioc_value": "27db224c47f6517f10bf21889c3ac8fdf35391aa6bf91ca04b34f1a02fdd2644", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790184": [ { "ioc_value": "b99ca8da6928cd5860f06a0211d5d6db24eaef983a9a389f7fa4dcabd1e840c7", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790185": [ { "ioc_value": "13dea6467446ce26442650cb14f57fde20604abd9c418c3979fb95b9198f5af9", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790186": [ { "ioc_value": "84a7670a373e8ffcc829ed79ba2bfe2bd52b256b3da0e93e110d8279f182003a", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790187": [ { "ioc_value": "host3-link.zor5liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": "2026-04-14 14:39:00", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1790188": [ { "ioc_value": "34c949e673b6aafe2ddd316b6e57a62f4dd8d3bacb4d8f440a6caf110bb116d3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790189": [ { "ioc_value": "6081aab9c1aab23d0df61a0a14ebbc72d7ee9fd44c68d2608c4ee9b11d879782", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790190": [ { "ioc_value": "e8dcb5c7a02f355f0db2e0a67092cf4dd1f1b410585bd949ee18a67a850c033b", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790191": [ { "ioc_value": "a64e76651d86aa8a3ba7c8f4dbb2f141483facc158023a714777875f8f708941", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790192": [ { "ioc_value": "3337a2581ee4994252d1baf5b94ddee4eeb9d9f7aedd57eddd2dd70fc9c3cab5", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790193": [ { "ioc_value": "7a19fab311de8040ca9440386398909e691025dccd3dbe3359a1013fa8b922dc", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790194": [ { "ioc_value": "58e0ebb91efc1c7d6844ee7d9f5fc91e3c6aab60f6052adad1d5f3e70f4b556d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790195": [ { "ioc_value": "425897b5383f676f132f2e140f7ab731524e2985de63d8b9ed3c7f674b3598c0", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790196": [ { "ioc_value": "834e2f109220a39973e9298b05bec1b28ba0345bda22f00da7c4dfed3e8b3573", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790197": [ { "ioc_value": "2a4dddebaf9ebae8b3ed734924127791f66e20ada08a64e28e094cacc4d2a53f", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790198": [ { "ioc_value": "830f638fac14a89bbaa9017ef5a53d1cb280397161a0ca931678aed3f2021032", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790199": [ { "ioc_value": "7786bc8b0b7ec60e6a5c3ae0360cabd932c17fe2ba5ee1a857147b59634e1213", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790200": [ { "ioc_value": "da542e9a955de4b7746da0093ae64de328ad33be2cafe2fefcdedbff6b879da3", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790177": [ { "ioc_value": "f99dd1d54a35253968feaf595c780a56b08b4bb73e395449b6f201ef1a5a5ad6", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790178": [ { "ioc_value": "eaa975b5e8f16b3ed49382517231e6439b5aff9d603c35d1ae682dd5f83ea110", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790179": [ { "ioc_value": "dd95dd42a5dc9212db72ef97b4f891ac31ff21b2e52536392395cf760a08c067", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790180": [ { "ioc_value": "820077c9c5fe8efba6a41b83c7787397de4dc65aaed23e591e5439691921e590", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790181": [ { "ioc_value": "65c598eed6a29cf700e4fc5c4885db8616f86ab40af6ea00a7b7dec9eafd9b43", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790182": [ { "ioc_value": "f64af31a6ef19a3825f1ca7bd747531befb4ffcd8647a324b7cb4362f76a425d", "ioc_type": "sha256_hash", "threat_type": "payload", "malware": "win.redline_stealer", "malware_alias": "RECORDSTEALER", "malware_printable": "RedLine Stealer", "first_seen_utc": "2026-04-14 14:38:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://github.com/TheRavenFile/IOC/blob/main/Redline%20Stealer", "tags": "redline,stealer", "anonymous": "0", "reporter": "TheRavenFile" } ], "1790176": [ { "ioc_value": "api2-node.zor5liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 14:33:00", "last_seen_utc": "2026-04-14 14:34:57", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790175": [ { "ioc_value": "pop1-edge.zor5liven.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 14:27:12", "last_seen_utc": "2026-04-14 14:29:15", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790174": [ { "ioc_value": "132.243.173.55:28370", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 14:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/d6a46b51dae39f549563ebe0b5ea1ae70082dc26385b45d661ad6bfca384cc8d/", "tags": "quasar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790173": [ { "ioc_value": "yellow.marblejoust.site", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 14:11:41", "last_seen_utc": "2026-04-14 14:49:52", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "kdozia,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790172": [ { "ioc_value": "http://yellow.marblejoust.site", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 14:11:35", "last_seen_utc": "2026-04-14 14:49:49", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "kdozia,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790171": [ { "ioc_value": "dzodu.sparklingideas.space", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 14:11:23", "last_seen_utc": "2026-04-16 11:15:47", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "odzdkzo,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790170": [ { "ioc_value": "http://dzodu.sparklingideas.space", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 14:11:18", "last_seen_utc": "2026-04-16 11:15:43", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "odzdkzo,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790169": [ { "ioc_value": "http://kdije.weirdthings.site", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 14:10:11", "last_seen_utc": "2026-04-16 11:14:07", "confidence_level": 75, "is_compromised": false, "reference": null, "tags": "okfueh,Vidar", "anonymous": "0", "reporter": "abuse_ch" } ], "1790168": [ { "ioc_value": "hyper-a5h.zen4qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 14:05:48", "last_seen_utc": "2026-04-14 14:08:17", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790167": [ { "ioc_value": "dynmarka2.zen4qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 14:00:29", "last_seen_utc": "2026-04-14 14:02:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790166": [ { "ioc_value": "soft3-ring.zen4qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:54:51", "last_seen_utc": "2026-04-14 13:56:49", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1790165": [ { "ioc_value": "darkspark.zen4qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:49:07", "last_seen_utc": "2026-04-14 13:50:59", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790164": [ { "ioc_value": "rai16-track.zen4qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:43:50", "last_seen_utc": "2026-04-14 13:45:38", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790163": [ { "ioc_value": "upzr.zen4qorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:37:51", "last_seen_utc": "2026-04-14 13:40:12", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790162": [ { "ioc_value": "cipherengin.mor5laxis.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:32:37", "last_seen_utc": "2026-04-14 13:34:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790161": [ { "ioc_value": "vialinn.mor5laxis.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:26:26", "last_seen_utc": "2026-04-14 13:28:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790160": [ { "ioc_value": "hz7cbx.mor5laxis.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:21:02", "last_seen_utc": "2026-04-14 13:22:55", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1790159": [ { "ioc_value": "https://tasktackleservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790154": [ { "ioc_value": "https://xclusivetravel.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:07", "last_seen_utc": "2026-04-15 18:30:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790155": [ { "ioc_value": "https://ytz.gca.mybluehost.me/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790156": [ { "ioc_value": "https://zeitdanach.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790157": [ { "ioc_value": "https://zunaminds.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790158": [ { "ioc_value": "https://brilliantgem.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790149": [ { "ioc_value": "https://tumburetreatbali.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790150": [ { "ioc_value": "https://uzatoulaneslepice.cz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790151": [ { "ioc_value": "https://valuesschool.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:06", "last_seen_utc": "2026-04-15 18:30:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790152": [ { "ioc_value": "https://verticerepresentacoes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790153": [ { "ioc_value": "https://villerusse.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790145": [ { "ioc_value": "https://stylerolan.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790146": [ { "ioc_value": "https://systemxperformance.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790147": [ { "ioc_value": "https://tasksreductionoffice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790148": [ { "ioc_value": "https://trindade.pe.gov.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790140": [ { "ioc_value": "https://shreeriddhisiddhijewellers.co.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790141": [ { "ioc_value": "https://slotpixxybet.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:04", "last_seen_utc": "2026-04-15 18:30:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790142": [ { "ioc_value": "https://soulswayhome.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:04", "last_seen_utc": "2026-04-15 18:30:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790143": [ { "ioc_value": "https://staging.theflooringmasters.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790144": [ { "ioc_value": "https://steep9.site.transip.me/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:04", "last_seen_utc": "2026-04-15 18:30:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790136": [ { "ioc_value": "https://saphiramusic.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790137": [ { "ioc_value": "https://saurabhsingh.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:03", "last_seen_utc": "2026-04-15 17:00:54", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790138": [ { "ioc_value": "https://seo1.bluehatmarketing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790139": [ { "ioc_value": "https://shoot2sellmls.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790135": [ { "ioc_value": "https://reyanshenterprisess.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:19:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790133": [ { "ioc_value": "https://radaresportivo.blog/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790134": [ { "ioc_value": "https://redesign.arrowedge.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790129": [ { "ioc_value": "https://orlandopressurewashingcompany.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790130": [ { "ioc_value": "https://peserta114-dm.karyakreasi.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790131": [ { "ioc_value": "https://promoresmisuzukibali.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790132": [ { "ioc_value": "https://qzconsultoresdeseguros.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790124": [ { "ioc_value": "https://menu.rovahotel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790125": [ { "ioc_value": "https://midlandyatra.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790126": [ { "ioc_value": "https://nutriequilibrio.cl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790127": [ { "ioc_value": "https://obat-lemahsyahwat.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790128": [ { "ioc_value": "https://omnicoresolutions.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790119": [ { "ioc_value": "https://mayespacepro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:55", "last_seen_utc": "2026-04-14 18:00:48", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790120": [ { "ioc_value": "https://menu-chezpapa.rovahotel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790121": [ { "ioc_value": "https://menu-lacasablu.rovahotel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790122": [ { "ioc_value": "https://menu-lapetitebrasserie.rovahotel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:55", "last_seen_utc": "2026-04-15 00:00:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790123": [ { "ioc_value": "https://menu-nocommentbar.rovahotel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790115": [ { "ioc_value": "https://m2e.digitalmindcareindia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790116": [ { "ioc_value": "https://mariaameliamontenegro.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790117": [ { "ioc_value": "https://max.upkodes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:54", "last_seen_utc": "2026-04-15 00:00:49", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790118": [ { "ioc_value": "https://maxmara.antaranganews.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790110": [ { "ioc_value": "https://kargoflowlogistics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790111": [ { "ioc_value": "https://kudeta.fm/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790112": [ { "ioc_value": "https://localtrustmoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790113": [ { "ioc_value": "https://lp.evdtechnology.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790114": [ { "ioc_value": "https://luluboxproapk.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790105": [ { "ioc_value": "https://hrent.ro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790106": [ { "ioc_value": "https://j4ugroups.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790107": [ { "ioc_value": "https://jetro.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790108": [ { "ioc_value": "https://joshaceconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790109": [ { "ioc_value": "https://jtctraders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790101": [ { "ioc_value": "https://holystica.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790102": [ { "ioc_value": "https://homerenovationconsultant.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790103": [ { "ioc_value": "https://hortivise.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790104": [ { "ioc_value": "https://hortivise.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790096": [ { "ioc_value": "https://hauka-ug.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790097": [ { "ioc_value": "https://heachang.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790098": [ { "ioc_value": "https://heatbymt.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790099": [ { "ioc_value": "https://hekimaautotyres.co.ke/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790100": [ { "ioc_value": "https://holol-t.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790091": [ { "ioc_value": "https://freetoolz.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790092": [ { "ioc_value": "https://fundafic.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790093": [ { "ioc_value": "https://gdut931.win/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790094": [ { "ioc_value": "https://glowmakeupacademy.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790095": [ { "ioc_value": "https://golfphysioclinic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790086": [ { "ioc_value": "https://ecommercegoods.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790087": [ { "ioc_value": "https://egypt24.top/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790088": [ { "ioc_value": "https://essenzacentroestetico.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790089": [ { "ioc_value": "https://feelnoor.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790090": [ { "ioc_value": "https://felix.dbmmgroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790085": [ { "ioc_value": "https://dublinhomecarellc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790083": [ { "ioc_value": "https://divineartz.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790084": [ { "ioc_value": "https://drraisonboone.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790078": [ { "ioc_value": "https://cloudgateitsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790079": [ { "ioc_value": "https://creacionesdyl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790080": [ { "ioc_value": "https://crownsecure.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790081": [ { "ioc_value": "https://dev.alhambra.app/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790082": [ { "ioc_value": "https://devcon.cd/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790073": [ { "ioc_value": "https://anduconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790074": [ { "ioc_value": "https://aromistiq.co.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790075": [ { "ioc_value": "https://artemcollection.obatone.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790076": [ { "ioc_value": "https://atscreensfl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790077": [ { "ioc_value": "https://clairesclassiccrafts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790068": [ { "ioc_value": "https://yellowstonelandscapesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790069": [ { "ioc_value": "https://yonweysnowexperience.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790070": [ { "ioc_value": "https://yuzhno-sahalinsk.xn----7sbbk0auidbf2b5a.xn--p1ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790071": [ { "ioc_value": "https://54.81.210.146/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790072": [ { "ioc_value": "https://aeroceptsgt.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790063": [ { "ioc_value": "https://trendora.cz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790064": [ { "ioc_value": "https://trustytravelnemt.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790065": [ { "ioc_value": "https://uld.ac.cd/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790066": [ { "ioc_value": "https://uwdierenarts.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790067": [ { "ioc_value": "https://vetromarketinggroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790058": [ { "ioc_value": "https://test.nayassia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790059": [ { "ioc_value": "https://thefullhousemedia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790060": [ { "ioc_value": "https://tinyexplorers1.wp-warriors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790061": [ { "ioc_value": "https://topbuyernyc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790062": [ { "ioc_value": "https://toronto.rmtclinic.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790053": [ { "ioc_value": "https://sterlingunion.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790054": [ { "ioc_value": "https://stg.dream-cyber.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790055": [ { "ioc_value": "https://studio360visuals.site/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790056": [ { "ioc_value": "https://svakdimoslevadeon.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790057": [ { "ioc_value": "https://taxisdublin.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790048": [ { "ioc_value": "https://snowberryfarm.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790049": [ { "ioc_value": "https://souravgoutamsharma.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790050": [ { "ioc_value": "https://stage.miranchotx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790051": [ { "ioc_value": "https://stage21.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790052": [ { "ioc_value": "https://staging.smartscheduler.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790043": [ { "ioc_value": "https://saurabhkhanna.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790044": [ { "ioc_value": "https://semperfimovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790045": [ { "ioc_value": "https://services.kkpower.com.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790046": [ { "ioc_value": "https://shadow-lights.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790047": [ { "ioc_value": "https://smartlivinghelp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790038": [ { "ioc_value": "https://roofinguponthamesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790039": [ { "ioc_value": "https://rudicamilleri.codexwizardssquad.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790040": [ { "ioc_value": "https://s1.freeconferencecall.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790041": [ { "ioc_value": "https://s2.freeconferencecall.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790042": [ { "ioc_value": "https://sakurion.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790035": [ { "ioc_value": "https://removal-packaging.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790036": [ { "ioc_value": "https://ridlanceseo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790037": [ { "ioc_value": "https://roadsidewrangler.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790030": [ { "ioc_value": "https://powertoimpact.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790031": [ { "ioc_value": "https://qualifiedtrainingsolutions.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790032": [ { "ioc_value": "https://railtalk.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790033": [ { "ioc_value": "https://realmovingmovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790034": [ { "ioc_value": "https://recruitme.quickfirmx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790025": [ { "ioc_value": "https://pinnaclebrit.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790026": [ { "ioc_value": "https://pixpro.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790027": [ { "ioc_value": "https://planet.radiantmtech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790028": [ { "ioc_value": "https://polnews24.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790029": [ { "ioc_value": "https://portcharlottemovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790020": [ { "ioc_value": "https://opvisite.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790021": [ { "ioc_value": "https://oscarf1320.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790022": [ { "ioc_value": "https://parkertours.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790023": [ { "ioc_value": "https://patrafoam.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790024": [ { "ioc_value": "https://pillar3.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790016": [ { "ioc_value": "https://nonprofit.oldrosetheater.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790017": [ { "ioc_value": "https://northjerseywigstudio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790018": [ { "ioc_value": "https://octawolf.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790019": [ { "ioc_value": "https://ontest.binduit.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790011": [ { "ioc_value": "https://myrvcoverage.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790012": [ { "ioc_value": "https://nayacrm.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790013": [ { "ioc_value": "https://naza24th.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790014": [ { "ioc_value": "https://new.khilkhil.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790015": [ { "ioc_value": "https://newtan777.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790006": [ { "ioc_value": "https://mariasoutopsicologa.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790007": [ { "ioc_value": "https://mascaroteixeira.adv.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790008": [ { "ioc_value": "https://mohakelite.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790009": [ { "ioc_value": "https://moneymadeinswitzerland.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790010": [ { "ioc_value": "https://monkeymkt.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790002": [ { "ioc_value": "https://luxcosmedix.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790003": [ { "ioc_value": "https://mail.compelling-evidence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790004": [ { "ioc_value": "https://mail.precosdemotos.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790005": [ { "ioc_value": "https://maltcasinom.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789997": [ { "ioc_value": "https://kayak-new.ivato.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789998": [ { "ioc_value": "https://kompleksikulla.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789999": [ { "ioc_value": "https://lacaverneguitare.titanswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790000": [ { "ioc_value": "https://leagroupbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1790001": [ { "ioc_value": "https://locksmith4u.inht-web.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789992": [ { "ioc_value": "https://huenemepetcare.skstechsolution.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789993": [ { "ioc_value": "https://iezie-online.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789994": [ { "ioc_value": "https://iguabagreen.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789995": [ { "ioc_value": "https://justandry.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789996": [ { "ioc_value": "https://justingreer.hhhosting.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789987": [ { "ioc_value": "https://hosts-to-hungary.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789988": [ { "ioc_value": "https://hosts-to-nicaragua.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789989": [ { "ioc_value": "https://hosts-to-slovakia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789990": [ { "ioc_value": "https://hosts-to-sweden.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789991": [ { "ioc_value": "https://houstonweddingvenues.telegramstaging.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789985": [ { "ioc_value": "https://hosts-to-elsalvador.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789986": [ { "ioc_value": "https://hosts-to-england.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789981": [ { "ioc_value": "https://herculesvipslotpg.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789982": [ { "ioc_value": "https://hosts-to-austria.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789983": [ { "ioc_value": "https://hosts-to-belgium.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789984": [ { "ioc_value": "https://hosts-to-dominicanrep.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789976": [ { "ioc_value": "https://gazilaboratories.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789977": [ { "ioc_value": "https://gkjunkcars.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789978": [ { "ioc_value": "https://glucoberry.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789979": [ { "ioc_value": "https://go.souqsavy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789980": [ { "ioc_value": "https://greenheartpipingnyc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789970": [ { "ioc_value": "https://flowerwalls.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789971": [ { "ioc_value": "https://fonetechlancaster.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789972": [ { "ioc_value": "https://fourpoint.hu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789973": [ { "ioc_value": "https://francotaboada.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789974": [ { "ioc_value": "https://freeconferencecall.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789975": [ { "ioc_value": "https://fysioiversen.dk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789965": [ { "ioc_value": "https://elitelandscapeservicesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789966": [ { "ioc_value": "https://elmaouid.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789967": [ { "ioc_value": "https://enterprise.freeconferencecall.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789968": [ { "ioc_value": "https://firstaidvolunteers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789969": [ { "ioc_value": "https://florencioalonso.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789960": [ { "ioc_value": "https://dpegdhanani.aigrowth360.io/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789961": [ { "ioc_value": "https://dra-raguirre.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789962": [ { "ioc_value": "https://eaglevpfund.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789963": [ { "ioc_value": "https://edgewatercompanions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789964": [ { "ioc_value": "https://elesconditedelatlante.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789955": [ { "ioc_value": "https://dandi.rs/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789956": [ { "ioc_value": "https://darioel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789957": [ { "ioc_value": "https://datcha-dates.com.tn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789958": [ { "ioc_value": "https://digitalmarketingservice.com.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789959": [ { "ioc_value": "https://digitalservice.blpwebtech.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789950": [ { "ioc_value": "https://configurateur.esa42.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789951": [ { "ioc_value": "https://conventionescoladem1.hospedagemdesites.ws/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789952": [ { "ioc_value": "https://cosmotopic.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789953": [ { "ioc_value": "https://credibly.sg/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789954": [ { "ioc_value": "https://cualixrealestate.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789945": [ { "ioc_value": "https://bradford.savasaachi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789946": [ { "ioc_value": "https://brandonlasso.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789947": [ { "ioc_value": "https://cdn.alfayha.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789948": [ { "ioc_value": "https://ceskapropiska.cz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789949": [ { "ioc_value": "https://circleoffriendsforkids.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789940": [ { "ioc_value": "https://bertrand.solas-conseil.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789941": [ { "ioc_value": "https://billing.sharksattech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789942": [ { "ioc_value": "https://blitzhireio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789943": [ { "ioc_value": "https://bluemountainschalet.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789944": [ { "ioc_value": "https://bocelligruppo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789935": [ { "ioc_value": "https://aucklandhotwater.devbuildpro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789936": [ { "ioc_value": "https://audeladuclimat.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789937": [ { "ioc_value": "https://bedrijfsdirectory.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789938": [ { "ioc_value": "https://benjolankecildileher.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789939": [ { "ioc_value": "https://berkshire-electric.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789930": [ { "ioc_value": "https://amici-di-pogrande.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789931": [ { "ioc_value": "https://annapharmacy.hhhosting.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789932": [ { "ioc_value": "https://antoniocastagnino.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789933": [ { "ioc_value": "https://armavir.xn----7sbbk0auidbf2b5a.xn--p1ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789934": [ { "ioc_value": "https://astrosukhh.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789925": [ { "ioc_value": "https://4dhair.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789926": [ { "ioc_value": "https://8171portalalerts.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789927": [ { "ioc_value": "https://aglimitless.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789928": [ { "ioc_value": "https://ahde.com.et/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789929": [ { "ioc_value": "https://alrakham.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789920": [ { "ioc_value": "https://yakutsk.xn----7sbbk0auidbf2b5a.xn--p1ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789921": [ { "ioc_value": "https://yandmgoods.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789922": [ { "ioc_value": "https://yaroslavl.xn----7sbbk0auidbf2b5a.xn--p1ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789923": [ { "ioc_value": "https://zukrhub.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789924": [ { "ioc_value": "https://1net.ro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789915": [ { "ioc_value": "https://top10pg.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789916": [ { "ioc_value": "https://ts-instalaciones.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789917": [ { "ioc_value": "https://unycomp.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789918": [ { "ioc_value": "https://vetchick.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789919": [ { "ioc_value": "https://virellimgmt.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789911": [ { "ioc_value": "https://thermal.reignmedia.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789912": [ { "ioc_value": "https://thesilentplayer.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789913": [ { "ioc_value": "https://theyardadviser.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789914": [ { "ioc_value": "https://timepiece.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789906": [ { "ioc_value": "https://taloustuki.fi/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789907": [ { "ioc_value": "https://tarozap.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789908": [ { "ioc_value": "https://taxireginaud-36.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789909": [ { "ioc_value": "https://templeofnjord.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789910": [ { "ioc_value": "https://theglag.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789901": [ { "ioc_value": "https://stayudaipur.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789902": [ { "ioc_value": "https://steengoedmetselwerken.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789903": [ { "ioc_value": "https://superatratamentos.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789904": [ { "ioc_value": "https://sweetheartsfm.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789905": [ { "ioc_value": "https://syrcamp.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789896": [ { "ioc_value": "https://stage8.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789897": [ { "ioc_value": "https://stagepixarsart.pixarsclients.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789898": [ { "ioc_value": "https://staging.savingprocy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789899": [ { "ioc_value": "https://stark.nasna.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789900": [ { "ioc_value": "https://starpropertiesmanagement.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789891": [ { "ioc_value": "https://sonubeautycollege.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789892": [ { "ioc_value": "https://springbrookbungalow.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789893": [ { "ioc_value": "https://srefrigeration.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789894": [ { "ioc_value": "https://stage1.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789895": [ { "ioc_value": "https://stage3.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789886": [ { "ioc_value": "https://sheikhmasud.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789887": [ { "ioc_value": "https://shgmart.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789888": [ { "ioc_value": "https://shs.6fd.mytemp.website/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789889": [ { "ioc_value": "https://shubh.hellonfc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789890": [ { "ioc_value": "https://sipsstrong.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789885": [ { "ioc_value": "https://seppiacultura.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789884": [ { "ioc_value": "https://seo.bluehatmarketing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789880": [ { "ioc_value": "https://schreinerei-schwaderer.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789881": [ { "ioc_value": "https://secureattached.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789882": [ { "ioc_value": "https://sedragaragedaytona6163.live-website.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789883": [ { "ioc_value": "https://sentrex.bluehat.hosting/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789875": [ { "ioc_value": "https://rovassisupply.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789876": [ { "ioc_value": "https://safespacesouthwest.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789877": [ { "ioc_value": "https://saladobatuque.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789878": [ { "ioc_value": "https://samanthaliangcakeartistry.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789879": [ { "ioc_value": "https://santoyofinancial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789870": [ { "ioc_value": "https://ranksfirst.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789871": [ { "ioc_value": "https://reardanathletics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789872": [ { "ioc_value": "https://renaproofficial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789873": [ { "ioc_value": "https://rodrigooliveiracontabil.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789874": [ { "ioc_value": "https://roofrenewfl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789866": [ { "ioc_value": "https://polkadotdp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789867": [ { "ioc_value": "https://projetorendadigital.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789868": [ { "ioc_value": "https://prostazin.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789869": [ { "ioc_value": "https://purikurniaayuvilla.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789860": [ { "ioc_value": "https://pasajpro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789861": [ { "ioc_value": "https://peepsville.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789862": [ { "ioc_value": "https://periville.hhhosting.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789863": [ { "ioc_value": "https://peruincadiscovery.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789864": [ { "ioc_value": "https://pillolews.altervista.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789865": [ { "ioc_value": "https://playflowdogtraining.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789855": [ { "ioc_value": "https://oakandcedarus.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789856": [ { "ioc_value": "https://onhive.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789857": [ { "ioc_value": "https://orbarquitetura.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789858": [ { "ioc_value": "https://outdoorsoundinstallation.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789859": [ { "ioc_value": "https://paintballplayers.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789850": [ { "ioc_value": "https://nejoommuwaileh.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789851": [ { "ioc_value": "https://netlinkss.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789852": [ { "ioc_value": "https://new.resifip.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789853": [ { "ioc_value": "https://nicebuilt.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789854": [ { "ioc_value": "https://notperctisperfect.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789845": [ { "ioc_value": "https://mriscanchennai.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789846": [ { "ioc_value": "https://mtlsqld.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789847": [ { "ioc_value": "https://mywindowsfactory.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789848": [ { "ioc_value": "https://namthipbong.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789849": [ { "ioc_value": "https://neat-interior.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789840": [ { "ioc_value": "https://mail.thonyphoneservice.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789841": [ { "ioc_value": "https://mannysceramictouch.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789842": [ { "ioc_value": "https://mattlimits.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789843": [ { "ioc_value": "https://medmode.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789844": [ { "ioc_value": "https://moneyborlest.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789835": [ { "ioc_value": "https://lotus365winloginid.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789836": [ { "ioc_value": "https://maedareinoodontologia.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789837": [ { "ioc_value": "https://mail.menj.pics/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789838": [ { "ioc_value": "https://mail.muslim-apologetic-borneo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789839": [ { "ioc_value": "https://mail.sentrex.bluehat.hosting/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789832": [ { "ioc_value": "https://linknet.co.ke/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789833": [ { "ioc_value": "https://locldn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789834": [ { "ioc_value": "https://lonemountainreinforcing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789827": [ { "ioc_value": "https://labelle.in10.cdn-alpha.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789828": [ { "ioc_value": "https://lapizza.re/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789829": [ { "ioc_value": "https://lesroutesdusenegal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789830": [ { "ioc_value": "https://leticiacrodrigues.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789831": [ { "ioc_value": "https://lilithlorian.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789822": [ { "ioc_value": "https://jooysutra.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789823": [ { "ioc_value": "https://jumpinhound.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789824": [ { "ioc_value": "https://k9cleanupusa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789825": [ { "ioc_value": "https://kettopluszegy.hu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789826": [ { "ioc_value": "https://kkg-wehofen.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789817": [ { "ioc_value": "https://javernpond.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789818": [ { "ioc_value": "https://jaybranch27.webcoreweb.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789819": [ { "ioc_value": "https://jeha-renting.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789820": [ { "ioc_value": "https://jmarcmedia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789821": [ { "ioc_value": "https://jobolympic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789812": [ { "ioc_value": "https://intercalat.ro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789813": [ { "ioc_value": "https://investingdoc.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789814": [ { "ioc_value": "https://isavelacreativa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789815": [ { "ioc_value": "https://itservice71.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789816": [ { "ioc_value": "https://jamesrodgersforcongress.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789808": [ { "ioc_value": "https://griotte-art.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789809": [ { "ioc_value": "https://hifreshbox.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789810": [ { "ioc_value": "https://hosts-to-paraguay.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789811": [ { "ioc_value": "https://ianisaacson.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789803": [ { "ioc_value": "https://gmarketingforyou.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789804": [ { "ioc_value": "https://godblessushandyman.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789805": [ { "ioc_value": "https://goldstartutoring.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789806": [ { "ioc_value": "https://graftools.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789807": [ { "ioc_value": "https://greenworks.pixarsclients.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789799": [ { "ioc_value": "https://gentle-mongoose.10web.me/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789800": [ { "ioc_value": "https://getshadowfight2modapk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789801": [ { "ioc_value": "https://giftgadgetsusa.shop/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789802": [ { "ioc_value": "https://glarchitectsdesign.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789794": [ { "ioc_value": "https://fishinginuruguay.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789795": [ { "ioc_value": "https://fixmybrands.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789796": [ { "ioc_value": "https://flovelclothing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789797": [ { "ioc_value": "https://foresightedtech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789798": [ { "ioc_value": "https://galvano.documentoeuropeu.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789790": [ { "ioc_value": "https://estudioipm.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789791": [ { "ioc_value": "https://expressivefloors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789792": [ { "ioc_value": "https://fastphotoscans.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789793": [ { "ioc_value": "https://fcfb.farbio.edu.bo/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789786": [ { "ioc_value": "https://embrs.ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789787": [ { "ioc_value": "https://equinoxmoney.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789788": [ { "ioc_value": "https://erossiconsultoria.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789789": [ { "ioc_value": "https://esteticaresende.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789785": [ { "ioc_value": "https://ellsworthmaritime.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789780": [ { "ioc_value": "https://duraflexpallets.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789781": [ { "ioc_value": "https://dz-travels.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789782": [ { "ioc_value": "https://easttechnicalstudio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789783": [ { "ioc_value": "https://edcare.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789784": [ { "ioc_value": "https://educationloansolution.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789775": [ { "ioc_value": "https://demo.goorangepay.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789776": [ { "ioc_value": "https://detroitmalestripper.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789777": [ { "ioc_value": "https://dev.wirmachenkfzgutachten.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789778": [ { "ioc_value": "https://diegopary.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789779": [ { "ioc_value": "https://dr-tamesha.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789770": [ { "ioc_value": "https://cxevolve2.titanswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789771": [ { "ioc_value": "https://daphney.onlinedemoserver8.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789772": [ { "ioc_value": "https://darkorange-ferret-449201.hostingersite.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789773": [ { "ioc_value": "https://delivery.atxsolution.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789774": [ { "ioc_value": "https://deltonamovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789765": [ { "ioc_value": "https://cornerstocolleges.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789766": [ { "ioc_value": "https://corsimotolugano.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789767": [ { "ioc_value": "https://craiglebo.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789768": [ { "ioc_value": "https://cridhac.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789769": [ { "ioc_value": "https://cubefire.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789760": [ { "ioc_value": "https://cherylsemere.wpvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789761": [ { "ioc_value": "https://chrisfrick.art/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789762": [ { "ioc_value": "https://cigarsandconversationsevents.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789763": [ { "ioc_value": "https://circlesecurity.mockupdomain.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789764": [ { "ioc_value": "https://clinicarex.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789755": [ { "ioc_value": "https://bushnaq.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789756": [ { "ioc_value": "https://camaintenance.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789757": [ { "ioc_value": "https://ccfarmbali.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789758": [ { "ioc_value": "https://center.absar.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789759": [ { "ioc_value": "https://chanzroyaltyfashion.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789750": [ { "ioc_value": "https://bigbaer.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789751": [ { "ioc_value": "https://bocorantogel-hariini.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789752": [ { "ioc_value": "https://bradisongroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789753": [ { "ioc_value": "https://britishcareercraft.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789754": [ { "ioc_value": "https://budgetindian.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789745": [ { "ioc_value": "https://authorstolookout4.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789746": [ { "ioc_value": "https://azimutelog.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789747": [ { "ioc_value": "https://barocci.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789748": [ { "ioc_value": "https://bdset-ictd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789749": [ { "ioc_value": "https://benjamesuk.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789742": [ { "ioc_value": "https://arlingtonmoversvirginia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789743": [ { "ioc_value": "https://arrowdots.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789744": [ { "ioc_value": "https://asmbosse.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789738": [ { "ioc_value": "https://angarsk.xn----7sbbk0auidbf2b5a.xn--p1ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789739": [ { "ioc_value": "https://aoglobalsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789740": [ { "ioc_value": "https://apextowingandrecoveryin.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789741": [ { "ioc_value": "https://aplusmovingandstorage.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789737": [ { "ioc_value": "https://ali20256.wp-warriors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:17:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789734": [ { "ioc_value": "https://agikali.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789735": [ { "ioc_value": "https://agrocietech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789736": [ { "ioc_value": "https://aidwithoutborders.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789729": [ { "ioc_value": "https://acnet.org.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789730": [ { "ioc_value": "https://adotapets.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789731": [ { "ioc_value": "https://aeromovingcolorado.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789732": [ { "ioc_value": "https://afasconstrucoes.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789733": [ { "ioc_value": "https://africheck.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789724": [ { "ioc_value": "https://35.207.233.108/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789725": [ { "ioc_value": "https://3btics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789726": [ { "ioc_value": "https://4tenergy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789727": [ { "ioc_value": "https://aaprepuk.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789728": [ { "ioc_value": "https://accurateremedies.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789718": [ { "ioc_value": "https://ultrahealthcaresolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789719": [ { "ioc_value": "https://vehicleshipping.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789720": [ { "ioc_value": "https://vendixperts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789721": [ { "ioc_value": "https://xxx18up.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789722": [ { "ioc_value": "https://ycazmoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789723": [ { "ioc_value": "https://1byte.cat/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789713": [ { "ioc_value": "https://tesco.chiphealth.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789714": [ { "ioc_value": "https://themuslimapologist.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789715": [ { "ioc_value": "https://touraqso.my.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789716": [ { "ioc_value": "https://trainingvista.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789717": [ { "ioc_value": "https://ugplogistics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789708": [ { "ioc_value": "https://stcloudmover.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789709": [ { "ioc_value": "https://tatirodriguesbiomedica.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789710": [ { "ioc_value": "https://tbtdesigner.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789711": [ { "ioc_value": "https://teaminfo.site/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789712": [ { "ioc_value": "https://ter-harkel.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789703": [ { "ioc_value": "https://stage13.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789704": [ { "ioc_value": "https://stage5.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789705": [ { "ioc_value": "https://stage6.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789706": [ { "ioc_value": "https://stage7.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789707": [ { "ioc_value": "https://staging.ceningandivers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789698": [ { "ioc_value": "https://sigitmuddikuncoro.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789699": [ { "ioc_value": "https://skal.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789700": [ { "ioc_value": "https://solar.ruiyasamaa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789701": [ { "ioc_value": "https://stage10.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789702": [ { "ioc_value": "https://stage12.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789693": [ { "ioc_value": "https://riodomedia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789694": [ { "ioc_value": "https://robertwilliamsmoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789695": [ { "ioc_value": "https://royaltyhubprinting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789696": [ { "ioc_value": "https://sandyvstamales.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789697": [ { "ioc_value": "https://saranifysportsacademy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789688": [ { "ioc_value": "https://podium.toftal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789689": [ { "ioc_value": "https://post.mysmartpros.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789690": [ { "ioc_value": "https://protal.agenciadn.net.pe/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789691": [ { "ioc_value": "https://puracarespecialisthospital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789692": [ { "ioc_value": "https://resourcingpartners.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789687": [ { "ioc_value": "https://pleasantontaxis.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789684": [ { "ioc_value": "https://oakmontdistribution.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789685": [ { "ioc_value": "https://optasia.hr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789686": [ { "ioc_value": "https://patyaexpressions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789680": [ { "ioc_value": "https://new65th.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789681": [ { "ioc_value": "https://newtanbet168.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789682": [ { "ioc_value": "https://nickvanhoegen.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789683": [ { "ioc_value": "https://nuq.czd.temporary.site/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789675": [ { "ioc_value": "https://medial-einklang.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789676": [ { "ioc_value": "https://melbournebuyeradvisory.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789677": [ { "ioc_value": "https://militarymovers.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789678": [ { "ioc_value": "https://my.cofeusa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789679": [ { "ioc_value": "https://myplace-cm.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789670": [ { "ioc_value": "https://mail.rembat.my/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789671": [ { "ioc_value": "https://mail.shimantohukushi.ac.jp/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789672": [ { "ioc_value": "https://mail.thegoldenliving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789673": [ { "ioc_value": "https://mail.totallyreferral.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789674": [ { "ioc_value": "https://mail.westcoastmarine.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789665": [ { "ioc_value": "https://kilimaniart.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789666": [ { "ioc_value": "https://lahixdigital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789667": [ { "ioc_value": "https://livecup.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789668": [ { "ioc_value": "https://loadrunnersmoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789669": [ { "ioc_value": "https://lrproductionmerch.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789660": [ { "ioc_value": "https://jarisklusenafbouwbedrijf.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789661": [ { "ioc_value": "https://jav24th.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789662": [ { "ioc_value": "https://jessicaassociates.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789663": [ { "ioc_value": "https://jurisimmoaveyron.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789664": [ { "ioc_value": "https://kalsilaw.bluehat.hosting/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789655": [ { "ioc_value": "https://hostess-italia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789656": [ { "ioc_value": "https://hosts-to-puertorico.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789657": [ { "ioc_value": "https://iaklegal.org.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789658": [ { "ioc_value": "https://icreatemystory.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789659": [ { "ioc_value": "https://integrityplacementnc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789650": [ { "ioc_value": "https://greybabyandchandlerfrances.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789651": [ { "ioc_value": "https://groenehandpost.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789652": [ { "ioc_value": "https://happydaysplaylondon.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789653": [ { "ioc_value": "https://happyhighlandscattle.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789654": [ { "ioc_value": "https://hortivise.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789645": [ { "ioc_value": "https://fmrvisa.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789646": [ { "ioc_value": "https://frisk-thomsen.dk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789647": [ { "ioc_value": "https://gamrock-ed.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789648": [ { "ioc_value": "https://gertlerlawoffice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789649": [ { "ioc_value": "https://gloryiwunor.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789640": [ { "ioc_value": "https://events.riazproperties.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789641": [ { "ioc_value": "https://exportstousa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789642": [ { "ioc_value": "https://fiftyminutesofsilence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789643": [ { "ioc_value": "https://fileadmin.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789644": [ { "ioc_value": "https://fitandfabulousforties.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789637": [ { "ioc_value": "https://ekohairsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789638": [ { "ioc_value": "https://erlebnisreisen.guru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789639": [ { "ioc_value": "https://estoutdoorliving.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789633": [ { "ioc_value": "https://drluislevel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789634": [ { "ioc_value": "https://dwiretna.tn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789635": [ { "ioc_value": "https://ec2-54-252-210-193.ap-southeast-2.compute.amazonaws.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789636": [ { "ioc_value": "https://einvoicesolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789628": [ { "ioc_value": "https://cusickmovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789629": [ { "ioc_value": "https://dev.npcautomotive.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789630": [ { "ioc_value": "https://devmanireiki.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789631": [ { "ioc_value": "https://digital-drive.ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789632": [ { "ioc_value": "https://divinni.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789623": [ { "ioc_value": "https://brandalcapital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789624": [ { "ioc_value": "https://cheapmovers.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789625": [ { "ioc_value": "https://chilevinoscolombia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789626": [ { "ioc_value": "https://cleanclimat.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789627": [ { "ioc_value": "https://corporativo.temaiken.org.ar/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789618": [ { "ioc_value": "https://beesandhoneymusic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789619": [ { "ioc_value": "https://befrankphotos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789620": [ { "ioc_value": "https://bensshopparis.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789621": [ { "ioc_value": "https://blog.medicsresearch.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789622": [ { "ioc_value": "https://blog.mysizejersey.is/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789614": [ { "ioc_value": "https://anandagenciesindia.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789615": [ { "ioc_value": "https://arobasemail.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789616": [ { "ioc_value": "https://asesores.alimacbienesraices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789617": [ { "ioc_value": "https://balanova.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789609": [ { "ioc_value": "https://3vtowinganddelivery.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789610": [ { "ioc_value": "https://aaronkreuter.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789611": [ { "ioc_value": "https://academy.ninjagroup.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789612": [ { "ioc_value": "https://afietadi.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789613": [ { "ioc_value": "https://agenciainformativaguerrero.mx/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789605": [ { "ioc_value": "https://vision-movie.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789606": [ { "ioc_value": "https://zain.riazproperties.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789607": [ { "ioc_value": "https://zainbeauty-sa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789608": [ { "ioc_value": "https://3.111.39.87/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789600": [ { "ioc_value": "https://techher.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789601": [ { "ioc_value": "https://torlasoftware.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789602": [ { "ioc_value": "https://tropsunset.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789603": [ { "ioc_value": "https://twodogfarms.wpengine.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789604": [ { "ioc_value": "https://velovisitparis.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789595": [ { "ioc_value": "https://scalewithzephyr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789596": [ { "ioc_value": "https://skytexsourcingbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789597": [ { "ioc_value": "https://stsn-calinka.ru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789598": [ { "ioc_value": "https://taubatecomputadores.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789599": [ { "ioc_value": "https://taxilivermore.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789591": [ { "ioc_value": "https://residentstoday.co.ke/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789592": [ { "ioc_value": "https://retire-incostarica.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789593": [ { "ioc_value": "https://sagem-group.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789594": [ { "ioc_value": "https://savasaachimarketingagency.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789587": [ { "ioc_value": "https://osg-dot-shituru.cd/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789588": [ { "ioc_value": "https://provoyants.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789589": [ { "ioc_value": "https://qiamom.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789590": [ { "ioc_value": "https://radiounomorrope.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789583": [ { "ioc_value": "https://new.wavtaxi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789584": [ { "ioc_value": "https://ngdevltd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789585": [ { "ioc_value": "https://ofertajota.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789586": [ { "ioc_value": "https://oliverliamsolicitor.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789578": [ { "ioc_value": "https://mcleodslater.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789579": [ { "ioc_value": "https://mdfconsig.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789580": [ { "ioc_value": "https://milestonetrading.live/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789581": [ { "ioc_value": "https://movingcompaniesmadisonwi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789582": [ { "ioc_value": "https://myvirtualai.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789573": [ { "ioc_value": "https://keswick-dev.flywheelsites.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789574": [ { "ioc_value": "https://kikecadena.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789575": [ { "ioc_value": "https://lphandyman.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789576": [ { "ioc_value": "https://luxlightingsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789577": [ { "ioc_value": "https://matsclinic.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789568": [ { "ioc_value": "https://izotermvaljevo.rs/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789569": [ { "ioc_value": "https://jargalterdene.mn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789570": [ { "ioc_value": "https://jjlawpartners.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789571": [ { "ioc_value": "https://johncohencoaching.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789572": [ { "ioc_value": "https://kariki.jp/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789564": [ { "ioc_value": "https://gesund-wohnen-gesund-leben.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789565": [ { "ioc_value": "https://guiaespiritualkhano.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789566": [ { "ioc_value": "https://hosts-to-poland.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789567": [ { "ioc_value": "https://ipac2-0.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789562": [ { "ioc_value": "https://fahmy.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789563": [ { "ioc_value": "https://firefmstlucia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789556": [ { "ioc_value": "https://digitaldistribution.ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789557": [ { "ioc_value": "https://dingleydellestate.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789558": [ { "ioc_value": "https://diversemindsuccess.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789559": [ { "ioc_value": "https://divinehealthcaresvc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789560": [ { "ioc_value": "https://ebuydepot.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789561": [ { "ioc_value": "https://emporiodigital.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789552": [ { "ioc_value": "https://costa-blanca-apartment.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789553": [ { "ioc_value": "https://creditnex.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789554": [ { "ioc_value": "https://ddwaterfrontproperties.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789555": [ { "ioc_value": "https://dev-localhost6312.pantheonsite.io/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789547": [ { "ioc_value": "https://brighttrackllc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789548": [ { "ioc_value": "https://chairmartbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789549": [ { "ioc_value": "https://cinema4you.cat/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789550": [ { "ioc_value": "https://cleandippool.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789551": [ { "ioc_value": "https://cleanspace.com.na/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789542": [ { "ioc_value": "https://bgdatabuilders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789543": [ { "ioc_value": "https://blago-qr.ru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789544": [ { "ioc_value": "https://blog.israkey.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789545": [ { "ioc_value": "https://blog.takarafune.co.jp/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789546": [ { "ioc_value": "https://brgplanning.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789537": [ { "ioc_value": "https://auggieeats.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789538": [ { "ioc_value": "https://autodrivetrafikkskole.no/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789539": [ { "ioc_value": "https://avrupabet.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789540": [ { "ioc_value": "https://axisconstruction.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789541": [ { "ioc_value": "https://bencrumpsocialjustice.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789532": [ { "ioc_value": "https://agentstvo.com.ua/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789533": [ { "ioc_value": "https://americanmovers.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789534": [ { "ioc_value": "https://amigosdestramilano.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789535": [ { "ioc_value": "https://angyalburoservice.at/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789536": [ { "ioc_value": "https://auei.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789528": [ { "ioc_value": "https://viaserenis.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789529": [ { "ioc_value": "https://acmcartingct.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789530": [ { "ioc_value": "https://acorntreesandlandscapesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789531": [ { "ioc_value": "https://agentofbeauty.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789523": [ { "ioc_value": "https://str-chiptuning.cz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789524": [ { "ioc_value": "https://talleresmartinezjavea.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789525": [ { "ioc_value": "https://transformationhouse.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789526": [ { "ioc_value": "https://tritontowingllc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789527": [ { "ioc_value": "https://verticalmedia.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789519": [ { "ioc_value": "https://soltechengenharia.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789520": [ { "ioc_value": "https://soluzionienergetiche.one/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789521": [ { "ioc_value": "https://spauldingdeconstlouis.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789522": [ { "ioc_value": "https://srv1057220.hstgr.cloud/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789514": [ { "ioc_value": "https://second.menu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789515": [ { "ioc_value": "https://shfjad.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789516": [ { "ioc_value": "https://shmuelcohen.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789517": [ { "ioc_value": "https://sippinservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789518": [ { "ioc_value": "https://smarthealthplans.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789510": [ { "ioc_value": "https://saisio.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789511": [ { "ioc_value": "https://sampleone.webdexo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789512": [ { "ioc_value": "https://saryaa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789513": [ { "ioc_value": "https://sdmtoursandtravels.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789505": [ { "ioc_value": "https://rentscootermotorbikebangkok.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789506": [ { "ioc_value": "https://reports.socheers.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789507": [ { "ioc_value": "https://rnbuiltinappliances.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789508": [ { "ioc_value": "https://royalindiatrails.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789509": [ { "ioc_value": "https://safe.encylife.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789501": [ { "ioc_value": "https://radioondasdelriomayo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789502": [ { "ioc_value": "https://raquelbarufaldi.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789503": [ { "ioc_value": "https://regardfengshui.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789504": [ { "ioc_value": "https://relookingindia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789496": [ { "ioc_value": "https://panouradiant.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789497": [ { "ioc_value": "https://pfnfinance.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789498": [ { "ioc_value": "https://poljooprema.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789499": [ { "ioc_value": "https://ptepower4132.live-website.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789500": [ { "ioc_value": "https://qadrizaiqahaleem.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789491": [ { "ioc_value": "https://operacionreciclaje.sigfito.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789492": [ { "ioc_value": "https://ouranosodysea.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789493": [ { "ioc_value": "https://outdoorlightingstudio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789494": [ { "ioc_value": "https://pachecosementes.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789495": [ { "ioc_value": "https://pacificlogistic.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789486": [ { "ioc_value": "https://nineguardians.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789487": [ { "ioc_value": "https://njpave.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789488": [ { "ioc_value": "https://nyresearch.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789489": [ { "ioc_value": "rlovrqd.mor5laxis.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:15:42", "last_seen_utc": "2026-04-14 13:17:10", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789490": [ { "ioc_value": "https://obatflekhitam.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789484": [ { "ioc_value": "https://near-way.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789485": [ { "ioc_value": "https://neelaminfrateq.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789480": [ { "ioc_value": "https://motel-stovrela.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789481": [ { "ioc_value": "https://movingcompanypalmdale.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789482": [ { "ioc_value": "https://msenterprises6631.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789483": [ { "ioc_value": "https://murreetraders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789475": [ { "ioc_value": "https://mathalalnish.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789476": [ { "ioc_value": "https://meditateanytime.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789477": [ { "ioc_value": "https://migueldigital.site/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789478": [ { "ioc_value": "https://miku.co.ke/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789479": [ { "ioc_value": "https://mind.ba/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789470": [ { "ioc_value": "https://mail.sidneymiranda.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789471": [ { "ioc_value": "https://mandarabali.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789472": [ { "ioc_value": "https://manickamthiru.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789473": [ { "ioc_value": "https://marketing-mavericks.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789474": [ { "ioc_value": "https://martialnovalis.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789465": [ { "ioc_value": "https://lolasfashionlibrary.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789466": [ { "ioc_value": "https://lp.yecom.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789467": [ { "ioc_value": "https://lubnainteriorsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789468": [ { "ioc_value": "https://machupicchufox.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789469": [ { "ioc_value": "https://mail.androidevi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789461": [ { "ioc_value": "https://laguerriere.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789462": [ { "ioc_value": "https://legacycareadvertising.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789463": [ { "ioc_value": "https://lightspeeddata.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789464": [ { "ioc_value": "https://liveonweb.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789456": [ { "ioc_value": "https://jmdrenov.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789457": [ { "ioc_value": "https://jointpainmds.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789458": [ { "ioc_value": "https://julesscowcroft.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789459": [ { "ioc_value": "https://kulturformidler.no/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789460": [ { "ioc_value": "https://lacompaniahostal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789451": [ { "ioc_value": "https://indulgediscreetly.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789452": [ { "ioc_value": "https://islam-canada.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789453": [ { "ioc_value": "https://jchristmanpainting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789454": [ { "ioc_value": "https://jellygamatgoldseacucumber.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789455": [ { "ioc_value": "https://jerizeguesthome.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789447": [ { "ioc_value": "https://hamzaai.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789448": [ { "ioc_value": "https://handyhaulersmoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789449": [ { "ioc_value": "https://headley.staging.mosierdata.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789450": [ { "ioc_value": "https://humusliquido.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789442": [ { "ioc_value": "https://getstoken.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789443": [ { "ioc_value": "https://golden-nutritions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789444": [ { "ioc_value": "https://gov.flstudios.website/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789445": [ { "ioc_value": "https://gtechict.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789446": [ { "ioc_value": "https://gullivergaragedoors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789437": [ { "ioc_value": "https://federicodelmonaco.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789438": [ { "ioc_value": "https://fightfactory.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789439": [ { "ioc_value": "https://flmmjdr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789440": [ { "ioc_value": "https://freedomdetective.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789441": [ { "ioc_value": "https://funfoostore.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789436": [ { "ioc_value": "https://fazu50anos.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789433": [ { "ioc_value": "https://executivebitesbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789434": [ { "ioc_value": "https://falstaffstiftelsen.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789435": [ { "ioc_value": "https://fancyhouselk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789430": [ { "ioc_value": "https://ecosmartrevamp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789431": [ { "ioc_value": "https://escueladetendencias.kikecadena.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789432": [ { "ioc_value": "https://ethekeconnect.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789427": [ { "ioc_value": "https://dkroofingandbuildingltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789428": [ { "ioc_value": "https://drsilvi.ro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789429": [ { "ioc_value": "https://dustlandexpress.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789424": [ { "ioc_value": "https://davisonbooks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789425": [ { "ioc_value": "https://depodal.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789426": [ { "ioc_value": "https://digitalbazaar.site/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789421": [ { "ioc_value": "https://clickfast.io/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789422": [ { "ioc_value": "https://cmr.sbalott.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789423": [ { "ioc_value": "https://d7.tech-code.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789419": [ { "ioc_value": "https://chiabeatslife.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789420": [ { "ioc_value": "https://cjklawncare.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789415": [ { "ioc_value": "https://buktijpilmu.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789416": [ { "ioc_value": "https://carlutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789417": [ { "ioc_value": "https://charmprodutos.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789418": [ { "ioc_value": "https://chetanpatnaik.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789412": [ { "ioc_value": "https://biensoxedinhdanh.com.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789413": [ { "ioc_value": "https://bisp8171news.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789414": [ { "ioc_value": "https://blog.helloparalegal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789409": [ { "ioc_value": "https://batuqueros.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789410": [ { "ioc_value": "https://bentonlawson.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789411": [ { "ioc_value": "https://bgberlin.com.mx/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789406": [ { "ioc_value": "https://auscholars.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789407": [ { "ioc_value": "https://baking-tales.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789408": [ { "ioc_value": "https://balkanrefugeenetwork.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789403": [ { "ioc_value": "https://andreamaverino.com.uy/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789404": [ { "ioc_value": "https://app-altr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789405": [ { "ioc_value": "https://atlaerial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789401": [ { "ioc_value": "https://aisporttipster.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789402": [ { "ioc_value": "https://allcountiesroofingltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789398": [ { "ioc_value": "https://aflarellc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789399": [ { "ioc_value": "https://airxpresscleaning.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789400": [ { "ioc_value": "https://aisonggeneration.absarmujaddidi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789395": [ { "ioc_value": "https://ab000111.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789396": [ { "ioc_value": "https://abcpressurewashingorlando.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789397": [ { "ioc_value": "https://academy.orionseg.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789393": [ { "ioc_value": "https://1stclassmovingtn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789394": [ { "ioc_value": "https://247garagedoorrepairs.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 13:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789392": [ { "ioc_value": "arkflux7is.mor5laxis.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:09:50", "last_seen_utc": "2026-04-14 13:10:19", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789391": [ { "ioc_value": "road5-field.mor5laxis.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 13:04:28", "last_seen_utc": "2026-04-14 13:06:08", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789390": [ { "ioc_value": "sssjhvycytjnjoo.cn", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-14 13:03:43", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/47ff219e2ac2ecabdb035ebf98a7d7b2e91b8488f8351958deb1e06428550c25/", "tags": "RAT,ValleyRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1789389": [ { "ioc_value": "qwesxzxngtf.cn", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-14 12:59:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/07777df44654c84f4cf407d3338189d1c25e5e9f52d1df7c7603b430d7fc18f0/", "tags": "RAT,ValleyRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1789388": [ { "ioc_value": "95.40.209.127:8880", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.valley_rat", "malware_alias": "Winos", "malware_printable": "ValleyRAT", "first_seen_utc": "2026-04-14 12:59:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/07777df44654c84f4cf407d3338189d1c25e5e9f52d1df7c7603b430d7fc18f0/", "tags": "RAT,ValleyRAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1789387": [ { "ioc_value": "quormeshar.qul4xorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:58:55", "last_seen_utc": "2026-04-14 13:01:28", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789385": [ { "ioc_value": "172.235.189.70:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-14 12:54:50", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1789386": [ { "ioc_value": "quor-tidear.qul4xorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:53:07", "last_seen_utc": "2026-04-14 12:55:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "1", "reporter": "ttakvam" } ], "1789384": [ { "ioc_value": "fastroute661.duckdns.org", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-14 12:50:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/589451cb37604823b4e83b230fa89c2cb991657b322aaa761011e1b39d67f1ac/", "tags": "remcos", "anonymous": "0", "reporter": "abuse_ch" } ], "1789383": [ { "ioc_value": "q1tnk.qul4xorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:47:16", "last_seen_utc": "2026-04-14 12:49:33", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789382": [ { "ioc_value": "triforgea.qul4xorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:41:48", "last_seen_utc": "2026-04-14 12:43:48", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789381": [ { "ioc_value": "rc3ba.qul4xorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:35:59", "last_seen_utc": "2026-04-14 12:38:09", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1788635": [ { "ioc_value": "zyro-aim-pro.base44.app", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "unknown", "malware_alias": null, "malware_printable": "Unknown malware", "first_seen_utc": "2026-04-14 12:31:22", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "RAT,SilentNet", "anonymous": "0", "reporter": "burger" } ], "1788661": [ { "ioc_value": "https://nexvoid.top/auth/legacy-controller.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-14 12:31:22", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116402976542803710", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1788662": [ { "ioc_value": "nexvoid.top", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-14 12:31:22", "last_seen_utc": "2026-04-14 12:08:22", "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116402976542803710", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1788665": [ { "ioc_value": "https://nexvoid.top/auth/legacy-sessionstore.php", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-14 12:31:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116402976542803710", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1788669": [ { "ioc_value": "https://nexvoid.top/auth/alias-script.js", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "js.smartapesg", "malware_alias": "HANEYMANEY,ZPHP", "malware_printable": "SmartApeSG", "first_seen_utc": "2026-04-14 12:31:20", "last_seen_utc": null, "confidence_level": 100, "is_compromised": true, "reference": "https://infosec.exchange/@monitorsg/116402976542803710", "tags": "SmartApeSG", "anonymous": "0", "reporter": "monitorsg" } ], "1789380": [ { "ioc_value": "cmvpokng.qul4xorin.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:30:52", "last_seen_utc": "2026-04-14 12:32:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789379": [ { "ioc_value": "freigoak.norxelav.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:25:12", "last_seen_utc": "2026-04-14 12:27:50", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789377": [ { "ioc_value": "https://yoothlab.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789378": [ { "ioc_value": "https://yourmitzvah.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789372": [ { "ioc_value": "https://vaachiregalia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:40", "last_seen_utc": "2026-04-15 19:00:48", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789373": [ { "ioc_value": "https://viccidinivillas.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789374": [ { "ioc_value": "https://visaclima.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789375": [ { "ioc_value": "https://xn--eugeniopea-19a.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789376": [ { "ioc_value": "https://yetundemedia.ug/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789368": [ { "ioc_value": "https://training.littleraysaba.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789369": [ { "ioc_value": "https://twcgroupusa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789370": [ { "ioc_value": "https://univerfinder.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:39", "last_seen_utc": "2026-04-15 19:00:48", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789371": [ { "ioc_value": "https://urinyoglobal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789362": [ { "ioc_value": "https://taskauro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789363": [ { "ioc_value": "https://tasleek-elekhlas.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789364": [ { "ioc_value": "https://techbahiasistemas.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789365": [ { "ioc_value": "https://tecnometalindustrias.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789366": [ { "ioc_value": "https://thescrubclubatl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789367": [ { "ioc_value": "https://tmen.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789357": [ { "ioc_value": "https://stage4.fusiondev.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789358": [ { "ioc_value": "https://staging.crossfitbondi.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789359": [ { "ioc_value": "https://staging.mcarterauto.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789360": [ { "ioc_value": "https://stance-japan.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789361": [ { "ioc_value": "https://studio-la.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:37", "last_seen_utc": "2026-04-15 19:00:48", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789352": [ { "ioc_value": "https://rockstone16.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:36", "last_seen_utc": "2026-04-15 19:00:48", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789353": [ { "ioc_value": "https://saudimauritania.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789354": [ { "ioc_value": "https://sillaeuropa.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789355": [ { "ioc_value": "https://smartexp.sa/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789356": [ { "ioc_value": "https://solar-seo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789347": [ { "ioc_value": "https://qualityplus1.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789348": [ { "ioc_value": "https://rafaelabreu.mx/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789349": [ { "ioc_value": "https://rebekahgabriellebooks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789350": [ { "ioc_value": "https://redukproperty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:35", "last_seen_utc": "2026-04-15 19:00:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789351": [ { "ioc_value": "https://rianaambarsari.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789342": [ { "ioc_value": "https://nmv-contruction.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789343": [ { "ioc_value": "https://pilarmedina.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789344": [ { "ioc_value": "https://pittsburghpamobilenotaryservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:34", "last_seen_utc": "2026-04-14 18:00:48", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789345": [ { "ioc_value": "https://playasurparadise.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:34", "last_seen_utc": "2026-04-15 19:00:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789346": [ { "ioc_value": "https://purpleclone.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789337": [ { "ioc_value": "https://nanosystem.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789338": [ { "ioc_value": "https://new.accountingcrunchers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:33", "last_seen_utc": "2026-04-15 19:00:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789339": [ { "ioc_value": "https://newpathrelief.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:33", "last_seen_utc": "2026-04-15 19:00:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789340": [ { "ioc_value": "https://newrisebuys.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789341": [ { "ioc_value": "https://newtanslot.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:33", "last_seen_utc": "2026-04-15 19:00:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789332": [ { "ioc_value": "https://marketifyagency.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789333": [ { "ioc_value": "https://medusa18.xyz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789334": [ { "ioc_value": "https://moducontainers.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789335": [ { "ioc_value": "https://morganknights.savasaachimarketingagency.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789336": [ { "ioc_value": "https://nadadefogo.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789331": [ { "ioc_value": "https://madhushreeinc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:31", "last_seen_utc": "2026-04-14 18:00:48", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789329": [ { "ioc_value": "https://lkexcellence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789330": [ { "ioc_value": "https://luppyboutique.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:26", "last_seen_utc": "2026-04-15 19:00:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789324": [ { "ioc_value": "https://jarotmw.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789325": [ { "ioc_value": "https://jensoswald.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789326": [ { "ioc_value": "https://jobs.veebenjamin.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789327": [ { "ioc_value": "https://killershirts.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789328": [ { "ioc_value": "https://krisallys-medias.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789319": [ { "ioc_value": "https://housesellershub.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789320": [ { "ioc_value": "https://hwhmarketing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789321": [ { "ioc_value": "https://ianvance.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789322": [ { "ioc_value": "https://intranet.csoftintl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789323": [ { "ioc_value": "https://islamiceconomist.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789314": [ { "ioc_value": "https://happymovershomestead.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789315": [ { "ioc_value": "https://hardmoney-411.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789316": [ { "ioc_value": "https://heywoodmount.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789317": [ { "ioc_value": "https://hofferplastics.yourdevelopmentlink.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789318": [ { "ioc_value": "https://horizonbridgeinsurance.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789308": [ { "ioc_value": "https://fiscapro.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789309": [ { "ioc_value": "https://fogiprom.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789310": [ { "ioc_value": "https://forextradingtime.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789311": [ { "ioc_value": "https://futurearch.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789312": [ { "ioc_value": "https://globalfugitives.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789313": [ { "ioc_value": "https://goseychelles.travel/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789303": [ { "ioc_value": "https://estetika-okna.ru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789304": [ { "ioc_value": "https://example4.fastgroupltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789305": [ { "ioc_value": "https://fame2saoutboard.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789306": [ { "ioc_value": "https://fastcarrecoverylondon.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789307": [ { "ioc_value": "https://fcfdistribuidora.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789298": [ { "ioc_value": "https://ejecutivoblackcar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789299": [ { "ioc_value": "https://emiratestechzone.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789300": [ { "ioc_value": "https://empirejaynyc.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789301": [ { "ioc_value": "https://epoksizeminkaplamalar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789302": [ { "ioc_value": "https://espoirformulations.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789293": [ { "ioc_value": "https://dali.house/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789294": [ { "ioc_value": "https://dawatt.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789295": [ { "ioc_value": "https://dreemfactory.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789296": [ { "ioc_value": "https://eco-led-france.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789297": [ { "ioc_value": "https://ecom-1.innovate-ithub.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789288": [ { "ioc_value": "https://chefricharddiabeticdeserts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789289": [ { "ioc_value": "https://chiropractornearmela.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789290": [ { "ioc_value": "https://cimacontractors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789291": [ { "ioc_value": "https://cloudaccounting.pakistanfrontier.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789292": [ { "ioc_value": "https://consulting.spiderhuntstechnologies.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789282": [ { "ioc_value": "https://ampmsamedaylogistics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789283": [ { "ioc_value": "https://arnavcomputer.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789284": [ { "ioc_value": "https://bmcitizens.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789285": [ { "ioc_value": "https://bostongaragedoorrepairman.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789286": [ { "ioc_value": "https://carebridgeteam.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789287": [ { "ioc_value": "https://chadbond928.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789281": [ { "ioc_value": "https://amjconsultancy.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789280": [ { "ioc_value": "https://almazibuild.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789275": [ { "ioc_value": "https://yorka.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789276": [ { "ioc_value": "https://203411.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789277": [ { "ioc_value": "https://afterplay.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789278": [ { "ioc_value": "https://alia-nails.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789279": [ { "ioc_value": "https://allblindslex.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789269": [ { "ioc_value": "https://thrive365ventures.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789270": [ { "ioc_value": "https://transferencia-termica.com.mx/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789271": [ { "ioc_value": "https://travelnow.live/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789272": [ { "ioc_value": "https://ttmedicalusa.skstechsolution.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789273": [ { "ioc_value": "https://veluwheels.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789274": [ { "ioc_value": "https://yashadafoods.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789264": [ { "ioc_value": "https://supplion.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789265": [ { "ioc_value": "https://sweetcarolinedesserts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789266": [ { "ioc_value": "https://tayaubeachfront.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789267": [ { "ioc_value": "https://theeconomiccloset.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789268": [ { "ioc_value": "https://themagmoment.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789259": [ { "ioc_value": "https://shabbatmealsdelivered.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789260": [ { "ioc_value": "https://shop.digitaljewelry.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789261": [ { "ioc_value": "https://sofiabosio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789262": [ { "ioc_value": "https://sokokeconservatory.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789263": [ { "ioc_value": "https://studio3ray.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789254": [ { "ioc_value": "https://playbro.ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789255": [ { "ioc_value": "https://projetorendadigital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789256": [ { "ioc_value": "https://qpr.da3.myftpupload.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789257": [ { "ioc_value": "https://repro.reproproject.com.my/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789258": [ { "ioc_value": "https://royalkimons.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789249": [ { "ioc_value": "https://odettelafrance.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789250": [ { "ioc_value": "https://onepoundhospital.org.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789251": [ { "ioc_value": "https://pcsolutionkannauj.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789252": [ { "ioc_value": "https://penzion-dinda.sk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789253": [ { "ioc_value": "https://pingodegentejundiai.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789244": [ { "ioc_value": "https://menj.pics/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789245": [ { "ioc_value": "https://migen.ph/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789246": [ { "ioc_value": "https://mindspi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789247": [ { "ioc_value": "https://mw-test.website/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789248": [ { "ioc_value": "https://niyatt.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789239": [ { "ioc_value": "https://legalrankers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789240": [ { "ioc_value": "https://luizbarsi.com.peqified.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789241": [ { "ioc_value": "https://magicgardens.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789242": [ { "ioc_value": "https://makethatcount.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789243": [ { "ioc_value": "https://masudaskitchen.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789237": [ { "ioc_value": "https://knowtanzaniatours.co.tz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789238": [ { "ioc_value": "https://lashbou.pro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789236": [ { "ioc_value": "https://klinikhospital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789231": [ { "ioc_value": "https://italian-language.biz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789232": [ { "ioc_value": "https://j2kwastesolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789233": [ { "ioc_value": "https://joesmovingmiami.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789234": [ { "ioc_value": "https://jpgequity.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789235": [ { "ioc_value": "https://kk.linkuma.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:18:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789230": [ { "ioc_value": "https://ipl2026indibet.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789226": [ { "ioc_value": "https://holtoncars.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789227": [ { "ioc_value": "https://idealdecore.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789228": [ { "ioc_value": "https://indieviewtv.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789229": [ { "ioc_value": "https://integraclo.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789221": [ { "ioc_value": "https://hair.hhhosting.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789222": [ { "ioc_value": "https://hairssentialstudio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789223": [ { "ioc_value": "https://hangerspro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789224": [ { "ioc_value": "https://hariomspecialityhospital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789225": [ { "ioc_value": "https://hashtag-raw.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789215": [ { "ioc_value": "https://elegancenterprise.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789216": [ { "ioc_value": "https://euro-btp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789217": [ { "ioc_value": "https://exoticcarsrental.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789218": [ { "ioc_value": "https://flowone.co.il/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789219": [ { "ioc_value": "https://gerrardsroofingandgutteringltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789220": [ { "ioc_value": "https://grupo2.miuni.kids/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789210": [ { "ioc_value": "https://cpr-can.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789211": [ { "ioc_value": "https://cronosal.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789212": [ { "ioc_value": "https://curatrading.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789213": [ { "ioc_value": "https://dmgautomoviles.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789214": [ { "ioc_value": "https://ecoaura.pe/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789205": [ { "ioc_value": "https://brandriteglobal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789206": [ { "ioc_value": "https://btm.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789207": [ { "ioc_value": "https://career.pearlchemistgroup.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789208": [ { "ioc_value": "https://celebritysummits.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789209": [ { "ioc_value": "https://cosmo.planeta.ua/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789200": [ { "ioc_value": "https://bestplumbercy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789201": [ { "ioc_value": "https://bigapplepestnyc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789202": [ { "ioc_value": "https://blog.beemove.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789203": [ { "ioc_value": "https://bodybydre.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789204": [ { "ioc_value": "https://bostonbservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789195": [ { "ioc_value": "https://arabe.qa/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789196": [ { "ioc_value": "https://avjapanxxx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789197": [ { "ioc_value": "https://ayaskalive.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789198": [ { "ioc_value": "https://bankruptcyhk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789199": [ { "ioc_value": "https://befamoussite.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789190": [ { "ioc_value": "https://adilsonaguiar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789191": [ { "ioc_value": "https://aficomtech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789192": [ { "ioc_value": "https://airfiltration.com.mx/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789193": [ { "ioc_value": "https://alibabasauce.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789194": [ { "ioc_value": "https://americanautotransportation.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789185": [ { "ioc_value": "https://visa360.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789186": [ { "ioc_value": "https://vptscope.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789187": [ { "ioc_value": "https://1doball.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789188": [ { "ioc_value": "https://abar.systems/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789189": [ { "ioc_value": "https://academiecmm.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789182": [ { "ioc_value": "https://tkkl.nz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789183": [ { "ioc_value": "https://tusmoconnects.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789184": [ { "ioc_value": "https://velovend.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789181": [ { "ioc_value": "https://thinkana.com.ar/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789176": [ { "ioc_value": "https://svepropertyservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789177": [ { "ioc_value": "https://thebakersdaughter.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789178": [ { "ioc_value": "https://thedigitalheloc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789179": [ { "ioc_value": "https://thetritonsociety.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789180": [ { "ioc_value": "https://thevendettagroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789171": [ { "ioc_value": "https://sisglob.com.mx/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789172": [ { "ioc_value": "https://smartkidnetwork.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789173": [ { "ioc_value": "https://soft-project.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789174": [ { "ioc_value": "https://spo.digibord-shop.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789175": [ { "ioc_value": "https://styledsoulseries.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789166": [ { "ioc_value": "https://recoveryrak.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789167": [ { "ioc_value": "https://resources.leadgenapp.io/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789168": [ { "ioc_value": "https://sandhurestaurants.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789169": [ { "ioc_value": "https://sekisui.reignmedia.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789170": [ { "ioc_value": "https://signsexpress.silvertechconsultants.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789161": [ { "ioc_value": "https://offer.bisoninsulation.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789162": [ { "ioc_value": "https://outdoorlightingmiami.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789163": [ { "ioc_value": "https://papertrail.co.il/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789164": [ { "ioc_value": "https://pavecolorado.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789165": [ { "ioc_value": "https://picsofficial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789156": [ { "ioc_value": "https://neodigitalagencia.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789157": [ { "ioc_value": "https://new.magneticmediatv.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789158": [ { "ioc_value": "https://nexusglobaluniversity.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789159": [ { "ioc_value": "https://nightanddaylimpezas.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789160": [ { "ioc_value": "https://nongnoi.chainat.police.go.th/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789150": [ { "ioc_value": "https://levicpt.webcoreweb.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789151": [ { "ioc_value": "https://lorocafe.rs/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789152": [ { "ioc_value": "https://montresorspa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789153": [ { "ioc_value": "https://mozziart.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789154": [ { "ioc_value": "https://mta.my/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789155": [ { "ioc_value": "https://my.embeds.top/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789145": [ { "ioc_value": "https://kaoru-tanaka.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789146": [ { "ioc_value": "https://kishuaccessories.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789147": [ { "ioc_value": "https://klassicsoccer.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789148": [ { "ioc_value": "https://kustantiblogs.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789149": [ { "ioc_value": "https://laaf2017.wpvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789140": [ { "ioc_value": "https://importadorasanchezmontoya.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789141": [ { "ioc_value": "https://inovinconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789142": [ { "ioc_value": "https://interativavisual.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789143": [ { "ioc_value": "https://jardineiratour.store/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789144": [ { "ioc_value": "https://kairoschristianresourcecenter.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789135": [ { "ioc_value": "https://gplpropertyservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789136": [ { "ioc_value": "https://hanzelova.gunslingers.sk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789137": [ { "ioc_value": "https://hosts-to-switzerland.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789138": [ { "ioc_value": "https://huraira.riazproperties.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789139": [ { "ioc_value": "https://ibdistributions.ie/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789132": [ { "ioc_value": "https://fbgolv.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789133": [ { "ioc_value": "https://foreconomicjustice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789134": [ { "ioc_value": "https://gomberg.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789131": [ { "ioc_value": "https://faithassociados.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789126": [ { "ioc_value": "https://dhanmondieidgahmosque.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789127": [ { "ioc_value": "https://dservinc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789128": [ { "ioc_value": "https://dsgroupco.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789129": [ { "ioc_value": "https://dtale.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789130": [ { "ioc_value": "https://dukeofribs.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789121": [ { "ioc_value": "https://centrifugeugandalimited.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789122": [ { "ioc_value": "https://childrenofgaza.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789123": [ { "ioc_value": "https://communedediossong.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789124": [ { "ioc_value": "https://cryptominerworld.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789125": [ { "ioc_value": "https://dev.waresport.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789116": [ { "ioc_value": "https://bharathospitalsrdr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789117": [ { "ioc_value": "https://brick.hallbyggarna.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789118": [ { "ioc_value": "https://buddhasweg.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789119": [ { "ioc_value": "https://bussimultimatemod.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789120": [ { "ioc_value": "https://capstonephoenix.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789111": [ { "ioc_value": "https://arveilo-reviews.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789112": [ { "ioc_value": "https://asphalttechpro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789113": [ { "ioc_value": "https://astratech.global/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789114": [ { "ioc_value": "https://backend.cvrc.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789115": [ { "ioc_value": "https://bestsaunas.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789105": [ { "ioc_value": "https://alfonsocerreti.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789106": [ { "ioc_value": "https://alinativa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789107": [ { "ioc_value": "https://alphadrywallconstruction.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789108": [ { "ioc_value": "https://alphaleds.shop/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789109": [ { "ioc_value": "https://americastartmagazine.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789110": [ { "ioc_value": "https://andyuxd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789100": [ { "ioc_value": "https://aamiryk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789101": [ { "ioc_value": "https://adamrood.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789102": [ { "ioc_value": "https://advancedmobiledetailing.services/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789103": [ { "ioc_value": "https://afmua.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789104": [ { "ioc_value": "https://akroseniorhigh.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789096": [ { "ioc_value": "https://xn--e3cyf0c3a3cbz9d8dc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789097": [ { "ioc_value": "https://zamboneti.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789098": [ { "ioc_value": "https://zark.ltd/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789099": [ { "ioc_value": "https://208.109.20.46/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789092": [ { "ioc_value": "https://thesupervisorscompanion.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789093": [ { "ioc_value": "https://threepublic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789094": [ { "ioc_value": "https://valleyroadside.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789095": [ { "ioc_value": "https://vutovprint.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789086": [ { "ioc_value": "https://sefiani.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789087": [ { "ioc_value": "https://shreemataastro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789088": [ { "ioc_value": "https://somaliconferencing.freeconferencecall.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789089": [ { "ioc_value": "https://sreshnadangol.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789090": [ { "ioc_value": "https://tcshadowbrook.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789091": [ { "ioc_value": "https://thehypicmodapk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789085": [ { "ioc_value": "https://s-a-bd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789081": [ { "ioc_value": "https://revaloreinigungsservice.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789082": [ { "ioc_value": "https://robertsofguildford.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789083": [ { "ioc_value": "https://rrfacility.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789084": [ { "ioc_value": "https://rsgrouppk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789075": [ { "ioc_value": "https://qarnifoods.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789076": [ { "ioc_value": "https://qiresonance.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789077": [ { "ioc_value": "wx3wxihq.norxelav.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:17:08", "last_seen_utc": "2026-04-14 12:18:30", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1789078": [ { "ioc_value": "https://quipuloja.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789079": [ { "ioc_value": "https://radiantwellnesshi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789080": [ { "ioc_value": "https://ramoaa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789070": [ { "ioc_value": "https://pixelstudioproduction.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789071": [ { "ioc_value": "https://pizzadoughrollers.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789072": [ { "ioc_value": "https://praxis-radde.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789073": [ { "ioc_value": "https://printfashion.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789074": [ { "ioc_value": "https://prokaushik.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789065": [ { "ioc_value": "https://nicpstaging.lmkr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789066": [ { "ioc_value": "https://onlineacademicswriter.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789067": [ { "ioc_value": "https://onyx-infinity.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789068": [ { "ioc_value": "https://pcdataplus.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789069": [ { "ioc_value": "https://pierreetvigne.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789060": [ { "ioc_value": "https://missavws.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789061": [ { "ioc_value": "https://monopret.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789062": [ { "ioc_value": "https://montanaranchrental.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789063": [ { "ioc_value": "https://movesllc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789064": [ { "ioc_value": "https://multanfurniture.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789055": [ { "ioc_value": "https://makinstal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789056": [ { "ioc_value": "https://marylanddrugexpert.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789057": [ { "ioc_value": "https://mcqueen.zapwebsites.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789058": [ { "ioc_value": "https://metavo.web-sitepreview.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789059": [ { "ioc_value": "https://midramo.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789050": [ { "ioc_value": "https://interlineroofingservicesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789051": [ { "ioc_value": "https://justclicktv.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789052": [ { "ioc_value": "https://kentrolaservolos.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789053": [ { "ioc_value": "https://kscooldesign.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789054": [ { "ioc_value": "https://lasacristanabnb.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789049": [ { "ioc_value": "https://institutobrasilcorporativo.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789046": [ { "ioc_value": "https://fmibusiness.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789047": [ { "ioc_value": "https://gworkspace.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789048": [ { "ioc_value": "https://iglesiapdv.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789041": [ { "ioc_value": "https://facetoface.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789042": [ { "ioc_value": "https://ferienwohnungen-brockmann.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789043": [ { "ioc_value": "https://findyourrootshairacademy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789044": [ { "ioc_value": "https://finntuition.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789045": [ { "ioc_value": "https://fixupwala.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:17:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789036": [ { "ioc_value": "https://ecoscrapcarsmedway.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789037": [ { "ioc_value": "https://edlelectricllc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789038": [ { "ioc_value": "https://estanciadochale.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789039": [ { "ioc_value": "https://etelkosar.hu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789040": [ { "ioc_value": "https://extensiongroups.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789034": [ { "ioc_value": "https://delicious-dev.strouseconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789035": [ { "ioc_value": "https://eclub.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789033": [ { "ioc_value": "https://darkslateblue-gnu-453682.hostingersite.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789028": [ { "ioc_value": "https://castit.live/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789029": [ { "ioc_value": "https://ciphercodersweb.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789030": [ { "ioc_value": "https://commander.freeconferencecall.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789031": [ { "ioc_value": "https://constructorageners.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789032": [ { "ioc_value": "https://creedaprojects.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789024": [ { "ioc_value": "https://boostmyplan.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789025": [ { "ioc_value": "https://bordtopgames.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789026": [ { "ioc_value": "https://branchspecialistltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789027": [ { "ioc_value": "https://cadtec.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789019": [ { "ioc_value": "https://berlin21.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789020": [ { "ioc_value": "https://bf-b.tatar/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789021": [ { "ioc_value": "https://bhartiyaprint.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789022": [ { "ioc_value": "https://blog.theadulawo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789023": [ { "ioc_value": "https://bonandeve.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789014": [ { "ioc_value": "https://agabuilders.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789015": [ { "ioc_value": "https://ajittextiles.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789016": [ { "ioc_value": "https://angrybees.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789017": [ { "ioc_value": "https://anticondensazionespecialista.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789018": [ { "ioc_value": "https://artmadasenegal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789009": [ { "ioc_value": "https://7linesluxurycars.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789010": [ { "ioc_value": "https://85vyou.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789011": [ { "ioc_value": "https://abogadosmontevideo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789012": [ { "ioc_value": "https://acqualereformadepiscina.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789013": [ { "ioc_value": "https://admiralife.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789004": [ { "ioc_value": "https://thestandardequine.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789005": [ { "ioc_value": "https://translarco.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789006": [ { "ioc_value": "https://trilbymovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789007": [ { "ioc_value": "https://vikrymadz.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789008": [ { "ioc_value": "https://yugantatech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788999": [ { "ioc_value": "https://stmichaelslegione.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789000": [ { "ioc_value": "https://syokimau.co.ke/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789001": [ { "ioc_value": "https://takarafune.co.jp/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789002": [ { "ioc_value": "https://test.inspiredluxurytraveler.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1789003": [ { "ioc_value": "https://theconsult-age.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788994": [ { "ioc_value": "https://rolyslandscaping.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788995": [ { "ioc_value": "https://sassynclassystudio.ie/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788996": [ { "ioc_value": "https://sm.orbitpages.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788997": [ { "ioc_value": "https://smartclinicscreens.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788998": [ { "ioc_value": "https://solebloom.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788989": [ { "ioc_value": "https://pentestingstore.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788990": [ { "ioc_value": "https://personalinternetserverhostingnewsletter.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788991": [ { "ioc_value": "https://piifund.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788992": [ { "ioc_value": "https://ramuanherbal.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788993": [ { "ioc_value": "https://restaurantegos.ro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788985": [ { "ioc_value": "https://mnpermlighting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788986": [ { "ioc_value": "https://muneramusica.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788987": [ { "ioc_value": "https://mymeatwagon.ie/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788988": [ { "ioc_value": "https://nscrd.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788982": [ { "ioc_value": "https://misscrownenterprises.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788983": [ { "ioc_value": "https://mjelevadores.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788984": [ { "ioc_value": "https://mkscoffee.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788977": [ { "ioc_value": "https://kabayanmarketplacesolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788978": [ { "ioc_value": "https://legacywholesalegroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788979": [ { "ioc_value": "https://localmates.demo-techcilo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788980": [ { "ioc_value": "https://luannemullin.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788981": [ { "ioc_value": "https://mediastreamproduction.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788973": [ { "ioc_value": "https://iclv.pe/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788974": [ { "ioc_value": "https://ifc.simet.hr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788975": [ { "ioc_value": "https://jazzautoparts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788976": [ { "ioc_value": "https://junkremoval4u.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788968": [ { "ioc_value": "https://giftcorporate.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788969": [ { "ioc_value": "https://gss-p.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788970": [ { "ioc_value": "https://hosts-to-anguilla.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788971": [ { "ioc_value": "https://hosts-to-northireland.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788972": [ { "ioc_value": "https://hyacintaccountants.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788963": [ { "ioc_value": "https://fatimamartinez1.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788964": [ { "ioc_value": "https://fonetechgrinstead.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788965": [ { "ioc_value": "https://genderismyagenda.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788966": [ { "ioc_value": "https://genforcepower.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788967": [ { "ioc_value": "https://gewoonactueel.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788957": [ { "ioc_value": "https://doughdepot.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788958": [ { "ioc_value": "https://dvconstructions.co.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:33", "last_seen_utc": "2026-04-15 18:30:45", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788959": [ { "ioc_value": "https://ehhuttonins.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788960": [ { "ioc_value": "https://elmateam.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788961": [ { "ioc_value": "https://evolve-psych.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788962": [ { "ioc_value": "https://fairplayloginapp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788953": [ { "ioc_value": "https://cloud9vizionsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788954": [ { "ioc_value": "https://conservadoraalvesbh.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788955": [ { "ioc_value": "https://cryptologygraphics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788956": [ { "ioc_value": "https://cummingofage.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788948": [ { "ioc_value": "https://builtbydimorahomes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788949": [ { "ioc_value": "https://carmetedil.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788950": [ { "ioc_value": "https://catering-murah.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788951": [ { "ioc_value": "https://chamz.fun/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788952": [ { "ioc_value": "https://chocoluxe.shop/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788943": [ { "ioc_value": "https://ahpropiscines.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788944": [ { "ioc_value": "https://atlantalifeviet.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788945": [ { "ioc_value": "https://aurelianforgedwheels.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788946": [ { "ioc_value": "https://autotransportspecialty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788947": [ { "ioc_value": "https://axhilth.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788937": [ { "ioc_value": "https://trustroofingltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788938": [ { "ioc_value": "https://vaartamedia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788939": [ { "ioc_value": "https://valeautorepairandtowing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788940": [ { "ioc_value": "https://xauusddigger.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788941": [ { "ioc_value": "https://zuzubrand.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788942": [ { "ioc_value": "https://24loodgieter.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788935": [ { "ioc_value": "https://travelhajiumroh.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788936": [ { "ioc_value": "https://tropicalhype.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788930": [ { "ioc_value": "https://shieldexfire.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788931": [ { "ioc_value": "https://singaporeguides.ru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788932": [ { "ioc_value": "https://store.ecorybd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788933": [ { "ioc_value": "https://tanamanhias.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788934": [ { "ioc_value": "https://technolawgi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788925": [ { "ioc_value": "https://rak-lok.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788926": [ { "ioc_value": "https://rockledgemovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788927": [ { "ioc_value": "https://sagereturns.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788928": [ { "ioc_value": "https://semja.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788929": [ { "ioc_value": "https://shermanlandscapesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788920": [ { "ioc_value": "https://pick-transfer.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788921": [ { "ioc_value": "https://prcfencing.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788922": [ { "ioc_value": "https://primeedge-ventures.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788923": [ { "ioc_value": "https://primejournal.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788924": [ { "ioc_value": "https://productosnaturalesenquito.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788915": [ { "ioc_value": "https://oakdaledrivewaysandpatioslimited.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788916": [ { "ioc_value": "https://oaklandtactical.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788917": [ { "ioc_value": "https://obatmaagkronisampuh.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788918": [ { "ioc_value": "https://ohiovalleyprep.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788919": [ { "ioc_value": "https://parishaengineers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788910": [ { "ioc_value": "https://miamilandscapelightings.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788911": [ { "ioc_value": "https://mybournemouth.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788912": [ { "ioc_value": "https://mydriverbs.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788913": [ { "ioc_value": "https://mzubayer.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788914": [ { "ioc_value": "https://nvslidingdoors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788905": [ { "ioc_value": "https://instalacionescobos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788906": [ { "ioc_value": "https://jameswebbspeaks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788907": [ { "ioc_value": "https://kbdumpsterrental.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788908": [ { "ioc_value": "https://latinomusic.cl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788909": [ { "ioc_value": "https://maasp.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788900": [ { "ioc_value": "https://fidelitytrusts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788901": [ { "ioc_value": "https://gigadietmeals.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788902": [ { "ioc_value": "https://greenvajos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788903": [ { "ioc_value": "https://heartbeats.heartlandwellnesscenter.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788904": [ { "ioc_value": "https://hipercapitaluae.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788895": [ { "ioc_value": "https://designbysignature.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788896": [ { "ioc_value": "https://dualityvillas.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788897": [ { "ioc_value": "https://eij-management.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788898": [ { "ioc_value": "https://elitesportssunglasses.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788899": [ { "ioc_value": "https://fabiopischedda.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788890": [ { "ioc_value": "https://builtinappliances.ronaldotech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788891": [ { "ioc_value": "https://danmarcconstruction.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788892": [ { "ioc_value": "https://dbextraining.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788893": [ { "ioc_value": "https://decor.impiriainterior.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788894": [ { "ioc_value": "https://dedekurniadi.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788885": [ { "ioc_value": "https://aquaestheticspa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788886": [ { "ioc_value": "https://asiabigboss777.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788887": [ { "ioc_value": "https://athousingsolutions.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788888": [ { "ioc_value": "https://baytalzayn.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788889": [ { "ioc_value": "https://book-taxi-paris.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788883": [ { "ioc_value": "https://aoetal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788884": [ { "ioc_value": "https://apexcapagency.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788878": [ { "ioc_value": "https://yummydoll.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788879": [ { "ioc_value": "https://adinugroho.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788880": [ { "ioc_value": "https://aetrix.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788881": [ { "ioc_value": "https://andreawirsum.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788882": [ { "ioc_value": "https://antaranganews-com.stackstaging.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788873": [ { "ioc_value": "https://tgsconstruccion.cl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788874": [ { "ioc_value": "https://therisinghaveli.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788875": [ { "ioc_value": "https://treeservicessouthwales.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788876": [ { "ioc_value": "https://viradainvisivel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788877": [ { "ioc_value": "https://yc-coaching.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788868": [ { "ioc_value": "https://qblicense.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788869": [ { "ioc_value": "https://regionaltms.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788870": [ { "ioc_value": "https://sevido-design.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788871": [ { "ioc_value": "https://signaturerugcleaning.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788872": [ { "ioc_value": "https://technettic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788865": [ { "ioc_value": "https://pontapretamaiocv.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788866": [ { "ioc_value": "https://poslovniregistar.rs/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788867": [ { "ioc_value": "https://promofordiscount.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788864": [ { "ioc_value": "https://penthouse501.satiys.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788859": [ { "ioc_value": "https://neo-langues.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788860": [ { "ioc_value": "https://newshub.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788861": [ { "ioc_value": "https://ocpostco.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788862": [ { "ioc_value": "https://oriontravelease.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788863": [ { "ioc_value": "https://ottimo-eshop.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:16:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788854": [ { "ioc_value": "https://lunamar2015.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788855": [ { "ioc_value": "https://mandalawimedia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788856": [ { "ioc_value": "https://microgardens.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788857": [ { "ioc_value": "https://myestheticsupplies.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788858": [ { "ioc_value": "https://nationunitybuilders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788849": [ { "ioc_value": "https://jablaservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788850": [ { "ioc_value": "https://kehofx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788851": [ { "ioc_value": "https://lasonrisapty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788852": [ { "ioc_value": "https://lasura.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788853": [ { "ioc_value": "https://losspreventionsec.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788844": [ { "ioc_value": "https://gustavogorriaran.com.uy/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788845": [ { "ioc_value": "https://happychildren2.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788846": [ { "ioc_value": "https://hvac.ee/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788847": [ { "ioc_value": "https://innorev.io/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788848": [ { "ioc_value": "https://ispeak.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788839": [ { "ioc_value": "https://foxlogic.com.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788840": [ { "ioc_value": "https://friendstatry.sk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788841": [ { "ioc_value": "https://gasheatersmelbourne.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788842": [ { "ioc_value": "https://goldenislesornamental.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788843": [ { "ioc_value": "https://greenenergyukservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788835": [ { "ioc_value": "https://cms.commonwealthdyf.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788836": [ { "ioc_value": "https://ddrmgb.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788837": [ { "ioc_value": "https://dunkindonutsmenuwithprices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788838": [ { "ioc_value": "https://evo-lootion.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788832": [ { "ioc_value": "https://bismib.com.bd/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788833": [ { "ioc_value": "https://call-center.ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788834": [ { "ioc_value": "https://chocomomentje.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788826": [ { "ioc_value": "https://allterrainroofingcontractor.wpalphasquad.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788827": [ { "ioc_value": "https://appliancerepairnormanok.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788828": [ { "ioc_value": "https://autorepairpalmetto.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788829": [ { "ioc_value": "https://best.net.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788830": [ { "ioc_value": "https://betmarinom.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788831": [ { "ioc_value": "https://bfmhi.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788821": [ { "ioc_value": "https://tsysf.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788822": [ { "ioc_value": "https://vcwjes.edu.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788823": [ { "ioc_value": "https://yerelvizyon.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788824": [ { "ioc_value": "https://yuyustudio.serv00.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788825": [ { "ioc_value": "https://akhuvatloan.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788816": [ { "ioc_value": "https://stylefrancesca.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788817": [ { "ioc_value": "https://switafrica.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788818": [ { "ioc_value": "https://titofilms.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788819": [ { "ioc_value": "https://transportsaintfelicien.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788820": [ { "ioc_value": "https://troop537.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788811": [ { "ioc_value": "https://sanabilacademy.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788812": [ { "ioc_value": "https://sdcmantenimiento.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788813": [ { "ioc_value": "https://shanitastraw.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788814": [ { "ioc_value": "https://softdio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788815": [ { "ioc_value": "https://southasianher.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788806": [ { "ioc_value": "https://ong-sadap-td.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788807": [ { "ioc_value": "https://printer-repair-miami.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788808": [ { "ioc_value": "https://printmayuram.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788809": [ { "ioc_value": "https://proshow-fx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788810": [ { "ioc_value": "https://rivetize.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788801": [ { "ioc_value": "https://newidmemberlogin.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788802": [ { "ioc_value": "https://nonghong.buriram.police.go.th/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788803": [ { "ioc_value": "https://nonrevtravelbuddy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788804": [ { "ioc_value": "https://obtradinglimited.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788805": [ { "ioc_value": "https://onechoicehomeimprovementsltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788795": [ { "ioc_value": "https://kimweb.in.th/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788796": [ { "ioc_value": "https://klimamurer.dk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788797": [ { "ioc_value": "https://ksunitynext.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788798": [ { "ioc_value": "https://malcon.cd/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788799": [ { "ioc_value": "https://mietservice-minibagger.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788800": [ { "ioc_value": "https://muskannew.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788790": [ { "ioc_value": "https://euroequipment.co.th/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788791": [ { "ioc_value": "https://expressdemenagement.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788792": [ { "ioc_value": "https://grounded-eicrs.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788793": [ { "ioc_value": "https://ilomss.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788794": [ { "ioc_value": "https://kaplanis.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788785": [ { "ioc_value": "https://coopercreative.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788786": [ { "ioc_value": "https://datakingg.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788787": [ { "ioc_value": "https://dimcouto.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788788": [ { "ioc_value": "https://eizerleisek.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788789": [ { "ioc_value": "https://elementslosgatos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788782": [ { "ioc_value": "https://churchillsthonglor.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788783": [ { "ioc_value": "https://clearpath-advisory.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788784": [ { "ioc_value": "https://conceptproductions.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788777": [ { "ioc_value": "https://boatshipping.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788778": [ { "ioc_value": "https://boyntonbeachflmovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788779": [ { "ioc_value": "https://broarmand.org.ph/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788780": [ { "ioc_value": "https://camptramonti.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788781": [ { "ioc_value": "https://centraldascaixas.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788771": [ { "ioc_value": "https://agenonline.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788772": [ { "ioc_value": "https://aparcertificadodigital.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788773": [ { "ioc_value": "https://appliancerepairsoahu.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788774": [ { "ioc_value": "https://aquilaprivatesecurity.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788775": [ { "ioc_value": "https://balenckingslot.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788776": [ { "ioc_value": "https://beaconmentors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788766": [ { "ioc_value": "https://upvcwindowsanddoorsaustralia.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788767": [ { "ioc_value": "https://voshodrobotics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788768": [ { "ioc_value": "https://yeshtheatre.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788769": [ { "ioc_value": "https://yokana.shop/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788770": [ { "ioc_value": "https://adammoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788761": [ { "ioc_value": "https://thekindergarten.education/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788762": [ { "ioc_value": "https://themindfulnesting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788763": [ { "ioc_value": "https://themosaicinstitute.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788764": [ { "ioc_value": "https://thurman.aryuprojects.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788765": [ { "ioc_value": "https://ttscholars.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788755": [ { "ioc_value": "https://solidyields.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788756": [ { "ioc_value": "https://squivle.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788757": [ { "ioc_value": "https://stage2sellrealestateagent.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788758": [ { "ioc_value": "https://tainanjazz.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788759": [ { "ioc_value": "https://taxisenogrove.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788760": [ { "ioc_value": "https://technologypickup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788750": [ { "ioc_value": "https://salazarteam1.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788751": [ { "ioc_value": "https://sapnaakhandelwal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788752": [ { "ioc_value": "https://sdalazer.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788753": [ { "ioc_value": "https://shadetree.financial/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788754": [ { "ioc_value": "https://shcquotes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788745": [ { "ioc_value": "https://northstaroperating.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788746": [ { "ioc_value": "https://passeios.transferrn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788747": [ { "ioc_value": "https://prioritypeople.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788748": [ { "ioc_value": "https://quickdatagh.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788749": [ { "ioc_value": "https://relbel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788740": [ { "ioc_value": "https://midnightblue-termite-395025.hostingersite.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788741": [ { "ioc_value": "https://monetsmeals.wpvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788742": [ { "ioc_value": "https://monsterglassandmirrors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788743": [ { "ioc_value": "https://montrealguideservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788744": [ { "ioc_value": "https://movingweighttowing.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788735": [ { "ioc_value": "https://khilkhil.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788736": [ { "ioc_value": "https://kjgalilee.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788737": [ { "ioc_value": "https://la-luxe-transportation.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788738": [ { "ioc_value": "https://mangomovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788739": [ { "ioc_value": "https://merrittislandmovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788732": [ { "ioc_value": "https://ihosolucoes.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788733": [ { "ioc_value": "https://insideafricans.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788734": [ { "ioc_value": "https://inviziblemantattooremoval.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788727": [ { "ioc_value": "https://filtrosdieselonline.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788728": [ { "ioc_value": "https://gameheavenstudio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788729": [ { "ioc_value": "https://geot-unikin.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788730": [ { "ioc_value": "https://growingorganic3440.live-website.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788731": [ { "ioc_value": "https://hortivise.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788722": [ { "ioc_value": "https://donaldanfuso.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788723": [ { "ioc_value": "https://draximenarosero.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788724": [ { "ioc_value": "https://drivemama.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788725": [ { "ioc_value": "https://eachoneteachonefoundation.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788726": [ { "ioc_value": "https://fb68.homes/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788717": [ { "ioc_value": "https://cyberzone.at/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788718": [ { "ioc_value": "https://daygroup.biz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788719": [ { "ioc_value": "https://dejabrewnh.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788720": [ { "ioc_value": "https://dentificlinic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788721": [ { "ioc_value": "https://diamonddiscount.ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788713": [ { "ioc_value": "https://checkpointmotorsltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788714": [ { "ioc_value": "https://chicagopave.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788715": [ { "ioc_value": "https://college-explorer.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788716": [ { "ioc_value": "https://conservos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788709": [ { "ioc_value": "https://bbg.cliftonmortgagesolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788710": [ { "ioc_value": "https://bigtimeholidays.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788711": [ { "ioc_value": "https://catcredit.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788712": [ { "ioc_value": "https://cefikvsg.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788706": [ { "ioc_value": "https://zahraessences.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788707": [ { "ioc_value": "https://alisascleaningservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788708": [ { "ioc_value": "https://anadomisis.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788703": [ { "ioc_value": "https://twosisterscleaningfl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788704": [ { "ioc_value": "https://ventasrivera.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788705": [ { "ioc_value": "https://vps.sgpctech.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788700": [ { "ioc_value": "https://teleamazonas.pe/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788701": [ { "ioc_value": "https://totaaldiscounter.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788702": [ { "ioc_value": "https://tutigotto.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788696": [ { "ioc_value": "https://promorent.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788697": [ { "ioc_value": "https://prueba.mgnacional.cl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788698": [ { "ioc_value": "https://redbridgechamberofcommerce.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788699": [ { "ioc_value": "https://sharkrealestate.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788693": [ { "ioc_value": "https://naqlacompany.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788694": [ { "ioc_value": "https://nonprofitproteam.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788695": [ { "ioc_value": "https://phoenix.edu.lb/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788691": [ { "ioc_value": "https://mail.encylife.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788692": [ { "ioc_value": "https://maracorongiu.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788688": [ { "ioc_value": "https://kebunmanggis.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788689": [ { "ioc_value": "https://kupaamedia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788690": [ { "ioc_value": "https://madisonaveproperties.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788687": [ { "ioc_value": "https://hunartechzmedia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:15:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788685": [ { "ioc_value": "ctl.sequareeus.online", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:13:24", "last_seen_utc": "2026-04-14 16:17:21", "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Vidar", "anonymous": "0", "reporter": "crep1x" } ], "1788686": [ { "ioc_value": "ctl.biolinks.com.br", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:13:24", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Vidar", "anonymous": "0", "reporter": "crep1x" } ], "1788683": [ { "ioc_value": "https://ctl.sequareeus.online/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:13:10", "last_seen_utc": "2026-04-14 16:17:18", "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Vidar", "anonymous": "0", "reporter": "crep1x" } ], "1788684": [ { "ioc_value": "https://ctl.biolinks.com.br/", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 12:13:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "", "tags": "Vidar", "anonymous": "0", "reporter": "crep1x" } ], "1788682": [ { "ioc_value": "sile-reel.norxelav.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:11:56", "last_seen_utc": "2026-04-14 12:14:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1788681": [ { "ioc_value": "mrz.myvnc.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.njrat", "malware_alias": "Bladabindi,Lime-Worm", "malware_printable": "NjRAT", "first_seen_utc": "2026-04-14 12:11:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-nhyvhahv5j", "tags": "C2,domain,njrat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788680": [ { "ioc_value": "1agame.tv", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:59", "last_seen_utc": "2026-04-14 12:09:21", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kr2qzaas7t", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788679": [ { "ioc_value": "terminal.eu.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:53", "last_seen_utc": "2026-04-14 12:08:56", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kx1e4aat91", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788678": [ { "ioc_value": "open883.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:46", "last_seen_utc": "2026-04-14 12:08:50", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kx1e4aat91", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788677": [ { "ioc_value": "c168vip2.online", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:41", "last_seen_utc": "2026-04-14 12:08:44", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kx1e4aat91", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788676": [ { "ioc_value": "c168-c168d.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:37", "last_seen_utc": "2026-04-14 12:08:39", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kx1e4aat91", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788675": [ { "ioc_value": "hi5n2qg.uk.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:35", "last_seen_utc": "2026-04-14 12:08:36", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kx1e4aat91", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788674": [ { "ioc_value": "98sasprosnowmeprona.za.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:30", "last_seen_utc": "2026-04-14 12:08:34", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-lwzylsgt2j", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788673": [ { "ioc_value": "https://gamesocialunder.it.com:3306", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-l8brjsbw9v", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788672": [ { "ioc_value": "https://gamesocialunder.it.com:8443", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:27", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-l8brjsbw9v", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788671": [ { "ioc_value": "https://gamesocialunder.it.com:8080", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:25", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-l8brjsbw9v", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788670": [ { "ioc_value": "https://gamesocialunder.it.com:80", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:24", "last_seen_utc": "2026-04-14 12:08:26", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-l8brjsbw9v", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788668": [ { "ioc_value": "gamesocialunder.it.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:16", "last_seen_utc": "2026-04-14 12:08:23", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-l8brjsbw9v", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788667": [ { "ioc_value": "https://kvr.uk.com:3306", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:13", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-macfvsbx4s", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788666": [ { "ioc_value": "https://kvr.uk.com:8080", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-macfvsbx4s", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788664": [ { "ioc_value": "https://kvr.uk.com:8443", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:09", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-macfvsbx4s", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788663": [ { "ioc_value": "https://kvr.uk.com:80", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:08:07", "last_seen_utc": "2026-04-14 12:08:12", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-macfvsbx4s", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788660": [ { "ioc_value": "kvr.uk.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:53", "last_seen_utc": "2026-04-14 12:08:05", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-macfvsbx4s", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788659": [ { "ioc_value": "tomoni.in.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:47", "last_seen_utc": "2026-04-14 12:07:50", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-l9yygagv8j", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788658": [ { "ioc_value": "https://nivad.io/vi-vn:3306", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:44", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788657": [ { "ioc_value": "https://nivad.io/vi-vn:8443", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:41", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788656": [ { "ioc_value": "https://nivad.io/vi-vn:443", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:39", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788655": [ { "ioc_value": "https://nivad.io/vi-vn:8080", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:36", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788654": [ { "ioc_value": "https://nivad.io/vi-vn:80", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:33", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788653": [ { "ioc_value": "https://nivad.io:3306", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:31", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788652": [ { "ioc_value": "https://nivad.io:8443", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:29", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788651": [ { "ioc_value": "https://nivad.io:8080", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:23", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788650": [ { "ioc_value": "https://nivad.io:80", "ioc_type": "url", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:20", "last_seen_utc": "2026-04-14 12:07:26", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788649": [ { "ioc_value": "nivad.io", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.quasar_rat", "malware_alias": "CinaRAT,QuasarRAT,Yggdrasil", "malware_printable": "Quasar RAT", "first_seen_utc": "2026-04-14 12:07:04", "last_seen_utc": "2026-04-14 12:07:16", "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-mdarfabx8x", "tags": "C2,domain,quasar,rat,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788648": [ { "ioc_value": "otpj4gh.norxelav.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:05:47", "last_seen_utc": "2026-04-14 12:08:24", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1788647": [ { "ioc_value": "173.211.106.14:56796", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-14 12:02:10", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kqv7ssas4z", "tags": "AS21769,C2,rat,remcos,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788646": [ { "ioc_value": "research.cloud-ip.cc", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-14 12:02:07", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kqv7ssas4z", "tags": "C2,domain,rat,remcos,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788645": [ { "ioc_value": "bioresearch.bumbleshrimp.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-14 12:02:04", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kqv7ssas4z", "tags": "C2,domain,rat,remcos,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788644": [ { "ioc_value": "research.abrdns.com", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.remcos", "malware_alias": "RemcosRAT,Remvio,Socmer", "malware_printable": "Remcos", "first_seen_utc": "2026-04-14 12:02:01", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-kqv7ssas4z", "tags": "C2,domain,rat,remcos,triage", "anonymous": "0", "reporter": "DonPasci" } ], "1788643": [ { "ioc_value": "rdqnbcayzh.localto.net", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-14 12:01:12", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-gwcqvsc13q", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1788642": [ { "ioc_value": "abo3li-50042.portmap.host", "ioc_type": "domain", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-14 12:01:08", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-jycjzsew3n", "tags": "C2,domain,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1788641": [ { "ioc_value": "172.245.244.81:1412", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.xworm", "malware_alias": null, "malware_printable": "XWorm", "first_seen_utc": "2026-04-14 12:01:05", "last_seen_utc": null, "confidence_level": 100, "is_compromised": false, "reference": "https://tria.ge/260414-myssrag13l", "tags": "AS36352,C2,triage,xworm", "anonymous": "0", "reporter": "DonPasci" } ], "1788640": [ { "ioc_value": "zbianule.norxelav.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 12:00:31", "last_seen_utc": "2026-04-14 12:02:03", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1788639": [ { "ioc_value": "144.172.96.27:8543", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.pure_rat", "malware_alias": "PureHVNC,ResolverRAT", "malware_printable": "PureRAT", "first_seen_utc": "2026-04-14 11:55:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/2d9d3c0cfdca2e96c13788f38464066ace526326cb887a0f7dc50f9e5be17aad/", "tags": "PureHVNC,PureRAT,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1788638": [ { "ioc_value": "sp4rr-switch.norxelav.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 11:54:57", "last_seen_utc": "2026-04-14 11:56:35", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1788637": [ { "ioc_value": "sermeshos5.bry6moxel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 11:49:28", "last_seen_utc": "2026-04-14 11:51:12", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1788636": [ { "ioc_value": "2.27.62.123:4449", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "win.pure_rat", "malware_alias": "PureHVNC,ResolverRAT", "malware_printable": "PureRAT", "first_seen_utc": "2026-04-14 11:49:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": false, "reference": "https://bazaar.abuse.ch/sample/e85bf177349f91d23697920f51bc38fa2088d135d206cac70c1111dc79183cc4/", "tags": "PureHVNC,PureRAT,RAT", "anonymous": "0", "reporter": "abuse_ch" } ], "1788634": [ { "ioc_value": "kg9c.bry6moxel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 11:43:44", "last_seen_utc": "2026-04-14 11:45:40", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1788630": [ { "ioc_value": "https://groundguardpropertymaintenanceltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788631": [ { "ioc_value": "https://harmelcodijd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788632": [ { "ioc_value": "https://hmpcs.co.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788633": [ { "ioc_value": "https://hosts-to-italy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788625": [ { "ioc_value": "https://frontsetter.dk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788626": [ { "ioc_value": "https://ftw-group.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788627": [ { "ioc_value": "https://gikseo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788628": [ { "ioc_value": "https://goodhousingworks.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788629": [ { "ioc_value": "https://gregmarchal.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788620": [ { "ioc_value": "https://downholeinjection.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788621": [ { "ioc_value": "https://eltransistorgranada.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788622": [ { "ioc_value": "https://ethanjawadi.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788623": [ { "ioc_value": "https://expoagroluziania.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788624": [ { "ioc_value": "https://fisioturtraining.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788615": [ { "ioc_value": "https://carservices.wpalphasquad.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788616": [ { "ioc_value": "https://chillandgo.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788617": [ { "ioc_value": "https://coffesibonis.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788618": [ { "ioc_value": "https://compassionate-solutions.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788619": [ { "ioc_value": "https://cookingrt.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788610": [ { "ioc_value": "https://aircliniq.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788611": [ { "ioc_value": "https://alrawda-co.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788612": [ { "ioc_value": "https://azurevillasibiza.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788613": [ { "ioc_value": "https://bestmoversmelbournefl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788614": [ { "ioc_value": "https://budgettoursind.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788604": [ { "ioc_value": "https://sigmetal.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788605": [ { "ioc_value": "https://teachers4zambia.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788606": [ { "ioc_value": "https://turmoilandtriumph.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788607": [ { "ioc_value": "https://uhooq.xyz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788608": [ { "ioc_value": "https://yousuftraders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788609": [ { "ioc_value": "https://aandjequipmentrental.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788599": [ { "ioc_value": "https://modelodecking.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788600": [ { "ioc_value": "https://philiphowardapartments.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788601": [ { "ioc_value": "https://quotient-capital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788602": [ { "ioc_value": "https://rockfinders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788603": [ { "ioc_value": "https://sidsidhu.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788594": [ { "ioc_value": "https://imagescapesembroidery.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788595": [ { "ioc_value": "https://jamhurikenyaleadershipawards.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788596": [ { "ioc_value": "https://kcbtherapy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788597": [ { "ioc_value": "https://marketing-consultancy.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788598": [ { "ioc_value": "https://medusa20.xyz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788588": [ { "ioc_value": "https://ebali.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788589": [ { "ioc_value": "https://ekcreations.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788590": [ { "ioc_value": "https://energyarts.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788591": [ { "ioc_value": "https://ewebawe.space/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788592": [ { "ioc_value": "https://ewrtaxi.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788593": [ { "ioc_value": "https://goreardan.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788582": [ { "ioc_value": "https://creativebdshop.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788583": [ { "ioc_value": "https://creawebsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788584": [ { "ioc_value": "https://danielkollyphoto.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788585": [ { "ioc_value": "https://digitalbari.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788586": [ { "ioc_value": "https://digitallybrave.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788587": [ { "ioc_value": "https://dobnews.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788577": [ { "ioc_value": "https://chitungwiza.org.zw/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788578": [ { "ioc_value": "https://clayci.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788579": [ { "ioc_value": "https://codko.tech/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788580": [ { "ioc_value": "https://commonwealthonline.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788581": [ { "ioc_value": "https://conventionescolademusica.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788575": [ { "ioc_value": "https://cdumpo.ru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788576": [ { "ioc_value": "https://chantalasido.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788573": [ { "ioc_value": "https://bestsunrisemovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788574": [ { "ioc_value": "https://builtinconstructions.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788568": [ { "ioc_value": "https://yuhiamuli.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788569": [ { "ioc_value": "https://adnsales.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788570": [ { "ioc_value": "https://americanprogaragedoorllc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788571": [ { "ioc_value": "https://auxbolsdenergies.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788572": [ { "ioc_value": "https://babykraamzorg.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788563": [ { "ioc_value": "https://skimmingstones.nz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788564": [ { "ioc_value": "https://solcrestcapital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788565": [ { "ioc_value": "https://tapolserwis.pl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788566": [ { "ioc_value": "https://tatata.wpvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788567": [ { "ioc_value": "https://thebiznessjawn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788558": [ { "ioc_value": "https://ourhomeoffaith.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788559": [ { "ioc_value": "https://outlanderbotanist.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788560": [ { "ioc_value": "https://redcross.org.pg/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788561": [ { "ioc_value": "https://restaurantekingdomhouse.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788562": [ { "ioc_value": "https://shamimusman.engineer/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788554": [ { "ioc_value": "https://nandaayurveda.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788555": [ { "ioc_value": "https://note.kimson.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788556": [ { "ioc_value": "https://novapathhomecare.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788557": [ { "ioc_value": "https://ouiping.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788551": [ { "ioc_value": "https://ladywear.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788552": [ { "ioc_value": "https://lavida.studio/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788553": [ { "ioc_value": "https://lsgeducation.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788547": [ { "ioc_value": "https://guidinglightwell.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788548": [ { "ioc_value": "https://hollowhillsgothic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788549": [ { "ioc_value": "https://keepontherun.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788550": [ { "ioc_value": "https://klhind.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788545": [ { "ioc_value": "https://expertsuae.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788546": [ { "ioc_value": "https://grupoalmago.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788542": [ { "ioc_value": "https://drpreetsandhu.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788543": [ { "ioc_value": "https://dynastyroofingfl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788544": [ { "ioc_value": "https://ecotiresecuador.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788540": [ { "ioc_value": "https://dansmobiletyres.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788541": [ { "ioc_value": "https://dealsdepot.xyz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788537": [ { "ioc_value": "https://connect.lightgig.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788538": [ { "ioc_value": "https://conseilnationalcacao.mg/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788539": [ { "ioc_value": "https://cuticonsultores.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788534": [ { "ioc_value": "https://bytowntires.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788535": [ { "ioc_value": "https://casadebellezza.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788536": [ { "ioc_value": "https://celebvalus.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788532": [ { "ioc_value": "https://boisegaragedoorsrepair.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788533": [ { "ioc_value": "https://bon-debarras-paris.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788529": [ { "ioc_value": "https://avivhair.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788530": [ { "ioc_value": "https://bengalspeech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788531": [ { "ioc_value": "https://biogrowgreens.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788528": [ { "ioc_value": "https://apiculturaempresarial.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788527": [ { "ioc_value": "https://amazonhomeloans.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:40:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788522": [ { "ioc_value": "https://twodogfarms.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788523": [ { "ioc_value": "https://5starrtv.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788524": [ { "ioc_value": "https://abrealtors.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788525": [ { "ioc_value": "https://aerofisic.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788526": [ { "ioc_value": "https://allyson.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788517": [ { "ioc_value": "https://rmaconsultoriacontabil.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788518": [ { "ioc_value": "https://samxgroups.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788519": [ { "ioc_value": "https://tigerfoods.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788520": [ { "ioc_value": "https://tophealthiestsupplements.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788521": [ { "ioc_value": "https://treelionsltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788511": [ { "ioc_value": "https://pet-friendlyaccommodation.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788512": [ { "ioc_value": "https://pipersplaceatbaylor.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788513": [ { "ioc_value": "https://pressblk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788514": [ { "ioc_value": "https://proplayuk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788515": [ { "ioc_value": "https://realla.io/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788516": [ { "ioc_value": "https://reigate.mktng-int.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1786841": [ { "ioc_value": "172.233.47.116:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-14 11:39:53", "last_seen_utc": "2026-04-14 11:22:26", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1786843": [ { "ioc_value": "172.233.47.87:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-14 11:39:53", "last_seen_utc": "2026-04-14 11:56:36", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1788506": [ { "ioc_value": "https://nsungayakongo.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788507": [ { "ioc_value": "https://obat-kuat.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788508": [ { "ioc_value": "https://obatpenurundarahtinggialami.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788509": [ { "ioc_value": "https://oceanicblueempire.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788510": [ { "ioc_value": "https://patchworkdigital.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1786850": [ { "ioc_value": "172.233.47.174:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-14 11:39:52", "last_seen_utc": "2026-04-14 10:58:51", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1788500": [ { "ioc_value": "https://littlepirate.co.il/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788501": [ { "ioc_value": "https://m-tex.rs/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788502": [ { "ioc_value": "https://mochi99.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788503": [ { "ioc_value": "https://neltilia.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788504": [ { "ioc_value": "https://nh2.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788505": [ { "ioc_value": "https://nostresshousefix.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1786857": [ { "ioc_value": "172.233.47.210:25001", "ioc_type": "ip:port", "threat_type": "botnet_cc", "malware": "apk.kimwolf", "malware_alias": null, "malware_printable": "Kimwolf", "first_seen_utc": "2026-04-14 11:39:51", "last_seen_utc": "2026-04-14 11:47:56", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "c2,Kimwolf", "anonymous": "0", "reporter": "Bitsight" } ], "1788494": [ { "ioc_value": "https://jrw.com.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788495": [ { "ioc_value": "https://keeploadinglogistics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788496": [ { "ioc_value": "https://landing.crossroadsvenues.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788497": [ { "ioc_value": "https://lartdusprint.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788498": [ { "ioc_value": "https://lesprivatsemarang.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788499": [ { "ioc_value": "https://levelupinvestments.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788489": [ { "ioc_value": "https://foints.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788490": [ { "ioc_value": "https://game-corp.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788491": [ { "ioc_value": "https://gocash.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788492": [ { "ioc_value": "https://guardiansunlimited.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788493": [ { "ioc_value": "https://iasystems.sitelaunch.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788483": [ { "ioc_value": "https://diversidadesexual.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788484": [ { "ioc_value": "https://docteurefarahnesrine.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788485": [ { "ioc_value": "https://dxlconstruction.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788486": [ { "ioc_value": "https://edit.lapino.com.ar/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788487": [ { "ioc_value": "https://elchai.co.il/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788488": [ { "ioc_value": "https://espace-renaissance.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788478": [ { "ioc_value": "https://tribunaledirittimalatoanziano-legnago.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788479": [ { "ioc_value": "https://amcagency.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788480": [ { "ioc_value": "https://bantaminc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788481": [ { "ioc_value": "https://blesscreation.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788482": [ { "ioc_value": "https://deltorres.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788477": [ { "ioc_value": "https://teknoboga.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788473": [ { "ioc_value": "https://scientificcreationism.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788474": [ { "ioc_value": "https://stinvestments.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788475": [ { "ioc_value": "https://sxr.dnz.mybluehost.me/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788476": [ { "ioc_value": "https://szael.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788467": [ { "ioc_value": "https://rjglamesfamilyfoundation.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788468": [ { "ioc_value": "https://sales.dreamssurface.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788469": [ { "ioc_value": "https://sam91222.wpvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788470": [ { "ioc_value": "https://samsungskal.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788471": [ { "ioc_value": "https://sanramontaxis.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788472": [ { "ioc_value": "https://satig.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788462": [ { "ioc_value": "https://papillonfinvest.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788463": [ { "ioc_value": "https://pharmaties.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788464": [ { "ioc_value": "https://phfadvocaciasorocaba.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788465": [ { "ioc_value": "https://pointsellingsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788466": [ { "ioc_value": "https://portal.elawyersbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788456": [ { "ioc_value": "https://iskoninfotech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788457": [ { "ioc_value": "https://jcadventures.xyz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788458": [ { "ioc_value": "https://jncengenharia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788459": [ { "ioc_value": "https://lisagabriela473-2nd.wpvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788460": [ { "ioc_value": "https://onoranzefunebricassa.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788461": [ { "ioc_value": "https://pahokeemovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788450": [ { "ioc_value": "https://cosimnormandie.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788451": [ { "ioc_value": "https://crestlynconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788452": [ { "ioc_value": "https://fansub.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788453": [ { "ioc_value": "https://foganalytics.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788454": [ { "ioc_value": "https://greenworldtradisional.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788455": [ { "ioc_value": "https://happierfr.atomicdesigninc.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:39", "last_seen_utc": "2026-04-15 17:00:54", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788444": [ { "ioc_value": "https://allbrevardaluminum.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788445": [ { "ioc_value": "https://anthonyhickonbottom.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788446": [ { "ioc_value": "https://anyspa.ec/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788447": [ { "ioc_value": "https://balanceadvisors242.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788448": [ { "ioc_value": "https://bsdadvocacy.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788449": [ { "ioc_value": "https://clearskyfarms.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788439": [ { "ioc_value": "https://ukgaudiyamission.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788440": [ { "ioc_value": "https://usedom.mc-multiclean.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788441": [ { "ioc_value": "https://vasantvilas.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788442": [ { "ioc_value": "https://54.167.47.15/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788443": [ { "ioc_value": "https://admissions2026.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788433": [ { "ioc_value": "https://slotgamespg.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788434": [ { "ioc_value": "https://stuartrealty.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788435": [ { "ioc_value": "https://studycollections.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788436": [ { "ioc_value": "https://terrapromessa.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788437": [ { "ioc_value": "https://thelewhouse.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788438": [ { "ioc_value": "https://trinitasgestao.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788428": [ { "ioc_value": "https://proserviceappliancerepair.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788429": [ { "ioc_value": "https://purefocusclinic.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788430": [ { "ioc_value": "https://rabbleallied.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788431": [ { "ioc_value": "https://royalaigle.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788432": [ { "ioc_value": "https://shashidigitalsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788427": [ { "ioc_value": "https://philips.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788423": [ { "ioc_value": "https://nickkyonline.store/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788424": [ { "ioc_value": "https://numeralla.org.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788425": [ { "ioc_value": "https://ondernemersverenigingvaassen.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788426": [ { "ioc_value": "https://packersmoversudaipur.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788418": [ { "ioc_value": "https://hotellotosinn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788419": [ { "ioc_value": "https://illuminartsigns.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788420": [ { "ioc_value": "https://levintutu.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788421": [ { "ioc_value": "https://magdalena-beaches.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788422": [ { "ioc_value": "https://mavenhousechildcare.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788412": [ { "ioc_value": "https://cms.avanttech.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788413": [ { "ioc_value": "https://danielmoody24.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788414": [ { "ioc_value": "https://ddsupportcare.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788415": [ { "ioc_value": "https://dereviewtoppers.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788416": [ { "ioc_value": "https://durableroofingandgutteringltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788417": [ { "ioc_value": "https://globalfuelenergy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788407": [ { "ioc_value": "https://bewiseinvestor.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788408": [ { "ioc_value": "https://bianchiniodontologia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788409": [ { "ioc_value": "https://blackheath-car-services.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788410": [ { "ioc_value": "https://bmks-bd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788411": [ { "ioc_value": "https://chiefsofcentury.org.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788402": [ { "ioc_value": "https://anjaneypharmainternational.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788403": [ { "ioc_value": "https://ballerscup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788404": [ { "ioc_value": "https://balorea.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788405": [ { "ioc_value": "https://bespokeforyou.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788406": [ { "ioc_value": "https://betingom.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788396": [ { "ioc_value": "https://topbeautytrainingcollege.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788397": [ { "ioc_value": "https://treetrimmingrichmond.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788398": [ { "ioc_value": "https://venoxagency.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788399": [ { "ioc_value": "https://vetromarketing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788400": [ { "ioc_value": "https://victorhugobarbosa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788401": [ { "ioc_value": "https://ammarnomani.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788390": [ { "ioc_value": "https://provill66.hu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788391": [ { "ioc_value": "https://redvecinalzaragoza.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788392": [ { "ioc_value": "https://sketchinsight.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788393": [ { "ioc_value": "https://smarterrealty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788394": [ { "ioc_value": "https://tabaaraka.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788395": [ { "ioc_value": "https://tamayoz.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788385": [ { "ioc_value": "https://mecanicaspike.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788386": [ { "ioc_value": "https://mrlocksmithpsl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788387": [ { "ioc_value": "https://namathejaljawdah.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788388": [ { "ioc_value": "https://prestigedeco.com.sg/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788389": [ { "ioc_value": "https://profesambo.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788379": [ { "ioc_value": "https://jfklimotransportation.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788380": [ { "ioc_value": "https://jms.mypaaltu.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788381": [ { "ioc_value": "https://johnsonmak.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788382": [ { "ioc_value": "https://maisonlj.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:22", "last_seen_utc": "2026-04-15 18:00:53", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788383": [ { "ioc_value": "https://masterclass-seminar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788384": [ { "ioc_value": "https://mealsonthebus.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788377": [ { "ioc_value": "https://hvegas168.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788378": [ { "ioc_value": "https://irelandheritages.ie/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788375": [ { "ioc_value": "https://glassmate.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788376": [ { "ioc_value": "https://grogreen-lr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788370": [ { "ioc_value": "https://cnfinance.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788371": [ { "ioc_value": "https://digitological.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788372": [ { "ioc_value": "https://eaglefrieghtlogistics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788373": [ { "ioc_value": "https://evangelhodiario.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788374": [ { "ioc_value": "https://fashionclubonline.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788364": [ { "ioc_value": "https://bookkeepingfinancial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788365": [ { "ioc_value": "https://branchouttreecareltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788366": [ { "ioc_value": "https://businessguidesforsales.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788367": [ { "ioc_value": "https://ca.pocketrisk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788368": [ { "ioc_value": "https://catchmore.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788369": [ { "ioc_value": "https://chalotravel.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788358": [ { "ioc_value": "https://advancedresearchdomain.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788359": [ { "ioc_value": "https://alkaramfurnitureworld.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788360": [ { "ioc_value": "https://alsar.sn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788361": [ { "ioc_value": "https://annpigneri.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788362": [ { "ioc_value": "https://antimids.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788363": [ { "ioc_value": "https://beckensmoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788352": [ { "ioc_value": "https://shipcaulkers.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788353": [ { "ioc_value": "https://sindicatoregional.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788354": [ { "ioc_value": "https://thetalearn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788355": [ { "ioc_value": "https://varin-elec.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788356": [ { "ioc_value": "https://vn88.gg/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788357": [ { "ioc_value": "https://zdravinaproti.cz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788347": [ { "ioc_value": "https://paulbrownelectric.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788348": [ { "ioc_value": "https://primeroofingandbuildingservicesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788349": [ { "ioc_value": "https://rasketehnikamuuk.ee/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788350": [ { "ioc_value": "https://redcoachtrucking.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788351": [ { "ioc_value": "https://rxhhs.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788341": [ { "ioc_value": "https://josdream.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788342": [ { "ioc_value": "https://kaesercustomhomes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788343": [ { "ioc_value": "https://kompetenstrappan.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788344": [ { "ioc_value": "https://m4newauto.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788345": [ { "ioc_value": "https://makemoneyswiftly.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788346": [ { "ioc_value": "https://obatpenyakitginjal09.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788335": [ { "ioc_value": "https://fabrica.et/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788336": [ { "ioc_value": "https://familyhomefloorplans.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788337": [ { "ioc_value": "https://firenzealluvione.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788338": [ { "ioc_value": "https://fundacionsemilladeamor.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788339": [ { "ioc_value": "https://highwayengineeringsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788340": [ { "ioc_value": "https://homecarewaterproofing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788329": [ { "ioc_value": "https://carebridgepc.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788330": [ { "ioc_value": "https://chsupply.tech/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788331": [ { "ioc_value": "https://deboraescobar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788332": [ { "ioc_value": "https://desitrips.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788333": [ { "ioc_value": "https://devivomanagement.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788334": [ { "ioc_value": "https://environmentaldaily.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788327": [ { "ioc_value": "https://amgmllc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788328": [ { "ioc_value": "https://bahujanhitaya.org.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788325": [ { "ioc_value": "https://scoutmanagementagency.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788326": [ { "ioc_value": "https://zclinic.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788319": [ { "ioc_value": "https://maschineowners.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788320": [ { "ioc_value": "https://mwmagency.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788321": [ { "ioc_value": "https://nongbuarawe.chaiyaphum.police.go.th/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788322": [ { "ioc_value": "https://parrottsolutions1.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788323": [ { "ioc_value": "https://radio-vizioni.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788324": [ { "ioc_value": "https://sageequities.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788317": [ { "ioc_value": "https://magazine.jolz.sa/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788318": [ { "ioc_value": "https://malagasuite.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788315": [ { "ioc_value": "https://kbbathroomfitters.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788316": [ { "ioc_value": "https://lauradove.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788309": [ { "ioc_value": "https://copierserviceconnection.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788310": [ { "ioc_value": "https://depilalaser.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788311": [ { "ioc_value": "https://forcevision.hu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788312": [ { "ioc_value": "https://forestry.comptonestate-services.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788313": [ { "ioc_value": "https://garageplusnw.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788314": [ { "ioc_value": "https://hertfordshireroofingandgutteringrepairs.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:39:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788304": [ { "ioc_value": "https://ameslwv.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788305": [ { "ioc_value": "https://andisrdc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788306": [ { "ioc_value": "https://argeau.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788307": [ { "ioc_value": "https://calspecrestoration.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788308": [ { "ioc_value": "https://canelabistromadrid.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788298": [ { "ioc_value": "https://sunclickusa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788299": [ { "ioc_value": "https://szi-homes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788300": [ { "ioc_value": "https://uniqueprofessionals.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788301": [ { "ioc_value": "https://100.31.95.216/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788302": [ { "ioc_value": "https://affordablemoversfortmyers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788303": [ { "ioc_value": "https://alsengineering.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788292": [ { "ioc_value": "https://pmsons.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788293": [ { "ioc_value": "https://resifip.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788294": [ { "ioc_value": "https://restoredbypristine.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788295": [ { "ioc_value": "https://roosyspirit.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788296": [ { "ioc_value": "https://salzhomecare.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788297": [ { "ioc_value": "https://smartcityrealtors.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788287": [ { "ioc_value": "https://inttra.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788288": [ { "ioc_value": "https://medecinepharmaceutique.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788289": [ { "ioc_value": "https://noise2k.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788290": [ { "ioc_value": "https://nolimitroofingandrestoration.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788291": [ { "ioc_value": "https://permaethos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788281": [ { "ioc_value": "https://ekahighpressurefittings.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788282": [ { "ioc_value": "https://eurekamultipleservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788283": [ { "ioc_value": "https://evrenselfilmlerim.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788284": [ { "ioc_value": "https://fourseasonspr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788285": [ { "ioc_value": "https://georgiaitp.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788286": [ { "ioc_value": "https://hawkeyetreats.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788277": [ { "ioc_value": "https://call-united.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788278": [ { "ioc_value": "https://chewy.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788279": [ { "ioc_value": "https://ctseoexperts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788280": [ { "ioc_value": "https://divinedishes.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788272": [ { "ioc_value": "https://attech.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788273": [ { "ioc_value": "https://autocareacademy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788274": [ { "ioc_value": "https://barguidenotes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788275": [ { "ioc_value": "https://barlanonna.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788276": [ { "ioc_value": "https://behargintza-be.biz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788267": [ { "ioc_value": "https://abbeyelizabethsykes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788268": [ { "ioc_value": "https://abcdngo.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788269": [ { "ioc_value": "https://alagoinhastransportes.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788270": [ { "ioc_value": "https://ariatec.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788271": [ { "ioc_value": "https://atlantistowingservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788261": [ { "ioc_value": "https://romanatruckrepairs.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788262": [ { "ioc_value": "https://slidingdesk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788263": [ { "ioc_value": "https://summerhillinstitute.com.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788264": [ { "ioc_value": "https://toniessler.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788265": [ { "ioc_value": "https://usflygoat.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788266": [ { "ioc_value": "https://volatforex.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788256": [ { "ioc_value": "https://paginas-web-baratas.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788257": [ { "ioc_value": "https://pathwaytohopellc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788258": [ { "ioc_value": "https://proyectosdomaria.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788259": [ { "ioc_value": "https://quwatt.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788260": [ { "ioc_value": "https://rdhacademy.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788250": [ { "ioc_value": "https://ledgergavel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788251": [ { "ioc_value": "https://liquidblue.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788252": [ { "ioc_value": "https://michiganmagictires.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788253": [ { "ioc_value": "https://myonlinetools.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788254": [ { "ioc_value": "https://nacionsolar.mx/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788255": [ { "ioc_value": "https://nossopastoralemao.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788245": [ { "ioc_value": "https://gibinsight.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788246": [ { "ioc_value": "https://guardianimmigration.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788247": [ { "ioc_value": "https://happymore.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788248": [ { "ioc_value": "https://hierleefik.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788249": [ { "ioc_value": "https://k2studyabroad.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788239": [ { "ioc_value": "https://businesstipsforrevenue.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788240": [ { "ioc_value": "https://centralroofinglimited.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788241": [ { "ioc_value": "https://deathbecomesher.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788242": [ { "ioc_value": "https://digitalmindcareindia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788243": [ { "ioc_value": "https://fodeco.com.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788244": [ { "ioc_value": "https://getbizi.io/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788234": [ { "ioc_value": "https://acrisiogroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788235": [ { "ioc_value": "https://airxpressdrafting.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788236": [ { "ioc_value": "https://ajitintl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788237": [ { "ioc_value": "https://an-instrumente.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788238": [ { "ioc_value": "https://appliancerepairsabilene.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788228": [ { "ioc_value": "https://tawakkalbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788229": [ { "ioc_value": "https://tropicalct.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788230": [ { "ioc_value": "https://vimalrajpanneerselvam.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788231": [ { "ioc_value": "https://visitheilhornet.no/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788232": [ { "ioc_value": "https://ziggyshomeimprovementct.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788233": [ { "ioc_value": "https://46.101.132.33/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788227": [ { "ioc_value": "https://smartkidsmada.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788225": [ { "ioc_value": "https://popo.drcoders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788226": [ { "ioc_value": "https://quesosierradecadiz.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788219": [ { "ioc_value": "https://gsp.adv.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788220": [ { "ioc_value": "https://lifemagazine.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788221": [ { "ioc_value": "https://londonloftsandbasements.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788222": [ { "ioc_value": "https://medspluscare.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788223": [ { "ioc_value": "https://oneconnectverse.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788224": [ { "ioc_value": "https://phibrows-seminars.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788214": [ { "ioc_value": "https://elevva.agency/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788215": [ { "ioc_value": "https://ezconsultoria.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788216": [ { "ioc_value": "https://farodevida.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788217": [ { "ioc_value": "https://fsejobs.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788218": [ { "ioc_value": "https://fullscopemanagement.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788208": [ { "ioc_value": "https://clearwatermovingservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788209": [ { "ioc_value": "https://cleitefernandes.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788210": [ { "ioc_value": "https://cpminterior.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788211": [ { "ioc_value": "https://doublebubbleslot.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788212": [ { "ioc_value": "https://drmailutha.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788213": [ { "ioc_value": "https://duboiscollege.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788202": [ { "ioc_value": "https://tuoperito.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788203": [ { "ioc_value": "https://unitymusicschool.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788204": [ { "ioc_value": "https://alturasvillanueva.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788205": [ { "ioc_value": "https://bookdayz.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788206": [ { "ioc_value": "https://celeirodedeus.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788207": [ { "ioc_value": "https://cheaphardware.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788197": [ { "ioc_value": "https://sro.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788198": [ { "ioc_value": "https://suhadruggobi.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788199": [ { "ioc_value": "https://sunvalleyes.depedparanaquecity.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788200": [ { "ioc_value": "https://themickingco.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788201": [ { "ioc_value": "https://theproscare.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788191": [ { "ioc_value": "https://nikosrestaurant.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788192": [ { "ioc_value": "https://obatkanker-serviks.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788193": [ { "ioc_value": "https://productsecure.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788194": [ { "ioc_value": "https://rcnasesores.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788195": [ { "ioc_value": "https://robocash.com.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788196": [ { "ioc_value": "https://ruqmana.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788186": [ { "ioc_value": "https://jjhomeimprovements.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788187": [ { "ioc_value": "https://makecontractorsgreatagain.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788188": [ { "ioc_value": "https://mfeuz.ch/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788189": [ { "ioc_value": "https://mueblesobregon.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788190": [ { "ioc_value": "https://nationalsecurestorage.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788179": [ { "ioc_value": "https://guildfordchildcarecentre.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788180": [ { "ioc_value": "https://habitatinteriors.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788181": [ { "ioc_value": "https://hzarchitects.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788182": [ { "ioc_value": "https://imagesuitepr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788183": [ { "ioc_value": "https://integritymortgagellc.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788184": [ { "ioc_value": "https://interstateappraisalca.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788185": [ { "ioc_value": "privat7-wave.bry6moxel.in.net", "ioc_type": "domain", "threat_type": "payload_delivery", "malware": "js.clearfake", "malware_alias": null, "malware_printable": "ClearFake", "first_seen_utc": "2026-04-14 11:38:28", "last_seen_utc": "2026-04-14 11:40:05", "confidence_level": 100, "is_compromised": false, "reference": null, "tags": "ClearFake", "anonymous": "0", "reporter": "threatcat_ch" } ], "1788176": [ { "ioc_value": "https://eadcapacitacao.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788177": [ { "ioc_value": "https://effectiveguidesforgrowth.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788178": [ { "ioc_value": "https://esim.gepanda.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788175": [ { "ioc_value": "https://didigroup.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788170": [ { "ioc_value": "https://bigbossasiaslot.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788171": [ { "ioc_value": "https://bootsontheroof.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788172": [ { "ioc_value": "https://callacabamsterdam.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788173": [ { "ioc_value": "https://closetk.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788174": [ { "ioc_value": "https://coords.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788164": [ { "ioc_value": "https://adelehawkes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788165": [ { "ioc_value": "https://answerjournal.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788166": [ { "ioc_value": "https://aqarco.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788167": [ { "ioc_value": "https://argirisangelopoulos.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788168": [ { "ioc_value": "https://azmotorparts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788169": [ { "ioc_value": "https://barretoneves.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788158": [ { "ioc_value": "https://shehersaaz.com.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788159": [ { "ioc_value": "https://signatis.co.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788160": [ { "ioc_value": "https://smokecenter.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788161": [ { "ioc_value": "https://svdo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788162": [ { "ioc_value": "https://velbujdhotel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788163": [ { "ioc_value": "https://vmpropertysolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788153": [ { "ioc_value": "https://qbclerks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788154": [ { "ioc_value": "https://samriddhabeachresort.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788155": [ { "ioc_value": "https://sbobet.net.cm/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788156": [ { "ioc_value": "https://scottishcommons.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788157": [ { "ioc_value": "https://sevenkband.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788147": [ { "ioc_value": "https://lastcallforredemption.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788148": [ { "ioc_value": "https://lisaray893.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788149": [ { "ioc_value": "https://miamigardensmovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788150": [ { "ioc_value": "https://nataliegonchar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788151": [ { "ioc_value": "https://nettoyage-proclean-paris.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788152": [ { "ioc_value": "https://phatstrength.club/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788142": [ { "ioc_value": "https://futbol.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788143": [ { "ioc_value": "https://guardianpublicadjusters.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788144": [ { "ioc_value": "https://infinittapinturas.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788145": [ { "ioc_value": "https://inspiredshares.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788146": [ { "ioc_value": "https://jaimitchellproperties.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788136": [ { "ioc_value": "https://ddcustomllc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788137": [ { "ioc_value": "https://djsmoothholy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788138": [ { "ioc_value": "https://dronesexperience.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788139": [ { "ioc_value": "https://dunebuggydubai.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788140": [ { "ioc_value": "https://ezpzjunkremoval.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788141": [ { "ioc_value": "https://fa-alter-technik.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788130": [ { "ioc_value": "https://zonadigitalconil.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788131": [ { "ioc_value": "https://academy.liveyourdreamsafrica.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788132": [ { "ioc_value": "https://amadviserslimited.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788133": [ { "ioc_value": "https://bodrumyachtservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788134": [ { "ioc_value": "https://bolcsode.felsopakony.hu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788135": [ { "ioc_value": "https://centrocomerciallaestrella.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788126": [ { "ioc_value": "https://simplesttastes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788127": [ { "ioc_value": "https://sisekotechnologies.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788128": [ { "ioc_value": "https://techyrobots.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788129": [ { "ioc_value": "https://tgaf.or.tz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788122": [ { "ioc_value": "https://pompes-funebres-defruit.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788123": [ { "ioc_value": "https://reviewztech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788124": [ { "ioc_value": "https://seoserviceinindia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788125": [ { "ioc_value": "https://siestaofficiel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788117": [ { "ioc_value": "https://meltonpediatrictherapy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788118": [ { "ioc_value": "https://miamidolphinsjerseys.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788119": [ { "ioc_value": "https://mtglobal.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788120": [ { "ioc_value": "https://noscalpelvasectomy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788121": [ { "ioc_value": "https://parlaman.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788111": [ { "ioc_value": "https://home.learningroom.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788112": [ { "ioc_value": "https://iasminaburlacu.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788113": [ { "ioc_value": "https://integritylawgrp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788114": [ { "ioc_value": "https://kicksremixed.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788115": [ { "ioc_value": "https://kidsninjawarrior.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788116": [ { "ioc_value": "https://lotusblossomconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788106": [ { "ioc_value": "https://fesouza.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788107": [ { "ioc_value": "https://focusireland.granite-web.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788108": [ { "ioc_value": "https://gbd-tech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788109": [ { "ioc_value": "https://gosunnysidesolar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788110": [ { "ioc_value": "https://hindiwiki.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788100": [ { "ioc_value": "https://colorsofcapital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788101": [ { "ioc_value": "https://develofytech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788102": [ { "ioc_value": "https://djlandscapingltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788103": [ { "ioc_value": "https://doubleddemolition.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788104": [ { "ioc_value": "https://exploringourtruth.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788105": [ { "ioc_value": "https://fbs-fahrzeugbau.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788095": [ { "ioc_value": "https://ambavgarhpalace.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788096": [ { "ioc_value": "https://bakht.cm/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788097": [ { "ioc_value": "https://bestewonen.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788098": [ { "ioc_value": "https://biwal.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788099": [ { "ioc_value": "https://brandrepublic.agency/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788089": [ { "ioc_value": "https://unit2london.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788090": [ { "ioc_value": "https://unitarianbahai.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788091": [ { "ioc_value": "https://universeautoship.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788092": [ { "ioc_value": "https://vehiculos.transportamostucoche.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788093": [ { "ioc_value": "https://alexakisae.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788094": [ { "ioc_value": "https://alignedconsultants.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788087": [ { "ioc_value": "https://ragdollscatering.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788088": [ { "ioc_value": "https://supremepropertysolutionsltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:02", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788084": [ { "ioc_value": "https://piratesammason.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788085": [ { "ioc_value": "https://pmcitrus.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788086": [ { "ioc_value": "https://powellrenovations.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788079": [ { "ioc_value": "https://hyrdistribuciones.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788080": [ { "ioc_value": "https://ingeniusconsultores.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788081": [ { "ioc_value": "https://nhmark.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788082": [ { "ioc_value": "https://octowebstudios.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788083": [ { "ioc_value": "https://pathtohomeapproval.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:38:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788076": [ { "ioc_value": "https://gametogel2d.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788077": [ { "ioc_value": "https://groganbrothersmoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788078": [ { "ioc_value": "https://halcyonapartments.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788074": [ { "ioc_value": "https://earthscapenj.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788075": [ { "ioc_value": "https://fiscallfranqueadora.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788068": [ { "ioc_value": "https://albertmovingandstorage.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788069": [ { "ioc_value": "https://alightmtion.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788070": [ { "ioc_value": "https://amaarilabs.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788071": [ { "ioc_value": "https://anasbhbh.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788072": [ { "ioc_value": "https://asictonline.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788073": [ { "ioc_value": "https://atrion.cz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788062": [ { "ioc_value": "https://taxgod.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788063": [ { "ioc_value": "https://telknight.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788064": [ { "ioc_value": "https://theniceoffice.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788065": [ { "ioc_value": "https://twoworldsonefamily.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788066": [ { "ioc_value": "https://uniteqe.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788067": [ { "ioc_value": "https://victorypoolconstruction.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:52", "last_seen_utc": "2026-04-15 17:00:54", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788057": [ { "ioc_value": "https://prestigeblindcompany.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788058": [ { "ioc_value": "https://promindsinc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788059": [ { "ioc_value": "https://soboldents.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788060": [ { "ioc_value": "https://startmarksolution.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788061": [ { "ioc_value": "https://statproginc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788051": [ { "ioc_value": "https://loveworldvirtualchurch.org.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788052": [ { "ioc_value": "https://martintrunschke.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788053": [ { "ioc_value": "https://mybusweb.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788054": [ { "ioc_value": "https://onetrip.lk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788055": [ { "ioc_value": "https://ostseehauswerker.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788056": [ { "ioc_value": "https://powersuitportraits.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788045": [ { "ioc_value": "https://hackathonaemotech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788046": [ { "ioc_value": "https://inovnis.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788047": [ { "ioc_value": "https://inursestaff.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788048": [ { "ioc_value": "https://jeanmayerpreschool.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788049": [ { "ioc_value": "https://jrrecruiting.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788050": [ { "ioc_value": "https://lepi.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788039": [ { "ioc_value": "https://brf-skutskepparen52.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788040": [ { "ioc_value": "https://cabinetdentairedelaliberte.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788041": [ { "ioc_value": "https://content-writing.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788042": [ { "ioc_value": "https://davisgrad.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788043": [ { "ioc_value": "https://dsgenergy.com.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788044": [ { "ioc_value": "https://eleanorcrook.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788034": [ { "ioc_value": "https://amethystclinicvet.ro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788035": [ { "ioc_value": "https://arquitetosjundiai.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788036": [ { "ioc_value": "https://aurablissholidays.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788037": [ { "ioc_value": "https://aylaproperty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788038": [ { "ioc_value": "https://besthi.io/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788028": [ { "ioc_value": "https://quotevista.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788029": [ { "ioc_value": "https://safeguardips.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788030": [ { "ioc_value": "https://thezenladakh.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788031": [ { "ioc_value": "https://valonmarketplace.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788032": [ { "ioc_value": "https://veracruz.today/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788033": [ { "ioc_value": "https://abc.neptune-oil.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788026": [ { "ioc_value": "https://phoenixbusinessolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788027": [ { "ioc_value": "https://placemaking.org.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788021": [ { "ioc_value": "https://lnx.keepyoung.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788022": [ { "ioc_value": "https://mansourweb.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788023": [ { "ioc_value": "https://meetswiss-transfers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788024": [ { "ioc_value": "https://mindwings.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788025": [ { "ioc_value": "https://mp-k9security.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788015": [ { "ioc_value": "https://enriched.ie/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788016": [ { "ioc_value": "https://esquivelbailbond.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788017": [ { "ioc_value": "https://gravityx.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788018": [ { "ioc_value": "https://holewinskigroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788019": [ { "ioc_value": "https://jizake.jp/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788020": [ { "ioc_value": "https://jsmlandscapingltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788010": [ { "ioc_value": "https://asljungamekaniska.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788011": [ { "ioc_value": "https://bullshitarium.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788012": [ { "ioc_value": "https://decorglassfusion.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788013": [ { "ioc_value": "https://demythbio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788014": [ { "ioc_value": "https://edenroofcareltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788004": [ { "ioc_value": "https://ramadori.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788005": [ { "ioc_value": "https://southfloridademolition.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788006": [ { "ioc_value": "https://t2-renovatec.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788007": [ { "ioc_value": "https://zengear.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788008": [ { "ioc_value": "https://alfa-redi.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788009": [ { "ioc_value": "https://antply.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787998": [ { "ioc_value": "https://meoskills.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787999": [ { "ioc_value": "https://mudanzasmtr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788000": [ { "ioc_value": "https://naxlaw.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788001": [ { "ioc_value": "https://pariya.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788002": [ { "ioc_value": "https://peakperformanceplus.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1788003": [ { "ioc_value": "https://premiumnwplumbing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787993": [ { "ioc_value": "https://cairnswestrotary.org.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787994": [ { "ioc_value": "https://damastech.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787995": [ { "ioc_value": "https://eshkol-ltd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787996": [ { "ioc_value": "https://farohidehlaw.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787997": [ { "ioc_value": "https://finzure.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787987": [ { "ioc_value": "https://thefragranceexchange.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787988": [ { "ioc_value": "https://thequickkicks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787989": [ { "ioc_value": "https://viagmmy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787990": [ { "ioc_value": "https://yachtregistration.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787991": [ { "ioc_value": "https://a-1appliancerepairservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787992": [ { "ioc_value": "https://aditihomes.impactrixadagency.co.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787982": [ { "ioc_value": "https://saas-lift.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787983": [ { "ioc_value": "https://salusa.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787984": [ { "ioc_value": "https://ssplsecurity.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787985": [ { "ioc_value": "https://subarugovap4s.vn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787986": [ { "ioc_value": "https://thaitourism.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787976": [ { "ioc_value": "https://ionfuture.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787977": [ { "ioc_value": "https://milkfrotherguide.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787978": [ { "ioc_value": "https://montepescoli.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787979": [ { "ioc_value": "https://msgadgetszone.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787980": [ { "ioc_value": "https://noor-cosmetic.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787981": [ { "ioc_value": "https://pettusfoundation.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787974": [ { "ioc_value": "https://gutscheineplus.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787975": [ { "ioc_value": "https://heartandsoulretriever.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787969": [ { "ioc_value": "https://aiweb.techtitanstudio.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787970": [ { "ioc_value": "https://bauforge.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787971": [ { "ioc_value": "https://bogey.golf/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787972": [ { "ioc_value": "https://cocube.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787973": [ { "ioc_value": "https://crownlineroofingltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787963": [ { "ioc_value": "https://snackyz.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787964": [ { "ioc_value": "https://sondolip.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787965": [ { "ioc_value": "https://standortforum.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787966": [ { "ioc_value": "https://stemlab.edufuntechnik.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787967": [ { "ioc_value": "https://youngeektech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787968": [ { "ioc_value": "https://agh-attorneys.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787958": [ { "ioc_value": "https://onwheels.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787959": [ { "ioc_value": "https://popularworldonline.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787960": [ { "ioc_value": "https://preschoolrock.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787961": [ { "ioc_value": "https://radiolacheverisima.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787962": [ { "ioc_value": "https://smcvocalcoachingja.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787953": [ { "ioc_value": "https://ladylakemovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787954": [ { "ioc_value": "https://login.carnow.ge/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787955": [ { "ioc_value": "https://lucadamilano.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787956": [ { "ioc_value": "https://melamdo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787957": [ { "ioc_value": "https://new.ana-soft.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787947": [ { "ioc_value": "https://disruptivetechnology.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787948": [ { "ioc_value": "https://doorstackexclusive.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787949": [ { "ioc_value": "https://housemasters.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787950": [ { "ioc_value": "https://indoboardgames.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787951": [ { "ioc_value": "https://inspiredassistance.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787952": [ { "ioc_value": "https://jurriaanpersyn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787942": [ { "ioc_value": "https://atlantastonecentre.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787943": [ { "ioc_value": "https://carremovalcashforcarsbrisbane.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787944": [ { "ioc_value": "https://chadeverettharris.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787945": [ { "ioc_value": "https://coworking.parquecentro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787946": [ { "ioc_value": "https://dinhcumy.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787937": [ { "ioc_value": "https://transformationalk9.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787938": [ { "ioc_value": "https://uniqueprime.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787939": [ { "ioc_value": "https://yallatv.my.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787940": [ { "ioc_value": "https://3brotherswindows.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787941": [ { "ioc_value": "https://allstarlawnandlandscapeservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787931": [ { "ioc_value": "https://swift-immigration.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787932": [ { "ioc_value": "https://teckflux.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787933": [ { "ioc_value": "https://texasqualitysolar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787934": [ { "ioc_value": "https://titimashipping.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787935": [ { "ioc_value": "https://tom-automation.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787936": [ { "ioc_value": "https://trabuco-canyon.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787926": [ { "ioc_value": "https://marcforwildlife.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787927": [ { "ioc_value": "https://predictia.life/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787928": [ { "ioc_value": "https://rohuaiapitsa.ee/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787929": [ { "ioc_value": "https://sereniteatravel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787930": [ { "ioc_value": "https://speed2000bd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787922": [ { "ioc_value": "https://fullkolortextil.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787923": [ { "ioc_value": "https://gcsquared.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787924": [ { "ioc_value": "https://groutcleaningperth.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787925": [ { "ioc_value": "https://hirexws.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787916": [ { "ioc_value": "https://aonecabs.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787917": [ { "ioc_value": "https://breastsurgeon-pune.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787918": [ { "ioc_value": "https://careyestatesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787919": [ { "ioc_value": "https://diamondjo.world/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787920": [ { "ioc_value": "https://fallaportdesilla.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787921": [ { "ioc_value": "https://frconsorcioseinvestimentos.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787911": [ { "ioc_value": "https://thisnthatshop.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787912": [ { "ioc_value": "https://unitedfaceofamerica.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787913": [ { "ioc_value": "https://adebamowo.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787914": [ { "ioc_value": "https://aemuntanya.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787915": [ { "ioc_value": "https://andrewmueller86.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787905": [ { "ioc_value": "https://riskygrapes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787906": [ { "ioc_value": "https://satex.com.ar/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787907": [ { "ioc_value": "https://servimatic.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787908": [ { "ioc_value": "https://southcoastflagging.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787909": [ { "ioc_value": "https://sutherlandcarsales.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787910": [ { "ioc_value": "https://thewebsiteplanners.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787899": [ { "ioc_value": "https://modamaskavo.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787900": [ { "ioc_value": "https://naivedhyam.org.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787901": [ { "ioc_value": "https://nextphaserecovery.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787902": [ { "ioc_value": "https://osakahalalfood.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787903": [ { "ioc_value": "https://popochosecohotelnuqui.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787904": [ { "ioc_value": "https://priscille-djamfa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:09", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787894": [ { "ioc_value": "https://marleydecor.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787895": [ { "ioc_value": "https://mayorconstruction.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787896": [ { "ioc_value": "https://mdb.ie/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787897": [ { "ioc_value": "https://migliaro.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787898": [ { "ioc_value": "https://mlmstory.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:08", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787888": [ { "ioc_value": "https://ffduopartners.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787889": [ { "ioc_value": "https://gsmtax.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787890": [ { "ioc_value": "https://junogroup.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787891": [ { "ioc_value": "https://karensullivanpuglover.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787892": [ { "ioc_value": "https://kompass-betreuung.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787893": [ { "ioc_value": "https://lassy.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:07", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787882": [ { "ioc_value": "https://adultseo.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787883": [ { "ioc_value": "https://avikagroups.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787884": [ { "ioc_value": "https://bevolve.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787885": [ { "ioc_value": "https://boldthrives.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787886": [ { "ioc_value": "https://capitalpowerinc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787887": [ { "ioc_value": "https://escort-service-goa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:06", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787877": [ { "ioc_value": "https://margroup.com.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787878": [ { "ioc_value": "https://meownime.my.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787879": [ { "ioc_value": "https://meredisciple.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787880": [ { "ioc_value": "https://monicamagalhaes.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787881": [ { "ioc_value": "https://somosdiseno.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787876": [ { "ioc_value": "https://go.for-it.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787874": [ { "ioc_value": "https://evansandenglert.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787875": [ { "ioc_value": "https://gloriousscrecruitment.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:37:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787868": [ { "ioc_value": "https://stlucialuxurytours.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787869": [ { "ioc_value": "https://ziegelei-akademie.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787870": [ { "ioc_value": "https://afrosafe-eu.africa/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787871": [ { "ioc_value": "https://barbaraburke.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787872": [ { "ioc_value": "https://bre-international.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787873": [ { "ioc_value": "https://efreeder.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787863": [ { "ioc_value": "https://motanitailors.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787864": [ { "ioc_value": "https://myhealthcarebilling.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787865": [ { "ioc_value": "https://ontronics.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787866": [ { "ioc_value": "https://skanbo.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787867": [ { "ioc_value": "https://sonucollege.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787857": [ { "ioc_value": "https://divinecaregiver.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787858": [ { "ioc_value": "https://forsterbodytherapy.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787859": [ { "ioc_value": "https://giftedofafrica.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787860": [ { "ioc_value": "https://jdrop.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787861": [ { "ioc_value": "https://laab-thai.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787862": [ { "ioc_value": "https://lisconstructiontx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787852": [ { "ioc_value": "https://boilermill.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787853": [ { "ioc_value": "https://certifyme.co.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787854": [ { "ioc_value": "https://chiefmarketingstrategist.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787855": [ { "ioc_value": "https://daatwieze.pl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787856": [ { "ioc_value": "https://daftarorangkaya.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787846": [ { "ioc_value": "https://thesparkmag.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787847": [ { "ioc_value": "https://vecte-algerie.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787848": [ { "ioc_value": "https://veebenjamin.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787849": [ { "ioc_value": "https://vladaustudio.ro/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787850": [ { "ioc_value": "https://africansindeutschland.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787851": [ { "ioc_value": "https://americanautotransport.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787841": [ { "ioc_value": "https://paulschick.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787842": [ { "ioc_value": "https://pothain-moulages.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787843": [ { "ioc_value": "https://rxbodyworx.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787844": [ { "ioc_value": "https://shriomkarjeweller.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787845": [ { "ioc_value": "https://sunsetcampmasaimara.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:54", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787835": [ { "ioc_value": "https://filmodigital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787836": [ { "ioc_value": "https://haruconstructions.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787837": [ { "ioc_value": "https://kenvocars.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787838": [ { "ioc_value": "https://lickprint.co.zw/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787839": [ { "ioc_value": "https://mobilelocksmithus.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787840": [ { "ioc_value": "https://paragansolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:53", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787829": [ { "ioc_value": "https://ultramfsgroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787830": [ { "ioc_value": "https://aachenhc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787831": [ { "ioc_value": "https://accuonproject.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787832": [ { "ioc_value": "https://content.derbayerischeclub.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787833": [ { "ioc_value": "https://coralmustang.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787834": [ { "ioc_value": "https://dallasdental.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:52", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787826": [ { "ioc_value": "https://theblueturf.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787827": [ { "ioc_value": "https://topbranchtreeandgardenservicesltd.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787828": [ { "ioc_value": "https://trofeuofensa.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:51", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787823": [ { "ioc_value": "https://seobloggerhub.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787824": [ { "ioc_value": "https://silvertechconsulting.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787825": [ { "ioc_value": "https://sverigesstorstabyggprojekt.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787818": [ { "ioc_value": "https://jackscarwashes.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787819": [ { "ioc_value": "https://media-plus.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787820": [ { "ioc_value": "https://munkebo-antennelaug.dk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787821": [ { "ioc_value": "https://oriontravel.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787822": [ { "ioc_value": "https://preachintheword.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787813": [ { "ioc_value": "https://efix.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787814": [ { "ioc_value": "https://essentialspressurewashing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787815": [ { "ioc_value": "https://goodbudsgenetics.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787816": [ { "ioc_value": "https://gstspecialty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787817": [ { "ioc_value": "https://ibook.optissimo.xyz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787807": [ { "ioc_value": "https://247sosservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787808": [ { "ioc_value": "https://aigle-construction.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787809": [ { "ioc_value": "https://axelspr.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787810": [ { "ioc_value": "https://babruonline.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787811": [ { "ioc_value": "https://bellalucaconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787812": [ { "ioc_value": "https://bndtreeservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787802": [ { "ioc_value": "https://rabindra-rachanabali.rabindranath.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787803": [ { "ioc_value": "https://rembat.my/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787804": [ { "ioc_value": "https://tangdevelopmentservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787805": [ { "ioc_value": "https://vintagehillsresorts.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787806": [ { "ioc_value": "https://24-hr.vip/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787796": [ { "ioc_value": "https://insurebw.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787797": [ { "ioc_value": "https://jandcopsychology.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787798": [ { "ioc_value": "https://jewelry.nymbis.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787799": [ { "ioc_value": "https://lachen-lebenslust.de/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787800": [ { "ioc_value": "https://marsgaming.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787801": [ { "ioc_value": "https://piercingnearme.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:41", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787791": [ { "ioc_value": "https://fieraagricolavalsangone.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787792": [ { "ioc_value": "https://flyonofficial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787793": [ { "ioc_value": "https://freejunkcarhauling.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787794": [ { "ioc_value": "https://fresconews.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787795": [ { "ioc_value": "https://instep.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:40", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787785": [ { "ioc_value": "https://sam-n.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787786": [ { "ioc_value": "https://sisl-bd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787787": [ { "ioc_value": "https://trendoraonlineshop.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787788": [ { "ioc_value": "https://trendwoodgibraltar.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787789": [ { "ioc_value": "https://aadiconsulting.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787790": [ { "ioc_value": "https://ceprap.celam.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:39", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787779": [ { "ioc_value": "https://mbmalikumz.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787780": [ { "ioc_value": "https://morettiadv.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787781": [ { "ioc_value": "https://myspeakersboutique.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787782": [ { "ioc_value": "https://outdoorworld.world/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787783": [ { "ioc_value": "https://rmttc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787784": [ { "ioc_value": "https://saddleriverroofing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:38", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787776": [ { "ioc_value": "https://hiebspressurewashing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787777": [ { "ioc_value": "https://krkaviation.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787778": [ { "ioc_value": "https://licasatreatment.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787774": [ { "ioc_value": "https://delaneyfeatherston.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787775": [ { "ioc_value": "https://floridacustomsbroker.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787768": [ { "ioc_value": "https://alphacoreroofing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787769": [ { "ioc_value": "https://anotherangle.biz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787770": [ { "ioc_value": "https://armandarougroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787771": [ { "ioc_value": "https://blackbookinvestments.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787772": [ { "ioc_value": "https://cafebonny.ae/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787773": [ { "ioc_value": "https://chigurucreations.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787763": [ { "ioc_value": "https://muavaigiacao.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787764": [ { "ioc_value": "https://paniexpress.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787765": [ { "ioc_value": "https://pickleballmastery.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787766": [ { "ioc_value": "https://psl.neptune-oil.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787767": [ { "ioc_value": "https://townsendpharmacy.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787757": [ { "ioc_value": "https://khannasales.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787758": [ { "ioc_value": "https://kombat.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787759": [ { "ioc_value": "https://lostriverestates.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787760": [ { "ioc_value": "https://maritimeuddannelser.dk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787761": [ { "ioc_value": "https://mbt.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787762": [ { "ioc_value": "https://mmlegalconsultants.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787752": [ { "ioc_value": "https://dagelijksonderwerp.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787753": [ { "ioc_value": "https://dreamwealthrealty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787754": [ { "ioc_value": "https://generalaccessoriesinc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787755": [ { "ioc_value": "https://ghostbark.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787756": [ { "ioc_value": "https://itechhardware.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787746": [ { "ioc_value": "https://thechefdan.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787747": [ { "ioc_value": "https://adriahousedubrovnik.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787748": [ { "ioc_value": "https://ahlalnashama.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787749": [ { "ioc_value": "https://app.lamet.com.ve/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787750": [ { "ioc_value": "https://beviralnews.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787751": [ { "ioc_value": "https://bookiewatchdog.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787740": [ { "ioc_value": "https://nationalconsumerrights.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787741": [ { "ioc_value": "https://removers.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787742": [ { "ioc_value": "https://saniacs.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787743": [ { "ioc_value": "https://sollicitatiebriefvoorbeeld.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787744": [ { "ioc_value": "https://starrontours.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787745": [ { "ioc_value": "https://tantrainsights.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:27", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787735": [ { "ioc_value": "https://cyberstreetsmart.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787736": [ { "ioc_value": "https://damarquemedia.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787737": [ { "ioc_value": "https://denkendthuis.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787738": [ { "ioc_value": "https://elitecustompoolsinc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787739": [ { "ioc_value": "https://groupelaporte.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:26", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787729": [ { "ioc_value": "https://agentira.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787730": [ { "ioc_value": "https://baristaweb.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787731": [ { "ioc_value": "https://certificacion-coaching.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787732": [ { "ioc_value": "https://cleanityuhself.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787733": [ { "ioc_value": "https://cosce.sn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787734": [ { "ioc_value": "https://crop-sun.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:25", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787726": [ { "ioc_value": "https://aalandscaping.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787727": [ { "ioc_value": "https://africaneconomicglobalconvergence.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787728": [ { "ioc_value": "https://agencenathtech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787722": [ { "ioc_value": "https://santetraps.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787723": [ { "ioc_value": "https://sitorapharma.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787724": [ { "ioc_value": "https://tommadodsbogoteborg.se/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787725": [ { "ioc_value": "https://xn----gtbmbhcymny.xn--p1ai/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787716": [ { "ioc_value": "https://knowtofuture.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787717": [ { "ioc_value": "https://manilagrandrealty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787718": [ { "ioc_value": "https://mathis-hain.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787719": [ { "ioc_value": "https://neumannschool.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787720": [ { "ioc_value": "https://rafaelsfurniture.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787721": [ { "ioc_value": "https://reimonstracking.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787711": [ { "ioc_value": "https://engelhard.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787712": [ { "ioc_value": "https://flaviovaleri.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787713": [ { "ioc_value": "https://fordlin.ie/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787714": [ { "ioc_value": "https://garciayarnold.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787715": [ { "ioc_value": "https://infinitylyon.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787705": [ { "ioc_value": "https://ataleunfolds.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787706": [ { "ioc_value": "https://bestieshoes.co.il/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787707": [ { "ioc_value": "https://chicnestdecor.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787708": [ { "ioc_value": "https://cindywritesbooks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787709": [ { "ioc_value": "https://conhecaifa.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787710": [ { "ioc_value": "https://duopo.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787700": [ { "ioc_value": "https://tigris-tegels.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787701": [ { "ioc_value": "https://transact-news.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787702": [ { "ioc_value": "https://adhdreliefshop.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787703": [ { "ioc_value": "https://ajmery.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787704": [ { "ioc_value": "https://americanpridemoving.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:15", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787694": [ { "ioc_value": "https://nainiexperiences.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787695": [ { "ioc_value": "https://reachneighborsintl.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787696": [ { "ioc_value": "https://renovationnation.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787697": [ { "ioc_value": "https://supplyanddealnetwork.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787698": [ { "ioc_value": "https://sv-technologies.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787699": [ { "ioc_value": "https://tgmetalworks.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:14", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787688": [ { "ioc_value": "https://draleticiavazquez.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787689": [ { "ioc_value": "https://elbalt.lt/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787690": [ { "ioc_value": "https://en.amordadnews.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787691": [ { "ioc_value": "https://gazaltours.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787692": [ { "ioc_value": "https://interhuss.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787693": [ { "ioc_value": "https://mylanguagelink.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:13", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787683": [ { "ioc_value": "https://unimedsv.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787684": [ { "ioc_value": "https://zventureintl.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787685": [ { "ioc_value": "https://aonerefrigeration.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787686": [ { "ioc_value": "https://aquafaunaexports.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787687": [ { "ioc_value": "https://bladesandgoven.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:12", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787677": [ { "ioc_value": "https://r41boutiquehotel.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787678": [ { "ioc_value": "https://senaosgb.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787679": [ { "ioc_value": "https://sistersofstjosephofmombasaschools.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787680": [ { "ioc_value": "https://tedwhitaker.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787681": [ { "ioc_value": "https://thejunglebookexperience.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787682": [ { "ioc_value": "https://tourturki.my.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:11", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787676": [ { "ioc_value": "https://northbendne.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:10", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787673": [ { "ioc_value": "https://myperformance.agency/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787674": [ { "ioc_value": "https://nairabuilder.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787675": [ { "ioc_value": "https://newsomvending.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:05", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787668": [ { "ioc_value": "https://jenniferjohnsonstudio.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787669": [ { "ioc_value": "https://junglebucketlist.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787670": [ { "ioc_value": "https://kidzacademyllc.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787671": [ { "ioc_value": "https://logisteg.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787672": [ { "ioc_value": "https://mundoparabrisas.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:04", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787663": [ { "ioc_value": "https://theslatetiles.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787664": [ { "ioc_value": "https://yarrafinefoods.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787665": [ { "ioc_value": "https://arabianmobiles.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787666": [ { "ioc_value": "https://chrisbrimelow.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787667": [ { "ioc_value": "https://godrejaliraofficial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:03", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787659": [ { "ioc_value": "https://optimusrak.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787660": [ { "ioc_value": "https://oregonfba.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787661": [ { "ioc_value": "https://qitmirhalalrawpetfood.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787662": [ { "ioc_value": "https://simplypureagroprocessing.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:01", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787653": [ { "ioc_value": "https://chanderdua.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787654": [ { "ioc_value": "https://divulgaabc.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:00", "last_seen_utc": "2026-04-14 13:17:10", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787655": [ { "ioc_value": "https://legacypool.us/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787656": [ { "ioc_value": "https://mariafumaca.frajolureceptivo.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787657": [ { "ioc_value": "https://mfspavers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787658": [ { "ioc_value": "https://milkywaypreprimaryschool.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:36:00", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787648": [ { "ioc_value": "https://theankh.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787649": [ { "ioc_value": "https://yieldbrief.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787650": [ { "ioc_value": "https://academia.massbateria.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787651": [ { "ioc_value": "https://afasconstrucao.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787652": [ { "ioc_value": "https://augmentedstaffing.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:59", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787642": [ { "ioc_value": "https://everythingondigital.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787643": [ { "ioc_value": "https://iconictrimsbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787644": [ { "ioc_value": "https://renovatie-van-appartementen.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787645": [ { "ioc_value": "https://ronaldotech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787646": [ { "ioc_value": "https://santacruzwebdesign.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787647": [ { "ioc_value": "https://teamboerne.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:58", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787637": [ { "ioc_value": "https://terrellfamilyfun.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787638": [ { "ioc_value": "https://upha.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787639": [ { "ioc_value": "https://vgpharma.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787640": [ { "ioc_value": "https://beltboutique.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787641": [ { "ioc_value": "https://escueladeexperimentos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:57", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787631": [ { "ioc_value": "https://printedpiecestech.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787632": [ { "ioc_value": "https://processpipeworkfabrication.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787633": [ { "ioc_value": "https://resilver.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787634": [ { "ioc_value": "https://ribonilighting.co.za/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787635": [ { "ioc_value": "https://sierbalken.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787636": [ { "ioc_value": "https://sloughscrapmetals.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:56", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787627": [ { "ioc_value": "https://danteti.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787628": [ { "ioc_value": "https://dynamiclifecoach.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787629": [ { "ioc_value": "https://joannedeitsch.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787630": [ { "ioc_value": "https://manchestermagician.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:55", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787623": [ { "ioc_value": "https://univer-global.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787624": [ { "ioc_value": "https://yogaonthewallkill.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787625": [ { "ioc_value": "https://4x4tourism.qa/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787626": [ { "ioc_value": "https://artillac.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:50", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787617": [ { "ioc_value": "https://mcabuild.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787618": [ { "ioc_value": "https://mccanndublin.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787619": [ { "ioc_value": "https://saniscreen.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787620": [ { "ioc_value": "https://securefutureproperty.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787621": [ { "ioc_value": "https://shemstream.ma/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787622": [ { "ioc_value": "https://thegamingsolutions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:49", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787611": [ { "ioc_value": "https://afroempiredance.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787612": [ { "ioc_value": "https://alquiler.teksoluz.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787613": [ { "ioc_value": "https://bacaconstructions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787614": [ { "ioc_value": "https://centrra.ru/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787615": [ { "ioc_value": "https://cursillo.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787616": [ { "ioc_value": "https://isdd.edu.sn/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:48", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787605": [ { "ioc_value": "https://hikinggearsreviews.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787606": [ { "ioc_value": "https://mirokutana.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787607": [ { "ioc_value": "https://mnerealty.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787608": [ { "ioc_value": "https://rookiereporter.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787609": [ { "ioc_value": "https://shivshankarexp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787610": [ { "ioc_value": "https://academiadedaytrading.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:47", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787600": [ { "ioc_value": "https://dustychemistry.wpsoftvence.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787601": [ { "ioc_value": "https://euronautica.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787602": [ { "ioc_value": "https://gmauvecin.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787603": [ { "ioc_value": "https://gruposmpoficial.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787604": [ { "ioc_value": "https://gsoundart.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:46", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787594": [ { "ioc_value": "https://almanara.edu.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787595": [ { "ioc_value": "https://americanhapkidokarate.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787596": [ { "ioc_value": "https://bedrijfsdatabank.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787597": [ { "ioc_value": "https://captureitphotography.info/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787598": [ { "ioc_value": "https://desertgreenlandscapeaz.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787599": [ { "ioc_value": "https://devdoesmortgages.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:45", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787588": [ { "ioc_value": "https://nickkyhub.com.ng/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787589": [ { "ioc_value": "https://peacemakersfresno.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787590": [ { "ioc_value": "https://tcwaremmien.be/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787591": [ { "ioc_value": "https://trustwalletsinvest.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787592": [ { "ioc_value": "https://ucndk.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787593": [ { "ioc_value": "https://alligatorcreations.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:44", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787583": [ { "ioc_value": "https://ivoryexhibitions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787584": [ { "ioc_value": "https://jair.in/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787585": [ { "ioc_value": "https://janzcanz.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787586": [ { "ioc_value": "https://kalijourney.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787587": [ { "ioc_value": "https://mtemsmemorialfoundation.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:43", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787577": [ { "ioc_value": "https://triplemelectric.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787578": [ { "ioc_value": "https://bestkilimanjarotours.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787579": [ { "ioc_value": "https://bodyweightculture.co/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787580": [ { "ioc_value": "https://etablissementbientraitant.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787581": [ { "ioc_value": "https://gruposuprema.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787582": [ { "ioc_value": "https://howtocooks.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:42", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787572": [ { "ioc_value": "https://pvpro.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787573": [ { "ioc_value": "https://sgpctech.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787574": [ { "ioc_value": "https://shopifyseoconsultant.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787575": [ { "ioc_value": "https://simicenter.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787576": [ { "ioc_value": "https://testspsychotechniques974.re/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:37", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787567": [ { "ioc_value": "https://mesacquisitions.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787568": [ { "ioc_value": "https://momnestology.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787569": [ { "ioc_value": "https://odaonline.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787570": [ { "ioc_value": "https://oldengineshed.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787571": [ { "ioc_value": "https://primetimehandymanllc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:36", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787561": [ { "ioc_value": "https://epaves-276.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787562": [ { "ioc_value": "https://evolutionplumbingservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787563": [ { "ioc_value": "https://homeguidetomaintenance.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787564": [ { "ioc_value": "https://itmega.lk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787565": [ { "ioc_value": "https://jbcpressurewashings.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787566": [ { "ioc_value": "https://lamusedurres.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:35", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787556": [ { "ioc_value": "https://zinvestgloballtd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:34", "last_seen_utc": "2026-04-16 11:15:07", "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787557": [ { "ioc_value": "https://anticondensspecialist.fr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787558": [ { "ioc_value": "https://dargahnizamuddin.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787559": [ { "ioc_value": "https://electroliteplus.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787560": [ { "ioc_value": "https://elementalabs.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:34", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787550": [ { "ioc_value": "https://inspiratielijn.nl/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787551": [ { "ioc_value": "https://itseleventhirtysix.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787552": [ { "ioc_value": "https://lawtemplefirm.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787553": [ { "ioc_value": "https://pallonfarms.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787554": [ { "ioc_value": "https://sgvsticker.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787555": [ { "ioc_value": "https://vladsautobahn.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:33", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787545": [ { "ioc_value": "https://youngpeopletoday.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787546": [ { "ioc_value": "https://ancorama.it/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787547": [ { "ioc_value": "https://cyberpme.tech/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787548": [ { "ioc_value": "https://educomics.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787549": [ { "ioc_value": "https://es-livadia.gr/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:32", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787539": [ { "ioc_value": "https://iniciativa21.cz/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787540": [ { "ioc_value": "https://innovativecustombuilders.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787541": [ { "ioc_value": "https://kalimah.online/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787542": [ { "ioc_value": "https://outernest.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787543": [ { "ioc_value": "https://pvdubai.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787544": [ { "ioc_value": "https://restorationinthepines.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:31", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787534": [ { "ioc_value": "https://fj2mindsetmasterygroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787535": [ { "ioc_value": "https://granitigroup.eu/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787536": [ { "ioc_value": "https://hotelshreevilas.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787537": [ { "ioc_value": "https://iconlng.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787538": [ { "ioc_value": "https://icosystem.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:30", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787529": [ { "ioc_value": "https://affordablefloridamovers.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787530": [ { "ioc_value": "https://amritsartaxiservice.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787531": [ { "ioc_value": "https://cbonline.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787532": [ { "ioc_value": "https://czargroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787533": [ { "ioc_value": "https://equinoxfinance.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:29", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787527": [ { "ioc_value": "https://prestigealuminium.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787528": [ { "ioc_value": "https://thestaginsurance.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:28", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787524": [ { "ioc_value": "https://gibkerr.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787525": [ { "ioc_value": "https://malcolmbrown.me/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787526": [ { "ioc_value": "https://peconstruction.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:24", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787519": [ { "ioc_value": "https://mifans.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787520": [ { "ioc_value": "https://mlid.games/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787521": [ { "ioc_value": "https://thefiascos.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787522": [ { "ioc_value": "https://a-mimarte.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787523": [ { "ioc_value": "https://devatakomputer.web.id/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:23", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787514": [ { "ioc_value": "https://umpaya.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787515": [ { "ioc_value": "https://1xbetsbd.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787516": [ { "ioc_value": "https://enanto.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787517": [ { "ioc_value": "https://ira-consultants.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787518": [ { "ioc_value": "https://lionsbreathwellness.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:22", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787509": [ { "ioc_value": "https://merazul.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787510": [ { "ioc_value": "https://niagaraeducon.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787511": [ { "ioc_value": "https://philadelphiarestorationservices.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787512": [ { "ioc_value": "https://shimanto-kango.ac.jp/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787513": [ { "ioc_value": "https://sukuk.com.pk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:21", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787504": [ { "ioc_value": "https://arsecgroup.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787505": [ { "ioc_value": "https://designsolid.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787506": [ { "ioc_value": "https://foneworld-reading.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787507": [ { "ioc_value": "https://global-herald.net/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787508": [ { "ioc_value": "https://kohesibond-stg.in10.cdn-alpha.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:20", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787499": [ { "ioc_value": "https://selfjourney.wizardswp.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787500": [ { "ioc_value": "https://semecor.es/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787501": [ { "ioc_value": "https://seyerjoinery.co.uk/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787502": [ { "ioc_value": "https://slotsfree.games/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787503": [ { "ioc_value": "https://telemallbrand.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:19", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787493": [ { "ioc_value": "https://btouch.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787494": [ { "ioc_value": "https://centralizedappeals.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787495": [ { "ioc_value": "https://ctveiculos.com.br/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787496": [ { "ioc_value": "https://modelzoo.dev/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787497": [ { "ioc_value": "https://poc.rs/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787498": [ { "ioc_value": "https://pricianastore.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:18", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787488": [ { "ioc_value": "https://profisix.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787489": [ { "ioc_value": "https://shopnsaveliquor.ca/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787490": [ { "ioc_value": "https://agluona.lt/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787491": [ { "ioc_value": "https://ateamhomeservicez.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787492": [ { "ioc_value": "https://autolistinc.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:17", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787483": [ { "ioc_value": "https://arnari.org/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787484": [ { "ioc_value": "https://carnow.ge/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787485": [ { "ioc_value": "https://commercialriskeurope.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787486": [ { "ioc_value": "https://hooyo-shop.com/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ], "1787487": [ { "ioc_value": "https://pax-tms.com.au/", "ioc_type": "url", "threat_type": "payload_delivery", "malware": "win.vidar", "malware_alias": null, "malware_printable": "Vidar", "first_seen_utc": "2026-04-14 11:35:16", "last_seen_utc": null, "confidence_level": 75, "is_compromised": true, "reference": null, "tags": "ClickFix,compromised,EtherHiding,Polygon,Vidar,WordPress", "anonymous": "1", "reporter": "m_govcert_ch" } ] }