ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://mezcalpro.com/scq.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1741246
IOC: https://mezcalpro.com/scq
IOC Type :url
Threat Type :payload_delivery
Malware: SmartApeSG
Malware alias:HANEYMANEY, ZPHP
Confidence Level : Confidence level is high (100%)
Is compromised? : True
ASN:AS396982 GOOGLE-CLOUD-PLATFORM
Country:- US
First seen:2026-02-05 06:34:07 UTC
Last seen:2026-04-28 12:09:08 UTC
UUID:f58e39d7-01e3-11f1-ac94-42010aa4000a
Reporter monitorsg
Reward 5 credits from ThreatFox
Tags:SmartApeSG
Reference: https://infosec.exchange/@monitorsg/116013228581960779

Avatar
monitorsg
hXXps://mezcalpro[.]com/scq (injected) --> hXXps://socialitei[.]com/callback/logout-payload.js --> hXXps://socialitei[.]com/callback/proxy-parser.php --> hXXps://socialitei[.]com/callback/refresh-parser.js (clickfix) --> hXXp://193[.]42.38.38/func (HTA) --> hXXps://neymbus[.]com/func (HTA) --> hXXps://193[.]42.38.38/class (ZIP)