ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://crf.masterklass.net.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1853232
IOC: https://crf.masterklass.net
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-07-17 23:29:43 UTC
Last seen:never
UUID:63ea5ee3-8237-11f1-8973-42010aa4000a
Reporter HuntYethHounds
Reward 5 credits from ThreatFox
Tags:ClickFix JokerStat TDS

Avatar
HuntYethHounds
Page Title: JokerStat Analytics
Description: JokerStat — Privacy-first web analytics for modern teams

DNS TXT records contain domains which are frequently updated:
hxxps://dns[.]google/resolve?name=crf[.]masterklass[.]net&type=TXT (Domains encrypted with XOR key 75)

Fallback if DNS TXT resolution fails:
hxxps[:]//raw.githubusercontent[.]com/franklynscarbrough-prog/TheListOfTasking/refs/heads/main/Readme[.]md (Inactive)

Endpoints:
/ccheck (Checks site identifier)
/collect (Visitor analytics and tracking data)
/collect/heartbeat (Sends every 15 seconds)
/collect/screen (Uploads screenshot of webpage every 2 minutes)
/cload (Randomly selects domain and fetches fake CAPTCHA script. XOR key = HOhBcwHnBA4KvslMDvMm)
/cload?k=SITE_KEY&os=OPERATING_SYSTEM&h=HOSTNAME)

JokerState Webpanel:
/realtime
/clipper
/captchas
/filters
/files
/integration
/faq
/settings