ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain borrovnou4421.icu.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1868311
IOC: borrovnou4421.icu
IOC Type :domain
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS203273 OCTaLPHA
First seen:2026-08-04 12:58:42 UTC
Last seen:never
UUID:325e9ca7-9003-11f1-8325-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:ClickFix etherhiding injected-loader TDS

Avatar
Anonymous
Injected-loader / TDS host. Path /t.js?site=<32-hex> returns HTTP 200 application/javascript (889 B): the script bot-cloaks a large crawler UA list (Googlebot/Bingbot/AhrefsBot/GPTBot/ClaudeBot etc), then A/B-injects a second stage as /ext-b.<hash>.js or /ext.<hash>.js from the same host. Root path 404s; the loader only serves on the parameterised path. Registered 2026-08-02 (PDR Ltd), Cloudflare NS, origin 185.173.144.140. Same loader kit as regenerate5141.icu. Live 2026-08-04.