🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain roptik.com.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1923325
IOC: roptik.com
IOC Type :domain
Threat Type :payload_delivery
Malware: MacSync
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-09-17 16:29:41 UTC
Last seen:never
UUID:54911b57-b2b4-11f1-8450-42010aa4000a
Reporter c4ffeine
Reward 5 credits from ThreatFox
Tags:ClickFix macOS MacSync
Reference: https://www.virustotal.com/gui/file/ac13d281a641dbfe19ff05dbcd9d758e567a0d608ae188d8202d53836c54095c

Avatar
c4ffeine
MacSync ClickFix delivery host for build token b54cc90c ("Build 10"). Verified 2026-09-17 16:20 UTC by read-only GET: /curl/<token> served the stage-1 zsh (sha256 04e4bad3a81e9c66d5220459d70f1541ca6b623d92243a633d8733d048bc2330, already on ThreatFox) and /dynamic?txd=<token> served the stage-3 AppleScript stealer with C2 realtux.com. / returns HTTP 520. Unstoppable Domains registration, Cloudflare NS sunny+yahir (same account as realtux.com).