🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain genovaw.com.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1924029
IOC: genovaw.com
IOC Type :domain
Threat Type :botnet_cc
Malware: MacSync
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-09-18 17:23:39 UTC
Last seen:never
UUID:ee9c82c0-b381-11f1-abee-42010aa4000a
Reporter c4ffeine
Reward 5 credits from ThreatFox
Tags:ClickFix macOS MacSync safeguard-build
Reference: https://www.virustotal.com/gui/file/6e4b84389afb4683e19f921ce3f54703fb6bb146fbdbffac3e398894074c0fa0

Avatar
c4ffeine
MacSync 'safeguard' build (token 001e07c934e19b9d10f621c6b7546b43b2fb1c7b8fce2625fc7b767dfb626336), first full build whose stage-3 C2 is the delivery host itself rather than realtux.com: every URL in the decoded AppleScript (/gate, /pipeline/event, /loader/agent) points at genovaw.com. Verified live over Tor 2026-09-18 16:2x-16:31 UTC. Independently reported on ThreatFox 2026-09-18 05:04 UTC by 'ghozt' as an unattributed /curl/ pivot with family unknown; this submission attributes it to MacSync/Seedhook with the full chain. Unstoppable Domains registration, Cloudflare NS laila+thaddeus (new account pair, not previously seen in this cluster).