🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://cdn.data-1283.com/app.vue.js.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1964568
IOC: https://cdn.data-1283.com/app.vue.js
IOC Type :url
Threat Type :payload_delivery
Malware: GHOSTBLADE
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS55933 CLOUDIE-AS-AP
Country:- HK
First seen:2026-10-14 05:42:55 UTC
Last seen:never
UUID:46a63d70-c757-11f1-bd13-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:DarkSword ios supply-chain web-drive-by
Reference: https://bazaar.abuse.ch/sample/64c52a52d64ea44a8b8e1a9fa367e37a9940f847fcd142182711b1b862efb8a2/

Avatar
Daydream
Script and frame injected at the end of a trojanised copy of the tld.js library (tld.min.mobile.js, tagged DarkSword on MalwareBazaar): for non-desktop platforms it loads https://cdn.data-1283.com/app.vue.js and writes a hidden iframe to https://www.cdnboostcache.com/sdk.html?s=bcdn. Strings are stored reversed. What the two URLs serve was not fetched or verified by us; family as tagged by the uploader.