🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://status-handler-sage.vercel.app/api/get-status.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1971866
IOC: https://status-handler-sage.vercel.app/api/get-status
IOC Type :url
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS16509 AMAZON-02
Country:- US
First seen:2026-10-18 06:10:06 UTC
Last seen:never
UUID:00176dc4-ca68-11f1-bd13-42010aa4000a
Reporter shmulc
Reward 5 credits from ThreatFox
Tags:ClickFix ContagiousInterview DPRK fake-recruitment

Avatar
shmulc
Check-in server for a ClickFix lure on the apply form of a fake employer site (tokenmetrics.org, not the real Token Metrics). The page posts each visitor's IP, OS, browser and location to /api/entered-site, shows a fake reCAPTCHA that copies a per-OS command (cmd/curl/wget from api.recapcha.fun/auth/v1|v2|v3?token=304) to the clipboard, and polls /api/get-status every second; the submit button is enabled only after the server reports the command ran. Live 2026-10-17.