🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain www.jeyms.com.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:2019335
IOC: www.jeyms.com
IOC Type :domain
Threat Type :payload_delivery
Malware: IClickFix
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS50474 O2SWITCH
Country:- FR
First seen:2026-11-08 07:26:39 UTC
Last seen:2026-11-07 18:58:50 UTC
UUID:3e1ecdf6-dad8-11f1-a74e-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:ClickFix etherhiding Polygon
Reference: https://urlscan.io/result/01a1b739-74f8-7518-962c-9b6e76f7a150/

Avatar
wristhulk
Compromised WordPress site serving an EtherHiding loader: the page reads its next stage from smart contract 0xfF9E792a3015A79340CDEc1847Ab0AA10560422a via eth_call on 1rpc.io, polygon-public.nodies.app, then loads script from interseq.at (IClickFix: interseq.at). Seen in urlscan.io scan 01a1b739-74f8-7518-962c-9b6e76f7a150; verified from the stored requests only (the site was not visited).