🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain smashroomcity.com.au.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:2023010
IOC: smashroomcity.com.au
IOC Type :domain
Threat Type :payload_delivery
Malware: IClickFix
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS209242 CLOUDFLARESPECTRUM
Country:- US
First seen:2026-11-10 12:28:01 UTC
Last seen:2026-11-11 01:39:16 UTC
UUID:22688801-dd02-11f1-a74e-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:ClickFix etherhiding Polygon
Reference: https://urlscan.io/result/01a1c500-4cd0-7330-bbf2-3575d5358285/

Avatar
wristhulk
Compromised WordPress site serving an EtherHiding loader: the page reads its next stage from smart contract 0xB909956B9d716ddfDF6935115a8d6F6cB2E655c6 via eth_call on 1rpc.io, polygon-bor-rpc.publicnode.com, polygon-rpc.com, then loads script from fudcomcheck.art, static.fareharbor.com, www.trustedsite.com (IClickFix: fudcomcheck.art). Seen in urlscan.io scan 01a1c500-4cd0-7330-bbf2-3575d5358285; verified from the stored requests only (the site was not visited).