🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://thewildandfreecafe.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=wesley.doc.

Database Entry


IOC ID:2026052
IOC: https://thewildandfreecafe.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=wesley.doc
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS16276 OVH
Country:- FR
First seen:2026-11-13 08:16:53 UTC
Last seen:never
UUID:17237f27-deba-11f1-8f92-42010aa4000a
Reporter EPASA
Reward 5 credits from ThreatFox
Tags:Adobe fake-pdf phishing RMM-abuse ScreenConnect

Avatar
EPASA
Fake Adobe 'Document.pdf - Downloaded' lure pages (static HTML, title 'Document.pdf — Downloaded', bogus 'Passcode: 70193') on AWS S3 / Netlify. Buttons + 5s JS auto-redirect deliver a legit signed ConnectWise ScreenConnect ClientSetup.msi from attacker-controlled *.screenconnect.com cloud instances (RMM abuse for remote access). Instance rotates every few days: rockymountainstoneart (2026-10-22/23) -> wocgranted (11-03/04) -> scjwc (11-10) -> thewildandfreecafe (11-12, OVH 148.113.190.173). Lure page sha256 (wesleyjanitorial) 90ad937b9cd081f917c24e574c238e04ce960aa32d84bcd29a407dfd12fede86. Source: urlscan.io stored scans; observed 2026-10-22 to 2026-11-12.