Campaigns / Malware / Family

ClearFake

32New IOCs · 24h
1,236New IOCs · 7 days
1,369Indicators tracked
1Independent feeds
2026-10-12 08:24Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

  • Domain1,354
  • URL14
  • Hash1
  • Malware1,353
  • C216

Where its infrastructure is hosted

No location data.

Latest indicators

Filter the live feed →
First seenTypeIndicatorRoleWhere
2026-10-12 08:24Domainhsk19cqn[.]kaarenorge[.]comPayload delivery—
2026-10-12 06:58Domainteknnovationbyobaid[.]teknnovation[.]comPayload delivery—
2026-10-12 06:11Domainpayload1717[.]proBotnet C2—
2026-10-12 06:11Domaingran1xea[.]xyzBotnet C2—
2026-10-12 06:11Domainsamehoo229[.]funBotnet C2—
2026-10-12 06:11Domainsayosay[.]ccBotnet C2—
2026-10-12 06:11Domaincrying881[.]beerBotnet C2—
2026-10-12 05:54Domaini67d9ppi[.]b00kself[.]comPayload delivery—
2026-10-12 04:50Domain7xum1r5l[.]lunza[.]storePayload delivery—
2026-10-12 03:19Domainrtp-k86sportop[.]sitePayload delivery—
2026-10-12 00:39Domaintoolauncher[.]comPayload delivery—
2026-10-12 00:29Domaintempmailgb[.]comPayload delivery—
2026-10-12 00:19Domainjeevi[.]storePayload delivery—
2026-10-12 00:10Domainmhxpjmu3[.]buhubee[.]comPayload delivery—
2026-10-11 23:22Domaineventation[.]sitePayload delivery—
2026-10-11 22:59Domainwww[.]pourquoidocteur[.]frPayload delivery—
2026-10-11 22:45Domainfwuepkv2[.]aryl[.]cloudPayload delivery—
2026-10-11 21:01Domaindrvto[.]sitePayload delivery—
2026-10-11 19:55Domaineyxiukwn[.]aryllabs[.]comPayload delivery—
2026-10-11 18:56Domainsandstrahlungen[.]chPayload delivery—
2026-10-11 18:41Domaincareertools[.]inPayload delivery—
2026-10-11 17:47Domaincap[.]camp-cantina[.]comBotnet C2—
2026-10-11 17:46Domainwsl5y6zq[.]aryl[.]appPayload delivery—
2026-10-11 16:15Domainfefsfes[.]orgPayload delivery—
2026-10-11 15:38Domainrclop3ch[.]aryllab[.]comPayload delivery—
2026-10-11 14:27Domainmgxyuko[.]xyzBotnet C2—
2026-10-11 14:00Domaintruenarrator[.]comPayload delivery—
2026-10-11 12:32Domainportfolio[.]hillairet-enzo[.]frPayload delivery—
2026-10-11 12:30Domainbnr1b90s[.]kaarenorge[.]comPayload delivery—
2026-10-11 11:43Domainyrfxbtcx[.]mawos[.]storePayload delivery—
2026-10-11 09:20Domainrtpk86sport-happy[.]clickPayload delivery—
2026-10-11 08:58Domainaguiasmarketing[.]com[.]brPayload delivery—
2026-10-11 08:18Domainturbo-rs[.]chPayload delivery—
2026-10-11 08:18Domainwww[.]seinfor[.]pePayload delivery—
2026-10-11 08:10Domainzj9s97wb[.]jp168amp-super[.]comPayload delivery—
2026-10-11 07:23Domain7aigp3my[.]lunza[.]storePayload delivery—
2026-10-11 07:02Domainkelp[.]camp-cantina[.]comBotnet C2—
2026-10-11 03:03Domaing5wm6nzi[.]kulonprogo[.]orgPayload delivery—
2026-10-11 02:40Domain3bse5c5d[.]b00kself[.]comPayload delivery—
2026-10-11 00:43Domainwww[.]miei[.]educationPayload delivery—
2026-10-10 23:12Domainamberchronicles[.]storePayload delivery—
2026-10-10 23:12Domainagentificial[.]comPayload delivery—
2026-10-10 23:07Domainbaboa502[.]rtplive-miliarbet[.]onlinePayload delivery—
2026-10-10 21:33Domain3cipm334[.]pilkada2017[.]comPayload delivery—
2026-10-10 19:16Domainaidigi[.]storePayload delivery—
2026-10-10 18:53Domaine-learning[.]fly-and-film[.]comPayload delivery—
2026-10-10 18:53Domainawtad[.]bizPayload delivery—
2026-10-10 18:45Domain16t38k5v[.]rtp-k86sportop[.]sitePayload delivery—
2026-10-10 16:56Domainxo98poker[.]comPayload delivery—
2026-10-10 16:31Domainfoipwjgt[.]paketmalam[.]vipPayload delivery—
2026-10-10 15:05Domainblog[.]xlab[.]qianxin[.]comPayload delivery—
2026-10-10 14:55Domain4cuissch[.]wcimbali2016[.]orgPayload delivery—
2026-10-10 14:55Domainpraxis-koerperquelle[.]chPayload delivery—
2026-10-10 14:49Domainwcimbali2016[.]orgPayload delivery—
2026-10-10 14:33Domainnyp67fb4[.]rtpk86sport-happy[.]clickPayload delivery—
2026-10-10 12:15Domainjp168amp-super[.]comPayload delivery—
2026-10-10 11:29Domaintpp6b30z[.]kulonprogo[.]orgPayload delivery—
2026-10-10 11:12Domainjabrzoza[.]euPayload delivery—
2026-10-10 11:02Domainxn--instantans-j7a[.]chPayload delivery—
2026-10-10 10:55Domainv6k91pk4[.]truenarrator[.]comPayload delivery—
2026-10-10 10:21Domainmdtupbnx[.]mawos[.]storePayload delivery—
2026-10-10 10:02Domaininstantanes[.]chPayload delivery—
2026-10-10 09:55Domaindominiaband[.]comPayload delivery—
2026-10-10 09:53Domainn2dypmy2[.]smanbotu[.]comPayload delivery—
2026-10-10 09:52Domainwaimana[.]chPayload delivery—
2026-10-10 09:49Domainsmanbotu[.]comPayload delivery—
2026-10-10 09:36Domainespace-zigzag[.]chPayload delivery—
2026-10-10 09:26Domainatelierdezigzag[.]chPayload delivery—
2026-10-10 08:02Domainvirazofurniture[.]inPayload delivery—
2026-10-10 07:34Domainmorib[.]storePayload delivery—
2026-10-10 07:32Domainclward[.]comPayload delivery—
2026-10-10 06:07Domainj0p0cibb[.]lunza[.]storePayload delivery—
2026-10-10 05:14Domainmisle[.]storePayload delivery—
2026-10-10 04:48Domainrtplive-miliarbet[.]storePayload delivery—
2026-10-10 04:48Domainkflm3k81[.]rtplive-miliarbet[.]storePayload delivery—
2026-10-10 02:10Domain8rlmyiu3[.]b00kself[.]comPayload delivery—
2026-10-10 00:48Domain13f33a61[.]pattysole[.]comPayload delivery—
2026-10-09 23:08Domainf81503e8[.]b00kself[.]comPayload delivery—
2026-10-09 23:08Domainbf5f2f9e[.]b00kself[.]comPayload delivery—
2026-10-09 22:19Domainecned5tg[.]roseanne[.]idPayload delivery—
2026-10-09 21:57Domain76dlzuzd[.]pinke[.]storePayload delivery—
2026-10-09 20:57Domainwoostore[.]devPayload delivery—
2026-10-09 20:57Domainwibuku[.]orgPayload delivery—
2026-10-09 20:57Domainwertog[.]comPayload delivery—
2026-10-09 20:57Domaintubidy[.]studyPayload delivery—
2026-10-09 20:57Domainybpm-kudus[.]sch[.]idPayload delivery—
2026-10-09 20:57Domainvlessi[.]netPayload delivery—
2026-10-09 20:57Domainvivekchaurasia[.]comPayload delivery—
2026-10-09 20:57Domaintylertysdal[.]comPayload delivery—
2026-10-09 20:57Domainwisebanq[.]comPayload delivery—
2026-10-09 20:57Domainwebsiteambition[.]comPayload delivery—
2026-10-09 20:47Domainrickowenwear[.]comPayload delivery—
2026-10-09 20:37Domaintransfy[.]cloudPayload delivery—
2026-10-09 20:37Domainthrottletechnologies[.]netPayload delivery—
2026-10-09 20:37Domaintourdasgalaxias[.]com[.]brPayload delivery—
2026-10-09 20:37Domaintmd12[.]topPayload delivery—
2026-10-09 20:37Domaintopvisionmarketing[.]comPayload delivery—
2026-10-09 20:37Domaintizant[.]comPayload delivery—
2026-10-09 20:37Domaintrussi-eg[.]comPayload delivery—
2026-10-09 20:37Domaintrustawesome[.]comPayload delivery—

Defanged for safety. URL query strings removed.