download-version.1-9-18[.]comDomain
Reported by 1 independent source · first reported by Sophos X-Ops · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Fake AI, real malware: Attackers impersonating AI brands“In one case, a fake Claude site instructed the victim to run an mshta one-liner that pulled its payload from download-version.1-9-18[.]com.”
Indicators reported together
named in the same reports- perplexity-ai[.]onlinein 1 report
- code.verification-claude-cdn[.]beerin 1 report
Copy these 2 indicators · defanged
Also named with it: CVE-2026-15409, CVE-2026-15410
Thanks — we review every report.