gemscocl[.]comDomain
Reported by 2 independent sources · first reported by AhnLab ASEC · last reported
Last reported 1 month agoFeeds last saw it 28 days ago
What the reports say
1 report, newest first · the exact sentence from each-
I just trusted the security certificate prompt… Beware of the LegionLoader malware being distributed via the ClickFix method“hxxp://gemscocl[.]Com/nfront.Php”
Seen in threat feeds
1 feed| Feed | First seen | Last seen | Sightings | What the feed says |
|---|---|---|---|---|
| abuse.ch ThreatFox | 1 | botnet_cc · Lumma Stealer · ClickFix · Lumma · LummaC2 |
Indicators reported together
named in the same reports- ascendpopdownloadtoday[.]monsterin 1 report
- 89.34.90[.]217in 1 report
- socialseoguru[.]comin 1 report
- leappoploaderinstantly[.]monsterin 1 report
- gushpopsecretdownload[.]monsterin 1 report
- jetpopdownloadsecret[.]monsterin 1 report
- pourpopclickgetfast[.]monsterin 1 report
- spoutpoploaderfast[.]monsterin 1 report
- hotfootpopfilefast[.]monsterin 1 report
- boltpopsecretbutton[.]monsterin 1 report
- tearpopfilegetfast[.]monsterin 1 report
- flinchpoploaderfast[.]monsterin 1 report
- pixelrainbowclub[.]cfdin 1 report
- dreamysamuraisoul[.]cfdin 1 report
- animecelestialblaze[.]cfdin 1 report
- cartoontalesworld[.]cfdin 1 report
- shadowinjalegend[.]cfdin 1 report
- hxxp://dallasbackstage[.]com/nfront.Phpin 1 report
- dallasbackstage[.]comin 1 report
- hxxp://dallasbackstage[.]com/nback.Phpin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.