hollow-badger-moasfraum[.]lifeDomain
Reported by 2 independent sources · first reported by SANS Internet Storm Center · last reported
Last reported 29 days agoFeeds last saw it 30 days ago
What the reports say
1 report, newest first · the exact sentence from each-
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)“On Thursday 2026-09-24, the Macfinger domain for the fake verification page was hollow-badger-moasfraum[.]life.”
Seen in threat feeds
1 feed| Feed | First seen | Last seen | Sightings | What the feed says |
|---|---|---|---|---|
| abuse.ch ThreatFox | 1 | payload_delivery · IClickFix · ClickFix · MacFinger |
Indicators reported together
named in the same reports- notes[.]appin 1 report
- terminal[.]appin 1 report
- hxxp://45.131.215[.]56/8031e818c7a46?force=1in 1 report
- 45.131.215[.]56in 1 report
- hxxp://45.131.215[.]56/a7a11f95?force=1in 1 report
- hxxp://45.131.215[.]56/4e04813226b1b93?force=1in 1 report
- hxxp://95.163.153[.]80:8133/api/tin 1 report
- 95.163.153[.]80in 1 report
- c6da028e0a8a25a3…1a49a5668912in 1 report
- 457ed02b0a63ccf8…18cc538055b7in 1 report
- 5a2242b862ef52fe…2e6d4b35c6fbin 1 report
- 3e26e006210ed398…8d45c56e1a89in 1 report
- 4a59528492326918…28f2839fb5b6in 1 report
- hxxp://95.163.153[.]80:8133/api/credentialsin 1 report
- hxxp://95.163.153[.]80:8133/api/shell/agentin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.