icy-star-f45c.workers[.]devDomain
Reported by 2 independent sources · first reported by Socket · last reported
Last reported 16 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases“All the identified add-ons barring one have been found to contact the "*.icy-star-f45c.workers[.]dev" domain.”
-
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials“Fifteen of the extensions contact icy-star-f45c.workers[.]dev; the broken variant uses fondationanimalaidrelief.workers.dev but retains the same frontend and campaign marker.”
Indicators reported together
named in the same reports- browserweb[.]comin 2 reports
- webtools[.]coin 2 reports
- tabtools[.]coin 2 reports
- fasttools[.]coin 2 reports
- protools[.]netin 2 reports
- webtools[.]comin 2 reports
- neattools[.]comin 2 reports
- fondationanimalaidrelief.workers[.]devin 1 report
- api.rabby[.]ioin 1 report
- download.rabby[.]ioin 1 report
- static-assets.rabby[.]ioin 1 report
- static.debank[.]comin 1 report
- static-assets.debank[.]comin 1 report
- matomo.debank[.]comin 1 report
- hxxps://silent-wind-get.icy-star-f45c.workers[.]dev/in 1 report
- silent-wind-get.icy-star-f45c.workers[.]devin 1 report
- hxxps://small-boat-969c.icy-star-f45c.workers[.]dev/in 1 report
- small-boat-969c.icy-star-f45c.workers[.]devin 1 report
- hxxps://green-firefly-ab28.icy-star-f45c.workers[.]dev/in 1 report
- green-firefly-ab28.icy-star-f45c.workers[.]devin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.