wexmri[.]ccDomain

Reported by 1 independent source · first reported 20 Feb 2026 by Elastic Security Labs · last reported 20 Feb 2026

Last reported 8 months ago

What the reports say

1 report, newest first · the exact sentence from each

“| wexmri[.]cc | Domain | | Stage 1 C2 alternate |”

Elastic Security LabsVendor20 Feb 2026C2
MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites

Indicators reported together

named in the same reports

www.ndibstersoft[.]comin 1 report
hxxps://www.investonline[.]in/js/jq.phpin 1 report
www.investonline[.]inin 1 report
xmri[.]networkin 1 report
45.13.212[.]250in 1 report
d15mawx0xveem1.cloudfront[.]netin 1 report
hxxps://www.google[.]com/?q=dj1in 1 report
45.13.212[.]251in 1 report
23.227.202[.]114in 1 report
investonline[.]inin 1 report
a508d0bb583dc6e5…2c343fce6f4bin 1 report
bcc7a0e53ebc62c7…68279ab4f6f1in 1 report
5e0a30d8d91d5fd4…d3cc74719f51in 1 report
055336daf2ac9d5b…52f540b28bebin 1 report
backupdailyawss.s3.us-east-1.amazonaws[.]comin 1 report

Copy these 15 indicators · defanged

15 indicators, defanged, one per line

www.ndibstersoft[.]com
hxxps://www.investonline[.]in/js/jq.php
www.investonline[.]in
xmri[.]network
45.13.212[.]250
d15mawx0xveem1.cloudfront[.]net
hxxps://www.google[.]com/?q=dj1
45.13.212[.]251
23.227.202[.]114
investonline[.]in
a508d0bb583dc6e5f97b6094f8f910b5b6f2b9d5528c04e4dee62c343fce6f4b
bcc7a0e53ebc62c77b7b6e3585166bfd7164f65a8115e7c8bda568279ab4f6f1
5e0a30d8d91d5fd46da73f3e6555936233d870ac789ca7dd64c9d3cc74719f51
055336daf2ac9d5bbc329fd52bb539085d00e2302fa75a0c7e9d52f540b28beb
backupdailyawss.s3.us-east-1.amazonaws[.]com

Thanks — we review every report.

Report a wrong value