hxxps://ordinary-computer-analytical-spell.trycloudflare[.]com/cURL
Reported by 1 independent source · first reported by Sophos X-Ops · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
ClickFix campaign abuses Deno runtime for infostealer delivery“The script downloaded content from hxxps://ordinary-computer-analytical-spell.trycloudflare[.]com/c and stored the content in a new registry key disguised as a Microsoft Edge update.”
Indicators reported together
named in the same reports- hxxps://columbnezhjdq[.]com/goolgetagmanager.js?v=2.0&_cb=in 1 report
- columbnezhjdq[.]comin 1 report
- 162.33.177[.]16in 1 report
- hxxp://webstizkgao[.]com/v020def066f14754be9.jsin 1 report
- webstizkgao[.]comin 1 report
- ordinary-computer-analytical-spell.trycloudflare[.]comin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.