ClearFake

Malware Family

27 603 indicators of compromise attributed to ClearFake across abuse.ch threat intelligence feeds.

Domains

26 903

IPs

35

URLs

144

Hashes

521

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (26 903)IPs (35)URLs (144)Hashes (521)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
s617c6w1.rsudtarutung.comdomain
transit-sur.nexo5mir.surfdomain
73dwi.vividfox.in.netdomain
mfrpd.sm188daftar.cfddomain
innerflee.rosevale.gardendomain
x5-gate-33.arcostruttura.in.netdomain
hpi496.momentumventurex.in.netdomain
et5qogz2.one1xbet.promodomain
ext4point.keystoneprospera.in.netdomain
holz-8m.blackbirdr0ot.in.netdomain
cpu-pro.mav7loren.surfdomain
megapariwin.betdomain
srv-z901-node.turboflow.in.netdomain
it-irrigatn-cntrl-network-go.gardendomain
gold-star-5s.qen9vital.in.netdomain
ftcfotjnd.adsbln2.xyzdomain
line5taskhub.vertexurbanhub.gardendomain
cl4link.microflowprocess.in.netdomain
deep.chord1opari.surfdomain
spri5-grid.ky2mloren.in.netdomain
178.16.53.243ip
103.141.13.26ip
2.27.5.153ip
77.239.114.108ip
94.154.35.155ip
94.154.35.157ip
45.143.166.36ip
188.119.122.123ip
153.75.90.37ip
153.75.90.64ip
153.75.90.67ip
178.16.53.219ip
89.124.109.242ip
45.155.69.173ip
54.240.48.33ip
94.154.35.153ip
150.241.94.112ip
185.196.9.183ip
158.94.210.166ip
91.84.119.240ip
https://cdn.jsdelivr.net/gh/galinavsuk6/fjhg-567/humurl
https://cdn.jsdelivr.net/gh/kud-981/rt-3476@62fe780/kurt-38url
https://cdn.jsdelivr.net/gh/swiftvpnaccess/smtp-incoming-mx/loadurl
https://h9k2x7.highexplos.in.neturl
https://cdn.jsdelivr.net/gh/savina-41/mcv4f-jp5/launchingurl
https://cdn.jsdelivr.net/gh/kud-981/bunt@charred/errorurl
https://raw.githubusercontent.com/snowplow-byte/implicate/refs/heads/main/lilacurl
http://nerdsonsite.prourl
http://178.16.52.201/9cca20c6df659f72/m_cpt_bld172638.binurl
https://cdn.jsdelivr.net/gh/arinao7/6e91d58f-acdf/keyurl
https://devltd.top/flomowk2.zipurl
https://g0at-rnark.goatbreed.in.neturl
https://f1at-rnold.flatdon.in.neturl
https://cdn.jsdelivr.net/gh/zor-876/futures-import@04e2419/llmurl
https://insur02.dachshreinsur.in.neturl
https://steamcommunity.com/profiles/76561198719385745url
https://freightframe.5zoramel.in.net/05fe317c-0981-4de2-bc8a-930d369db441/ck-3d80df5d12cdfe6450a782fc87bf66b444.googleurl
https://cdn.jsdelivr.net/gh/arinao7/8327ac99-c06c-422f-bd2e-4a80978d52c9/api-45url
https://siege-close.com/n3s9c2aurl
https://carpet-sail.com/n3s9c2aurl