Skip to main content

ClearFake

Malware Family

33 593 indicators of compromise attributed to ClearFake across abuse.ch threat intelligence feeds.

Domains

32 675

IPs

37

URLs

328

Hashes

553

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (32 675)IPs (37)URLs (328)Hashes (553)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CCredit-Card SkimmerpayloadPayload Delivery

Sample indicators

IndicatorType
serdraix4.askloop.in.netdomain
j7n7i2dx.enfej.windomain
3bjguds4.eng--glycofree.comdomain
layoutamp.mav2lorix.latdomain
f833rk27.techvigilante.comdomain
narr-isl.bytegrid.latdomain
secretcav.remote-flow.workdomain
coralsolid.cinderbay.in.netdomain
macaronvanille.chdomain
s0lid-leaf.slowbend.in.netdomain
f27u92nr.ravanshenasi.xyzdomain
junge-sinfonie-berlin.dedomain
niliafshar.comdomain
moth.betweenthebunz.codomain
f0cu-grid.bexla2rin.in.netdomain
wqgq.oakridge.in.netdomain
emberbroker.tockentrue.in.netdomain
cleo-wasmer-app-deployments.wasmer.appdomain
cl2data.orbitaltraceunit.in.netdomain
zen-venor.klatren.latdomain
213.232.235.51ip
193.233.82.126ip
178.16.53.243ip
178.16.55.92ip
194.76.227.172ip
94.154.35.155ip
94.154.35.157ip
94.154.35.164ip
45.143.166.36ip
188.119.122.123ip
153.75.90.37ip
153.75.90.64ip
45.155.69.173ip
65.109.115.111ip
145.249.115.191ip
94.154.35.153ip
150.241.94.112ip
158.94.210.166ip
91.84.119.240ip
178.16.52.101ip
https://cdn.jsdelivr.net/gh/Max-856/treem/ludaurl
https://cdn.jsdelivr.net/gh/19875567137/0C-21-ED-097-4480-3E21-D48-4E/34-19-08-3C-5D-F10C21url
https://z8t3p.flatdon.in.neturl
https://cdn.jsdelivr.net/gh/kud-981/sandy-lumping-mandarin@a1fee8e/sysurl
https://cloudenterprise26.com/ZxC9vBnM7lKjH3gFurl
http://85.239.149.16/f6ptObhnkvaYRgMEJurl
https://softs.live/css.jsurl
https://cloudynetwork.onlineurl
https://agr4-vvave.agrahurry.in.neturl
https://cdn.jsdelivr.net/gh/Anny11-34/cfgdu-kdf/rftt-yurl
https://raw.githubusercontent.com/Christa6547/davidrunurl
https://temp-enc.5zoramel.in.net/05fe317c-0981-4de2-bc8a-930d369db441/ck-3d80df5d12cdfe6450a782fc87bf66b444.googleurl
https://testingcf.jsdelivr.net/gh/F819-39-A/764-D-A148-B414/1859294348Lurl
https://doth09.caliphdotham.in.neturl
https://testingcf.jsdelivr.net/gh/989A-A-3fF2465495760-2B3a/4657-8765943-85742-94856/22274659-87url
https://cdn.jsdelivr.net/gh/dsteru3421/5c5d8d-0333-4cbe-b328-d84e0dd9d/76f4346f-d81c-465f-9d7b-fa5089c9ea3burl
https://cdn.jsdelivr.net/gh/52-7aa5/40ab-5bb6-d1f9b0-9634a4-e30/af07382d-dd95-4f5a-8848-6c006579068curl
https://siege-close.com/n3s9c2aurl
https://rawcdn.githack.com/dsteru3421/02-FD9159F9-9A/refs/heads/main/f28ddb96-d4bc-410url
https://cdn.jsdelivr.net/gh/dsteru3421/2649728a-b35b-4211-a65a-85baaf653cbe/118132a8-a273-47da-931c-3c78081f6a38url

Another file to check? Run a file hash reputation check.