Skip to main content

IClickFix

Malware Family

10 024 indicators of compromise attributed to IClickFix across abuse.ch threat intelligence feeds.

Domains

9 775

IPs

40

URLs

202

Hashes

7

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (9 775)IPs (40)URLs (202)Hashes (7)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
mbgs.frdomain
freehence.comdomain
peritdm.comdomain
570qi-admiral-x.icudomain
esquadropc.comdomain
bronzinoconsulting.comdomain
lsgeducation.comdomain
www.tenutadelperugino.itdomain
kaesercustomhomes.comdomain
www.rebatefirm.comdomain
kebgis.comdomain
wwl-lb.codomain
gamblingwatch.cadomain
macrepairtool.comdomain
rtm7tech.netdomain
buttershopcreative.comdomain
agingenieria.com.pedomain
naturalis-uk.comdomain
ibnuzubair.comdomain
virtual-traction.comdomain
85.239.149.16ip
85.192.31.214ip
94.26.90.126ip
4.144.235.121ip
91.92.34.76ip
91.92.240.117ip
162.243.87.175ip
167.148.195.30ip
151.240.151.158ip
94.26.90.23ip
147.45.71.191ip
149.56.95.163ip
85.239.147.30ip
217.144.185.101ip
138.124.60.214ip
193.233.201.114ip
194.26.192.83ip
45.131.215.56ip
74.208.248.39ip
209.74.76.3ip
https://cdn.quickdelivr.com/mpackage.jsurl
http://103.150.186.125/1url
http://cloflart.com/7z.dllurl
https://ofaskfaksfmtjmka.com/otoaskjsk.jsurl
https://losfiros.comurl
http://103.229.53.84:8443/update.ps1url
http://143.241.174.121:2917/booturl
http://antongandon.club/url
http://80.253.249.186:5504/ct.baturl
https://rehearsal-b.com/4qX0LB/tm/xZjourl
https://sheltercirrus.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/oo9/updateurl
http://144.31.3.187/23logo.wavurl
http://losintoska.comurl
http://197.214.149.148:80/booturl
https://clickzona.net/embed/url
https://ashen-trace-zephyr-draeix.life/t.jsurl
http://87.120.126.100/kamet1.wavurl
https://policysync.pro/1kzpao/0G7Xcm07FD8Iurl
https://ofofoalalaladjrkrka.com/asgxcvxcv.jsurl
https://ashen-arc-badger-maie.life/t.js?site=f336ffdbb037127fe5e5a586fd71238curl

Another file to check? Run a file hash reputation check.