Monitor SG

New #SocGholish C2: hXXps://us-west.oceandentalcare[.]com/Xgd37BKqtSdK7BK3iIdM1crnyQzMucWByCzVtc451v7D7cs3eBWT us-west.oceandentalcare[.]com 185[.]28.119.173 AS62005 BlueVPS OU

New #SocGholish C2: hXXps://ow-api.behzad.eu[.]org/Xgd37BKqtSdK7BK31CfjioTD1c4KyNqOuczjuoPPuozP1vb5ucu3tSdD7BKqkw== ow-api.behzad.eu[.]org 149[.]28.69.142 AS20473 The Constant Company, LLC

Detected #SmartApeSG infection chain Compromised site --> namastheandhra[.]com/cloudflare (injected) --> chestnutstanza[.]top/realm/oauth-pipeline.js --> chestnutstanza[.]top/realm/health-service --> chestnutstanza[.]top/realm/acl-controller.js (clickfix)

Detected #KongTuke infection chain Compromised site --> griffihhs[.]click/q2hfsow4.js (ClickFucker) --> griffihhs[.]click/api/v1/session (token) --> griffihhs[.]click/api/v1/verify (gateway) --> griffihhs[.]click/api/v1/status (clipboard) --> tom-yy[.]top/f (powershell) 24d35d5da1d2f76292de0c6bc406fcc1108055eaaa0b54952cf8d9a49d0aea3e f

Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> acaciaearthwork[.]top/private/session-util.js --> acaciaearthwork[.]top/private/login-dom --> acaciaearthwork[.]top/private/health-header.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> nebulaloom[.]top/oauth/reset-dom.js --> nebulaloom[.]top/oauth/auth-server --> nebulaloom[.]top/oauth/gateway-html.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> amberobservatory[.]top/public/scope-cookie.js --> amberobservatory[.]top/public/middleware-sessionstore --> amberobservatory[.]top/public/callback-asset.js (clickfix)

Detected #KongTuke infection chain Compromised site --> ritchie[.]click/ksbfgehn.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard) --> f-codebase[.]lol/f (powershell) a6846acd9c5b16a128b68f45f9af8ce2c9e10fa73a390c53e8b4546862a14222 f

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> marblehaven[.]top/claims/profile-view --> marblehaven[.]top/claims/identity-render.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> silverlandscape[.]top/claims/refresh-cookie.js --> silverlandscape[.]top/claims/profile-view --> silverlandscape[.]top/claims/identity-render.js (clickfix)

New #SocGholish C2: hXXps://img2.mekebibsolomonlaw[.]com/Xgd37BKqtSdK7BK3EoPIivP5ygbB1ol3tSdD7BKqkw== img2.mekebibsolomonlaw[.]com 108[.]61.194.248 AS20473 The Constant Company, LLC

Detected #KongTuke infection chain Compromised site --> bauabach[.]lol/zcfo2l6c.js (ClickFucker) --> bauabach[.]lol/api/v1/session (token) --> bauabach[.]lol/api/v1/verify (gateway) --> bauabach[.]lol/api/v1/status (clipboard) --> globalupdate6711[.]com/update/package (tar) c5a3d94cb6b4be539b68401e2fbd8008740d230109ee13a5b3b863f8e2d935c1 package

Detected #KongTuke infection chain Compromised site --> chaphan[.]click/jkg4oml2.js (ClickFucker) --> chaphan[.]click/api/v1/session (token) --> chaphan[.]click/api/v1/verify (gateway) --> chaphan[.]click/api/v1/status (clipboard) --> tommy-er[.]top/f (powershell) 61351d869940b9875400bf4ebd1bdc29f972813473a823acc85db242487212bc f

Detected #KongTuke infection chain Compromised site --> bouoher[.]lol/jyuf6cei.js (ClickFucker) --> bouoher[.]lol/api/v1/session (token) --> bouoher[.]lol/api/v1/verify (gateway) --> bouoher[.]lol/api/v1/status (clipboard) --> tommy-ee[.]top/f (powershell) bd15d8e2239a293d77a7fc1e9b38c3461c79069273d7d7c17ae1e7ca4ab82156 f

Detected #KongTuke infection chain Compromised site --> marshalh[.]icu/c9lg2uqb.js (ClickFucker) --> marshalh[.]icu/api/v1/session (token) --> marshalh[.]icu/api/v1/verify (gateway) --> marshalh[.]icu/api/v1/status (clipboard) --> hosthex9101[.]com/update/package (tar) 1cec90906b40fa7e29f0cd531d3bbcfc19f6e03fd99b5c41b5dbce8270652460 package

Detected #SmartApeSG infection chain Compromised site --> hazelcitadel[.]top/public/refresh-cookie --> hazelcitadel[.]top/public/throttle-sandbox.js (clickfix)

Detected #KongTuke infection chain Compromised site --> meduurst[.]space/vtyzese3.js (ClickFucker) --> meduurst[.]space/api/v1/session (token) --> meduurst[.]space/api/v1/verify (gateway) --> meduurst[.]space/api/v1/status (clipboard) --> nodemetrics9095[.]com/update/package (tar) a1e14e2b06dc859053cb63cfa9e76b4ef43540a35d736dc9fb1c39986bf67654 package

Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> novacupola[.]top/role/logout-header.js --> novacupola[.]top/role/handler-deploy --> novacupola[.]top/role/rate-layout.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> ibharcan[.]com/meta.google.com (injected) --> mulberrylodestar[.]top/metrics/verify-client.js --> mulberrylodestar[.]top/metrics/api-transpiler --> mulberrylodestar[.]top/metrics/signin-fetch.js (clickfix)

New #SocGholish C2: hXXps://up-to-date.paquetesparaorlando[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== up-to-date.paquetesparaorlando[.]com 216[.]128.153.117 AS20473 The Constant Company, LLC

Detected #KongTuke infection chain Compromised site --> henreques[.]lol/file.js (ClickFucker) --> henreques[.]lol/api/v1/session (token) --> henreques[.]lol/api/v1/verify (gateway) --> henreques[.]lol/api/v1/status (clipboard)

New #SocGholish C2: hXXps://app-api.starfoodmart[.]net/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== app-api.starfoodmart[.]net 45[.]32.193.249 AS20473 The Constant Company, LLC

New #SocGholish C2: hXXps://js-dl.kaliesthenics[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== js-dl.kaliesthenics[.]com 144[.]172.105.121 AS14956 RouterHosting LLC

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/meta.google.com (injected) --> granitehearth[.]top/status/profile-runtime.js --> granitehearth[.]top/status/status-parser --> granitehearth[.]top/status/health-effect.js (clickfix)

Detected #KongTuke infection chain Compromised site --> caapman[.]me/ql8tbzbg.js (ClickFucker) --> caapman[.]me/api/v1/session (token) --> caapman[.]me/api/v1/verify (gateway) --> caapman[.]me/api/v1/status (clipboard) --> portalguard7797[.]com/b (cmd) --> portalguard7797[.]com/ue (cmd) 6389cfc4b6ac7726bed2b829bb320692528682276f292a1e39adfe373c15c94d b df2a191a0994bb1a7068b6653198b4fb2a57cabd572b9e1acffbc792dfed1a90 ue

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> jadeworkshop[.]top/router/verify-build --> jadeworkshop[.]top/router/handler-asset.js (clickfix)

New #SocGholish C2: hXXps://js.galmabuna[.]com/Xgd37BKqtSdK7BK3icTOHNEMiIdfEhmPicqMXSbB1ol3tSdD7BKqkw== js.galmabuna[.]com 45[.]61.150.158 AS14956 RouterHosting LLC

New #SocGholish C2: hXXps://api-store.urgaacoffeeroastery[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== api-store.urgaacoffeeroastery[.]com 89[.]117.0.122 AS46475 Limestone Networks, Inc.

New #SocGholish C2: hXXps://drive4.destinationgallery[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== drive4.destinationgallery[.]com 104[.]200.73.216 AS199959 GWY IT PTY LTD

Detected #KongTuke infection chain Compromised site --> phiplips[.]click/l1hdpx7b.js (ClickFucker) --> phiplips[.]click/api/v1/session (token) --> phiplips[.]click/api/v1/verify (gateway) --> phiplips[.]click/api/v1/status (clipboard) --> tommy-eg[.]top/f (powershell) 372fa1524bcf4bb658b87d830071be38826beafb3311cd73c3d0314433233a5c f

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/meta.google.com (injected) --> alabastercompass[.]top/public/callback-stylesheet.js --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)

New #SocGholish C2: hXXps://cdn-js.tobaccobazaar[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== cdn-js.tobaccobazaar[.]com 89[.]117.0.38 AS46475 Limestone Networks, Inc.

Detected #KongTuke infection chain Compromised site --> ritchie[.]click/bgmmbr3x.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard)

Detected #KongTuke infection chain Compromised site --> thibahlt[.]lol/file.js (ClickFucker) --> thibahlt[.]lol/api/v1/session (token) --> thibahlt[.]lol/api/v1/verify (gateway) --> thibahlt[.]lol/api/v1/status (clipboard)

Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/d.js (injected) --> linenregistry[.]top/route/health-json.js --> linenregistry[.]top/route/callback-deploy --> linenregistry[.]top/route/profile-xml.js (clickfix)

New #SocGholish C2: hXXps://ui-portal.mekebibsolomonlaw[.]com/Xgd37BKqtSdK7BK3ECMfuoWjHCdMu3bB1ol3tSdD7BKqkw== ui-portal.mekebibsolomonlaw[.]com 104[.]238.57.228 AS199959 GWY IT PTY LTD

Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> acaciaearthwork[.]top/private/session-util.js --> acaciaearthwork[.]top/private/login-dom --> acaciaearthwork[.]top/private/health-header.js (clickfix)

Detected #KongTuke infection chain Compromised site --> oosterhout[.]click/82234daz.js (ClickFucker) --> oosterhout[.]click/api/v1/session (token) --> oosterhout[.]click/api/v1/verify (gateway) --> oosterhout[.]click/api/v1/status (clipboard) --> tommy-aa[.]lol/f (powershell) 64242dabcf2551d3aeab1ce9e22ae2e8508726d20ec3b347f783e5fa7216423c f

Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> slatebeacon[.]top/legacy/throttle-theme.js --> slatebeacon[.]top/legacy/identity-build --> slatebeacon[.]top/legacy/version-validator.js (clickfix)

New #SocGholish C2: hXXps://img-eu.veranofund[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== img-eu.veranofund[.]com 137[.]220.49.12 AS20473 The Constant Company, LLC

Detected #SmartApeSG infection chain Compromised site --> marblehaven[.]top/claims/profile-view --> marblehaven[.]top/claims/identity-render.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)

Detected #SmartApeSG infection chain Compromised site --> moonlitprovince[.]top/router/verify-build --> moonlitprovince[.]top/router/handler-asset.js (clickfix)

New #SocGholish C2: hXXps://rs-api.50adayplan[.]com/Xgd37BKqtSdK7BK3iN4fENqlucUjioTL73s31S7pY0l= rs-api.50adayplan[.]com 149[.]248.3.52 AS20473 The Constant Company, LLC

New #SocGholish C2: hXXps://free-api.travelaccex[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== free-api.travelaccex[.]com 45[.]76.238.138 AS20473 The Constant Company, LLC

New #SocGholish C2: hXXps://prod-dl.vandornpharmacy[.]net/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== prod-dl.vandornpharmacy[.]net 91[.]236.230.188 AS62005 BlueVPS OU

Detected #KongTuke infection chain Compromised site --> barringer[.]click/dsdchzzv.js (ClickFucker) --> barringer[.]click/api/v1/session (token) --> barringer[.]click/api/v1/verify (gateway) --> barringer[.]click/api/v1/status (clipboard) --> tommy-bb[.]lol/f (powershell) 489f30e58a4bd38d0707c7123967c8d62c35f80c0393f5d05d4c7ba3b12ae22d f

Detected #KongTuke infection chain Compromised site --> ritchie[.]click/frxhgs71.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard)

Detected #SmartApeSG infection chain Compromised site --> silverlandscape[.]top/claims/profile-view --> silverlandscape[.]top/claims/identity-render.js (clickfix)