{ "type": "Domain", "indicator": "glsrvc.cloud", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/glsrvc.cloud", "alexa": "http://www.alexa.com/siteinfo/glsrvc.cloud", "indicator": "glsrvc.cloud", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4072129552, "indicator": "glsrvc.cloud", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "686c6733844c8e929d5cca1e", "name": "netsupport", "description": "", "modified": "2026-02-14T06:19:08.153000", "created": "2025-07-08T00:32:51.298000", "tags": [ "NetSupport" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 217, "FileHash-MD5": 42, "FileHash-SHA1": 42, "FileHash-SHA256": 275, "domain": 15, "hostname": 6 }, "indicator_count": 597, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "107 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6894f62d1121db26437a3eee", "name": "\u201cCAPTCHAgeddon\u201d Unmasking the Viral Evolution of the ClickFix Browser-Based Threat", "description": "What began as a niche red-team trick posing as a harmless captcha challenge rapidly mutated into one of today\u2019s most dominant attack methods. Like a real-world virus variant, this new \u201cClickFix\u201d strain quickly outpaced and ultimately wiped out the infamous fake browser update scam that plagued the web just last year. It did so by removing the need for file downloads, using smarter social engineering tactics, and spreading through trusted infrastructure. The result - a wave of infections ranging from mass drive-by attacks to hyper-targeted spear-phishing lures.", "modified": "2025-09-06T18:03:44.493000", "created": "2025-08-07T18:53:33.547000", "tags": [ "clickfix", "google", "powershell", "clearfake", "dbscan", "guardio", "wordpress", "uuids", "narrative", "evasion", "cluster", "lumma stealer", "stealth", "june", "chaos", "clarity", "noise", "entropy", "shell" ], "references": [ "https://guard.io/labs/captchageddon-unmasking-the-viral-evolution-of-the-clickfix-browser-based-threat", "https://thehackernews.com/2025/08/clickfix-malware-campaign-exploits.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ClickFix", "display_name": "ClickFix", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AustinBH", "id": "147442", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5, "domain": 272, "hostname": 39 }, "indicator_count": 316, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "267 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68933138ab2c03a350e61156", "name": "ClickFix Malware Dominates Delivery Chains", "description": "", "modified": "2025-09-05T10:03:04.115000", "created": "2025-08-06T10:40:56.352000", "tags": [], "references": [ "Cyber Threat Advisory - ClickFix Malware Dominates Delivery Chains.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 23, "domain": 43, "hostname": 14 }, "indicator_count": 80, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "269 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "689339df5af76fd5f4d1e21d", "name": "ClickFix Malware Dominates Delivery Chains", "description": "", "modified": "2025-08-06T11:17:51.057000", "created": "2025-08-06T11:17:51.057000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 42, "hostname": 8 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "299 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "683b972db5a0c83f21189baa", "name": "URLHaus data - 31-05-2025", "description": "", "modified": "2025-06-30T23:00:46.773000", "created": "2025-05-31T23:56:29.887000", "tags": [ "elf", "lnk", "xml-opendir", "censys", "CobaltStrike", "backdoor", "sshdkit", "hajime", "apk", "ready.apk", "SpyNote", "mirai", "ua-wget", "sh", "gafgyt", "ascii", "Encoded", "exe", "RedLineStealer", "CoinMiner", "Redosdru", "LummaStealer", "NetSupport", "base64-loader", "powershell", "ps1", "PowreShell", "encrypted", "hta", "RemcosRAT", "AgentTesal", "vbs", "SharkStealer", "Stealc", "ACRStealer", "Rhadamanthys", "QuasarRAT", "AsyncRAT", "xworm", "KongTuke", "dropped-by-ACRStealer", "geofenced", "RUS", "ukr", "xmrig", "connectwise", "opendir" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 60, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 171, "hostname": 7, "domain": 13 }, "indicator_count": 191, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "335 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/", "https://thehackernews.com/2025/08/clickfix-malware-campaign-exploits.html", "https://guard.io/labs/captchageddon-unmasking-the-viral-evolution-of-the-clickfix-browser-based-threat", "Cyber Threat Advisory - ClickFix Malware Dominates Delivery Chains.pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Clickfix" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "686c6733844c8e929d5cca1e", "name": "netsupport", "description": "", "modified": "2026-02-14T06:19:08.153000", "created": "2025-07-08T00:32:51.298000", "tags": [ "NetSupport" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 217, "FileHash-MD5": 42, "FileHash-SHA1": 42, "FileHash-SHA256": 275, "domain": 15, "hostname": 6 }, "indicator_count": 597, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "107 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6894f62d1121db26437a3eee", "name": "\u201cCAPTCHAgeddon\u201d Unmasking the Viral Evolution of the ClickFix Browser-Based Threat", "description": "What began as a niche red-team trick posing as a harmless captcha challenge rapidly mutated into one of today\u2019s most dominant attack methods. Like a real-world virus variant, this new \u201cClickFix\u201d strain quickly outpaced and ultimately wiped out the infamous fake browser update scam that plagued the web just last year. It did so by removing the need for file downloads, using smarter social engineering tactics, and spreading through trusted infrastructure. The result - a wave of infections ranging from mass drive-by attacks to hyper-targeted spear-phishing lures.", "modified": "2025-09-06T18:03:44.493000", "created": "2025-08-07T18:53:33.547000", "tags": [ "clickfix", "google", "powershell", "clearfake", "dbscan", "guardio", "wordpress", "uuids", "narrative", "evasion", "cluster", "lumma stealer", "stealth", "june", "chaos", "clarity", "noise", "entropy", "shell" ], "references": [ "https://guard.io/labs/captchageddon-unmasking-the-viral-evolution-of-the-clickfix-browser-based-threat", "https://thehackernews.com/2025/08/clickfix-malware-campaign-exploits.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ClickFix", "display_name": "ClickFix", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AustinBH", "id": "147442", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5, "domain": 272, "hostname": 39 }, "indicator_count": 316, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "267 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68933138ab2c03a350e61156", "name": "ClickFix Malware Dominates Delivery Chains", "description": "", "modified": "2025-09-05T10:03:04.115000", "created": "2025-08-06T10:40:56.352000", "tags": [], "references": [ "Cyber Threat Advisory - ClickFix Malware Dominates Delivery Chains.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 23, "domain": 43, "hostname": 14 }, "indicator_count": 80, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "269 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "689339df5af76fd5f4d1e21d", "name": "ClickFix Malware Dominates Delivery Chains", "description": "", "modified": "2025-08-06T11:17:51.057000", "created": "2025-08-06T11:17:51.057000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 42, "hostname": 8 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "299 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "683b972db5a0c83f21189baa", "name": "URLHaus data - 31-05-2025", "description": "", "modified": "2025-06-30T23:00:46.773000", "created": "2025-05-31T23:56:29.887000", "tags": [ "elf", "lnk", "xml-opendir", "censys", "CobaltStrike", "backdoor", "sshdkit", "hajime", "apk", "ready.apk", "SpyNote", "mirai", "ua-wget", "sh", "gafgyt", "ascii", "Encoded", "exe", "RedLineStealer", "CoinMiner", "Redosdru", "LummaStealer", "NetSupport", "base64-loader", "powershell", "ps1", "PowreShell", "encrypted", "hta", "RemcosRAT", "AgentTesal", "vbs", "SharkStealer", "Stealc", "ACRStealer", "Rhadamanthys", "QuasarRAT", "AsyncRAT", "xworm", "KongTuke", "dropped-by-ACRStealer", "geofenced", "RUS", "ukr", "xmrig", "connectwise", "opendir" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 60, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 171, "hostname": 7, "domain": 13 }, "indicator_count": 191, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "335 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "glsrvc.cloud", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "glsrvc.cloud", "found": true, "verdict": "malicious", "url_count": 1, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://glsrvc.cloud/Xorde3Yv.txt", "status": "offline", "threat": "malware_download", "date_added": "2025-05-31", "tags": [ "NetSupport" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780318708.4019485 }