A Fake Captcha, a Trojanised File Manager, and a Year of IOC C2 Domains
- Published by
- Report URI Blog
- Published
- 8 Oct 2026
- Indicators
- 12 verified
The report
On 7th October our Threat Intelligence pipeline flagged a script from ohhhhhmoney.com injected into compromised WordPress sites. It is a ClickFix kit, and at the end of the chain is a backdoored copy of a real desktop app. Its Command and Control (C2) server moves to a new domain
Read the full analysis: A Fake Captcha, a Trojanised File Manager, and a Year of IOC C2 Domains (Report URI Blog).
Indicators
Malware C
- nhyeoeaueesyih[.]com
- srnnereaivm[.]com
- heahnoetsteot[.]com
- reoineueryete[.]com
- gradnoesieheco[.]com
- iwtuhfuei[.]com
- dtteeoerp[.]com
- vaituusoeeaanu[.]com
- daihmtnawe[.]com
- ieyoqrhtz[.]com
- chueohoe[.]com
- teevoeeaoobn[.]com
Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.
How this is tracked
EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#11). This page is generated from that record and the report’s own title and summary; nothing is rewritten.