Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
219 IOCs
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation
Excerpt
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation In September 2026, the cybersecurity community uncovered a massive, highly coordinated malvertising campaign leveraging the official, verified HBO Max Reddit account ( u/hbomax ). Over a frantic 48-hour period, the compromised account pushed 108 distinct “ClickFix” advertisements to users across the platform. Through joint research conducted by Hudson Rock and Kirk from…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →219 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | press29.com | High | Score 58/100 | First seen |
| Domain | houstongaragedoorinstallers.com | High | Score 61/100 | First seen |
| Domain | ouilov.com | High | Score 85/100 | First seen |
| Domain | cf.hugo-mapp.co | High | Score 58/100 | First seen |
| Domain | applediag.com | High | Score 58/100 | First seen |
| Domain | camaligsalvatrefoils.com | High | Score 58/100 | First seen |
| Domain | getnova.top | High | Score 58/100 | First seen |
| Domain | trekmesh15.com | High | Score 86/100 | First seen |
| SHA256 | ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb | High | Score 86/100 | First seen |
| Domain | st.hugo-lapp.lat | High | Score 58/100 | First seen |
| Domain | lb.propertyfind.cc | High | Score 86/100 | First seen |
| Domain | clveeragent.com | High | Score 58/100 | First seen |
| Domain | thepullmanfolkestone.com | High | Score 58/100 | First seen |
| Domain | desktop-version.com | High | Score 58/100 | First seen |
| SHA256 | 5ae085cb918abaeb83b4819106534247cfd30f30c77cbcc7806fbf99e12234fb | Medium | Score 53/100 | First seen |
| Domain | nova-desk.top | High | Score 58/100 | First seen |
| Domain | wdx.unguidedfreewill.co | High | Score 58/100 | First seen |
| Domain | cim-kolea.com | High | Score 58/100 | First seen |
| Domain | doh.hugo-mapp.co | High | Score 58/100 | First seen |
| Domain | verse-18.com | High | Score 86/100 | First seen |
| Domain | cw.hugo-lapp.lat | High | Score 58/100 | First seen |
| SHA256 | 97f9e987cbd9de6e853c1adcc7614a8d77d4216d63473e7a1f0f6356c5f0e771 | High | Score 85/100 | First seen |
| Domain | marbellaresales.com | High | Score 58/100 | First seen |
| SHA256 | ac90360ac4d8c2eb2585daa867d085d2fb12b859bed6c3a472a738cd08e55383 | Medium | Score 53/100 | First seen |
| Domain | muse-code-ide.com | High | Score 58/100 | First seen |
| SHA256 | 8d88b558dc9edbc4fdb66eb2451fd5f4df49266921346d2db1191cf23f0d13dc | Medium | Score 53/100 | First seen |
| Domain | hindustanagency.com | High | Score 58/100 | First seen |
| Domain | xn--i-ctbr1afp.gstats-api-contd.cc | High | Score 58/100 | First seen |
| SHA256 | 013e587247324cfa3005443d2b8036f9a434cafafa1d8a56a6f5637b3dd9d3c1 | Medium | Score 53/100 | First seen |
| Domain | alfredaps.com | High | Score 58/100 | First seen |
| Domain | umapla.com | High | Score 58/100 | First seen |
| Domain | cli-stack.com | High | Score 58/100 | First seen |
| Domain | congiagent.com | High | Score 58/100 | First seen |
| SHA1 | 3a35b409af86e79e8945d6a7ffb1dc59b8dbdf46 | Medium | Score 53/100 | First seen |
| Domain | opendisplay.us | High | Score 58/100 | First seen |
| SHA256 | ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331 | Medium | Score 53/100 | First seen |
| Domain | oakenfjrod.ru | High | Score 61/100 | First seen |
| SHA256 | f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7 | Medium | Score 53/100 | First seen |
| Domain | gogolfonline.com | High | Score 58/100 | First seen |
| SHA256 | d5a60dedf71308f5971269b7a63903e4b68992c392a0368f1dd03cb7e4bcefbc | Medium | Score 53/100 | First seen |
| Domain | mpasvw.com | High | Score 82/100 | First seen |
| SHA256 | 93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae | Medium | Score 53/100 | First seen |
| SHA256 | fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab | High | Score 85/100 | First seen |
| Domain | novastacktips.com | High | Score 58/100 | First seen |
| Domain | heroestales.com | High | Score 58/100 | First seen |
| SHA256 | 1ba14ee44de95a3e6dcb9866cd00015dbf37f078a74362a827b21c8b2ec48a1a | Medium | Score 53/100 | First seen |
| Domain | fcp.unguidedfreewill.co | High | Score 58/100 | First seen |
| SHA256 | 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505 | Medium | Score 53/100 | First seen |
| Domain | fern-plume.com | High | Score 86/100 | First seen |
| SHA1 | 7cc3cfc1ac007b8c6566fd2c7419b15a75473468 | Medium | Score 53/100 | First seen |
| Domain | xn--b1ahgbfifq.gstats-api-cont.co | High | Score 58/100 | First seen |
| Domain | wuess.com | High | Score 58/100 | First seen |
| SHA256 | 7a4c15c5f056322ceb9a16fd74374ec0e85aacbaeeb6042ff34b9c415e900864 | Medium | Score 53/100 | First seen |
| Domain | chatgpt-safepage.com | High | Score 58/100 | First seen |
| Domain | macfixguide.com | High | Score 58/100 | First seen |
| Domain | bright-links.com | High | Score 61/100 | First seen |
| Domain | basequill9.com | High | Score 58/100 | First seen |
| SHA256 | 825f0358da26a5cd85076be4586c4125ea5958235f3d9669ea3bf60c0edfc5b2 | Medium | Score 53/100 | First seen |
| Domain | arkypc.com | High | Score 86/100 | First seen |
| SHA256 | 407aaecabee599cb29dbb3cf177ed77b67f65d63f456c7abeda5834c0d36ed5f | High | Score 85/100 | First seen |
| Domain | fr.hugo-mapp.co | High | Score 58/100 | First seen |
| Domain | fd.gstats-api-contd.cc | High | Score 71/100 | First seen |
| Domain | habar55.namebright.bike | High | Score 58/100 | First seen |
| Domain | sprieagent.com | High | Score 58/100 | First seen |
| Domain | rudder-moss.com | High | Score 86/100 | First seen |
| Domain | claude-tools.com | High | Score 58/100 | First seen |
| Domain | cosimcagent.com | High | Score 58/100 | First seen |
| Domain | fd-api-irc.velqo7.co | High | Score 58/100 | First seen |
| Domain | aidevmaster.com | High | Score 86/100 | First seen |
| Domain | perchframe15.com | Medium | Score 41/100 | First seen |
| Domain | codex-notes.com | High | Score 58/100 | First seen |
| Domain | hbomaxx.app | High | Score 58/100 | First seen |
| Domain | gatemaden.space | High | Score 58/100 | First seen |
| Domain | lakhov.com | High | Score 79/100 | First seen |
| Domain | carlessclapped.com | High | Score 58/100 | First seen |
| Domain | tnt.unguidedfreewill.co | High | Score 58/100 | First seen |
| Domain | lalandscapelighting.com | High | Score 86/100 | First seen |
| SHA256 | 8c469b571875c6ba0009237379ba0a23b716db6d97724a81a7032a2e4b3456b6 | Medium | Score 53/100 | First seen |
| Domain | macstoragetips.com | High | Score 58/100 | First seen |
| SHA256 | d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540 | Medium | Score 53/100 | First seen |
| Domain | wdx.velqo7.co | High | Score 58/100 | First seen |
| Domain | nova-fix.top | High | Score 58/100 | First seen |
| SHA256 | ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7 | Medium | Score 53/100 | First seen |
| Domain | glowmedaesthetics.com | High | Score 86/100 | First seen |
| SHA256 | fbc6e1867de39feb53f62f8fe805b9dee8ca66e751243731d1db3974eba07e97 | Medium | Score 53/100 | First seen |
| Domain | storageprofiler.com | High | Score 58/100 | First seen |
| Domain | cmux-lab.com | High | Score 58/100 | First seen |
| SHA256 | 0d58616c750fc8530a7e90eee18398ddedd08cc0f4908c863ab650673b9819dd | Medium | Score 53/100 | First seen |
| Domain | wdm.unguidedfreewill.co | High | Score 58/100 | First seen |
| SHA256 | d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2 | Medium | Score 53/100 | First seen |
| Domain | io.hugo-lapp.lat | High | Score 58/100 | First seen |
| Domain | kffd3.vogueatelier.cc | High | Score 86/100 | First seen |
| SHA256 | 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7 | Medium | Score 53/100 | First seen |
| Domain | sic180.com | High | Score 58/100 | First seen |
| Domain | fd.hugo-lapp.lat | High | Score 58/100 | First seen |
| Domain | node-slate.com | High | Score 86/100 | First seen |
| Domain | ember-bridge.com | High | Score 58/100 | First seen |
| Domain | dogtrainersgeorgia.com | High | Score 86/100 | First seen |
| Domain | sp13.gstats-api-coni.co | High | Score 58/100 | First seen |
| Domain | crisp-paths.com | High | Score 58/100 | First seen |
| Domain | microsoftupdater.info | High | Score 58/100 | First seen |
| Domain | fd-api-irf.velqo7.co | High | Score 58/100 | First seen |
| Domain | flutelikelurkerunsinewy.com | High | Score 58/100 | First seen |
| SHA256 | 06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b | Medium | Score 53/100 | First seen |
| Domain | cehamilton.com | High | Score 58/100 | First seen |
| SHA256 | f771f4717ed04f723b30f9e0424cc2f630f1ffe47857502edd27c3c40c609320 | Medium | Score 53/100 | First seen |
| SHA256 | f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e | High | Score 86/100 | First seen |
| Domain | sgaaagent.com | High | Score 58/100 | First seen |
| Domain | claud-tips.com | High | Score 58/100 | First seen |
| SHA256 | 86d0c50cab4f394c58976c44d6d7b67a7dfbbb813fbcf622236e183d94fd944f | Medium | Score 53/100 | First seen |
| SHA256 | 91b192d28380c77bda19a142c8979d03b3409ca819c07e6dabae0c73a2ab2360 | Medium | Score 53/100 | First seen |
| Domain | apple.clean-disk-guide.com | High | Score 58/100 | First seen |
| Domain | codex-paths.com | High | Score 58/100 | First seen |
| Domain | euquiz.space | High | Score 58/100 | First seen |
| Domain | fd-api-zog.velqo7.co | High | Score 58/100 | First seen |
| SHA256 | 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938 | Medium | Score 53/100 | First seen |
| Domain | wix.velqo7.co | High | Score 58/100 | First seen |
| SHA1 | 6936edc505501ebb2f202c985a021a06f1c10c9e | Medium | Score 53/100 | First seen |
| Domain | nova-hub.top | High | Score 58/100 | First seen |
| Domain | cli-desktop.com | High | Score 86/100 | First seen |
| Domain | filesiriuscore.com | High | Score 58/100 | First seen |
| Domain | sp1.gstats-api-coni.co | High | Score 58/100 | First seen |
| SHA256 | 439f01ee546eabbdbcc02c0312cf3de28877ed8fcba80e46da88b76b02527a66 | Medium | Score 53/100 | First seen |
| Domain | hbomaxx.us | High | Score 58/100 | First seen |
| SHA256 | 5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad | Medium | Score 53/100 | First seen |
| Domain | fd-api-iris.velqo7.co | High | Score 58/100 | First seen |
| SHA256 | 5ee86cbcd296e0998ca20ee65a7506fb3baecfb7ce98eede29bff1a6a6e0fc95 | High | Score 85/100 | First seen |
| Domain | beaocnagent.com | High | Score 86/100 | First seen |
| SHA256 | 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96 | Medium | Score 53/100 | First seen |
| SHA256 | d72df956a51b1ec0af1e1d375a5704538d2e32688259c14aed39cf1e9d0d770a | Medium | Score 53/100 | First seen |
| SHA256 | a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411 | Medium | Score 53/100 | First seen |
| Domain | xn--b1aluem3j.gstats-api-contd.cc | High | Score 58/100 | First seen |
| SHA256 | 9f26da2456f30b1e10c9aaee4fbf4cbab07912177366aca7fa1103be08a026ff | Medium | Score 53/100 | First seen |
| SHA256 | 863f2b5cc85b6d02585a74c085ec028931f70753bf85e01fd03f029a36f0ce6d | Medium | Score 53/100 | First seen |
| SHA256 | 23bec473632af324b0a271f6b0575ea3d3174af7042ee5d582cb739714a35af8 | High | Score 85/100 | First seen |
| Domain | jup.unguidedfreewill.co | High | Score 58/100 | First seen |
| Domain | glrack.com | High | Score 58/100 | First seen |
| Domain | leaf68.com | High | Score 58/100 | First seen |
| Domain | esp.hugo-mapp.co | High | Score 58/100 | First seen |
| Domain | gigappyworld.com | High | Score 58/100 | First seen |
| SHA256 | 5a9a3ce9ff74d7823737b184330134b25a4f36fc1d268789229f8de16832508c | Medium | Score 53/100 | First seen |
| Domain | dau.hugo-mapp.co | High | Score 58/100 | First seen |
| SHA1 | a1e50daf64fb2b342a64d848e396700962acc2d0 | Medium | Score 53/100 | First seen |
| Domain | en.hugo-mapp.co | High | Score 58/100 | First seen |
| Domain | clean-disk-guide.com | High | Score 58/100 | First seen |
| SHA256 | ebb2a2f9f58d0908848399ffcb3a254e9171a8c14daeeae7fc042376372802f4 | Medium | Score 53/100 | First seen |
| SHA256 | a69fb9b56a10c8616e76b20a6900842737e16077796aa195b86b71407b8e79b9 | Medium | Score 53/100 | First seen |
| SHA256 | 2f04ba77bb841111036b979fc0dab7fcbae99749718ae1dd6fd348d4495b5f74 | Medium | Score 53/100 | First seen |
| SHA256 | 06c74829d8eee3c47e17d01c41361d314f12277d899cc9dfa789fe767c03693e | Medium | Score 53/100 | First seen |
| Domain | br.hugo-lapp.co | High | Score 58/100 | First seen |
| Domain | pt.hugo-lapp.co | High | Score 58/100 | First seen |
| Domain | papartybus.com | High | Score 86/100 | First seen |
| Domain | pinescope11.com | High | Score 86/100 | First seen |
| Domain | mgo.gstats-api-contact.cc | High | Score 86/100 | First seen |
| Domain | flame-guard.cc | High | Score 86/100 | First seen |
| SHA256 | e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c | Medium | Score 53/100 | First seen |
| Domain | static.quorashift.cc | High | Score 86/100 | First seen |
| Domain | remotion-skills.com | High | Score 58/100 | First seen |
| Domain | harbor-29.com | High | Score 58/100 | First seen |
| Domain | cli-guides.com | High | Score 58/100 | First seen |
| Domain | broadwalkindia.com | High | Score 58/100 | First seen |
| SHA256 | bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40 | High | Score 85/100 | First seen |
| SHA256 | dbe8f391291a66a509d5a0144ece8e61789657f96bac14f786293bb4d2ca21ac | Medium | Score 53/100 | First seen |
| SHA256 | 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4 | High | Score 86/100 | First seen |
| SHA256 | 31cf473bb93abef0760d4992d45bafcd936edb7c26193c175f8491f8ffaef0e0 | High | Score 85/100 | First seen |
| Domain | kffd3.vexlatech.cc | High | Score 86/100 | First seen |
| Domain | pressureulcerlawyer.com | High | Score 58/100 | First seen |
| SHA256 | f122d596ac6f5bb26ec69ab5fa68506da71d0f72bba5533c913dedd0314855e7 | Medium | Score 53/100 | First seen |
| SHA256 | 008e04a7807f9ed59d77942b1d268e4a93bb82316346f48e5f5b663233db3fff | Medium | Score 53/100 | First seen |
| Domain | ed.hugo-lapp.lat | High | Score 58/100 | First seen |
| SHA256 | 02ac1914fcb4efae0699571751acd700ef0a1933312cd37e72bb7f37bacf4776 | Medium | Score 53/100 | First seen |
| Domain | kr.hugo-lapp.co | High | Score 58/100 | First seen |
| Domain | pkg.vogueatelier.cc | High | Score 86/100 | First seen |
| Domain | smart.hugo-mapp.co | High | Score 58/100 | First seen |
| Domain | pine63.com | High | Score 58/100 | First seen |
| Domain | td.hugo-lapp.lat | High | Score 58/100 | First seen |
| SHA256 | 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24 | Medium | Score 53/100 | First seen |
| SHA256 | eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009 | Medium | Score 53/100 | First seen |
| Domain | grove-12.com | High | Score 58/100 | First seen |
| Domain | fd-api-irs.velqo7.co | High | Score 58/100 | First seen |
| Domain | code-desktop.com | High | Score 62/100 | First seen |
| Domain | filequanticore.com | High | Score 58/100 | First seen |
| Domain | paf.hugo-mapp.co | High | Score 58/100 | First seen |
| SHA256 | 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5 | Medium | Score 53/100 | First seen |
| Domain | macdeveloperhub.com | High | Score 58/100 | First seen |
| SHA256 | d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c | Medium | Score 53/100 | First seen |
| SHA256 | ecfaa20f25e11878686249c7094706bc3dcd2dc0ace0f2932a39d1bfdac85863 | Medium | Score 53/100 | First seen |
| SHA256 | 6705033c16d499d65b79f0f8f459a8ea214ae85aedffb3d25f68ba26e455f136 | Medium | Score 53/100 | First seen |
| Domain | hbomax-macos.com | High | Score 86/100 | First seen |
| Domain | pf.hugo-mapp.co | High | Score 58/100 | First seen |
| Domain | fd-api-rop.velqo7.co | High | Score 58/100 | First seen |
| Domain | wantsellonline.com | High | Score 58/100 | First seen |
| SHA256 | cf8d03a0de9e29e3f6a81606443cbf9df2167e95435f88ede747415d4b7e84ed | Medium | Score 53/100 | First seen |
| Domain | nova-labs.top | High | Score 58/100 | First seen |
| Domain | wdm.velqo7.co | High | Score 58/100 | First seen |
| Domain | denverplumbingandwaterheater.com | High | Score 86/100 | First seen |
| SHA256 | 48cc0941b4129bfaeb6948de49dc7c81456e92907b3ea6bdcef5ff186dddf200 | Medium | Score 53/100 | First seen |
| Domain | rectangleap.com | High | Score 58/100 | First seen |
| Domain | sp13.gstats-api-cont.co | High | Score 58/100 | First seen |
| SHA256 | 52385473e1a64ae5b7a3b79f145304e6b2c5db53e8883e6beede41821c08673f | Medium | Score 53/100 | First seen |
| Domain | homebrwmac-hub.com | High | Score 58/100 | First seen |
| Domain | fd.gstats-api-contact.cc | High | Score 86/100 | First seen |
| SHA1 | 1c19a9afa995b096ea029723df3c2afa33c2957c | Medium | Score 53/100 | First seen |
| Domain | sdx.unguidedfreewill.co | High | Score 58/100 | First seen |
| Domain | hbubagent.com | High | Score 58/100 | First seen |
| Domain | nova-tools.top | High | Score 58/100 | First seen |
| Domain | canvas-35.com | High | Score 58/100 | First seen |
| Domain | restoremental.com | High | Score 86/100 | First seen |
| Domain | weaveridge7.com | High | Score 86/100 | First seen |
| Domain | cladesktop.gitlab.io | High | Score 58/100 | First seen |
| SHA256 | 6d9ced8d62655d1a0ddc0d6b5359a10e921b4b2b3b1000dcf96b240f2fa79662 | Medium | Score 53/100 | First seen |
| SHA256 | d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb | Medium | Score 53/100 | First seen |
| SHA256 | 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 | High | Score 85/100 | First seen |
| Domain | clean-disk-tools.com | High | Score 58/100 | First seen |
| Domain | dmt.unguidedfreewill.co | High | Score 58/100 | First seen |
| SHA256 | 12f6fde9d8058292ad1fb869352eebd615aa59c526a481a39fb52aa59e368d0d | Medium | Score 53/100 | First seen |
| Domain | codex-craft.com | High | Score 86/100 | First seen |
| Domain | aforvm.com | High | Score 80/100 | First seen |
| SHA256 | d4cfab5e052df4c049f258e226d11825cb37b0359be454b83241edd59b295f08 | High | Score 85/100 | First seen |
IOC Relationship Graph
Building graph…