Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
MacOS ClickFix AMOS Campaign | Ransom-ISAC Blog - Ransom-ISAC Skip to main content Suspected cyber incident? Get support → About Blog Partners Membership L.O.C.K. S.T.A.R. Threat Summit · Recordings Login Back to Blog Threat Intelligence 10 min read September 17, 2026 macOS ClickFix BotProtection AMOS Malware MacOS ClickFix AMOS Campaign A Fake “Bot Protection” Prompt Is Stealing Mac Users’ Crypto Wallets, and the Cleanup Is Not Keeping Up Dani [Varys] Z & Dimple Gajra…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →168 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | robbywoj321.life | High | Score 86/100 | First seen |
| Domain | korichniuu122.icu | High | Score 86/100 | First seen |
| Domain | insightpixel.icu | High | Score 86/100 | First seen |
| Domain | easy-pixx321.world | High | Score 86/100 | First seen |
| Domain | faircloud512421.buzz | High | Score 86/100 | First seen |
| Domain | bromment41293.life | High | Score 86/100 | First seen |
| Domain | bladehostpi.life | High | Score 86/100 | First seen |
| Domain | relmciarnlioix.life | High | Score 86/100 | First seen |
| Domain | borny51221.icu | High | Score 86/100 | First seen |
| Domain | norrykilu231.digital | High | Score 86/100 | First seen |
| Domain | elizium999.digital | High | Score 86/100 | First seen |
| Domain | trokorypi451.icu | High | Score 86/100 | First seen |
| Domain | strongerpi921.life | High | Score 86/100 | First seen |
| Domain | buildingpi81.xyz | High | Score 86/100 | First seen |
| Domain | sable-orbit-wren-fiayn.live | High | Score 86/100 | First seen |
| Domain | ridge-ciosktai.site | High | Score 86/100 | First seen |
| URL | http://95.163.153.80:8133/api/t | High | Score 58/100 | First seen |
| Domain | minutes59.life | High | Score 86/100 | First seen |
| Domain | metricvault.icu | High | Score 86/100 | First seen |
| Domain | passeofum32.life | High | Score 86/100 | First seen |
| URL | http://62.60.156.226/payload/arm64/amos_bin | High | Score 58/100 | First seen |
| Domain | nonapi912.life | High | Score 86/100 | First seen |
| Domain | rukkoldauwe87.xyz | High | Score 86/100 | First seen |
| Domain | rokkko89123.life | High | Score 86/100 | First seen |
| Domain | bornilob43.life | High | Score 86/100 | First seen |
| Domain | thunderstopui912.life | High | Score 86/100 | First seen |
| Domain | brobbaeonlucid.life | High | Score 86/100 | First seen |
| Domain | apparatinpi22.life | High | Score 86/100 | First seen |
| Domain | reed-greogzium.life | High | Score 86/100 | First seen |
| Domain | workworm1412.buzz | High | Score 86/100 | First seen |
| Domain | nailpiuwe8921.life | High | Score 86/100 | First seen |
| Domain | longslimpi.life | High | Score 86/100 | First seen |
| Domain | ochre-otter-nernbreoe.life | High | Score 86/100 | First seen |
| Domain | analyticshore.icu | High | Score 86/100 | First seen |
| Domain | closegate21.xyz | High | Score 86/100 | First seen |
| Domain | basepiip9911.icu | High | Score 86/100 | First seen |
| Domain | sleepingpi81.life | High | Score 86/100 | First seen |
| Domain | ochre-wren-satbais.life | High | Score 86/100 | First seen |
| Domain | gixxipi9823.life | High | Score 86/100 | First seen |
| Domain | preokcriix.live | High | Score 86/100 | First seen |
| Domain | shaltaypi.life | High | Score 86/100 | First seen |
| URL | http://62.60.156.226/stager/init?force=1 | High | Score 58/100 | First seen |
| Domain | wailciry9911.icu | High | Score 86/100 | First seen |
| Domain | fairpi521.icu | High | Score 86/100 | First seen |
| Domain | compresspi9123.life | High | Score 86/100 | First seen |
| Domain | alcopiii876.digital | High | Score 86/100 | First seen |
| Domain | pagestatix.icu | High | Score 86/100 | First seen |
| Domain | nickopi141.life | High | Score 86/100 | First seen |
| Domain | beffitepi.buzz | High | Score 86/100 | First seen |
| Domain | ashen-arc-badger-maie.life | High | Score 86/100 | First seen |
| Domain | shadowmetric.buzz | High | Score 86/100 | First seen |
| Domain | buysypi831.life | High | Score 86/100 | First seen |
| Domain | bizzypiu45.life | High | Score 86/100 | First seen |
| Domain | pixelinsights.xyz | High | Score 86/100 | First seen |
| Domain | webpulsedata.icu | High | Score 86/100 | First seen |
| Domain | rollingpi4512.icu | High | Score 86/100 | First seen |
| Domain | gearlipi72.life | High | Score 86/100 | First seen |
| Domain | saymto9213.life | High | Score 86/100 | First seen |
| Domain | beautiful213.life | High | Score 86/100 | First seen |
| Domain | nachoiuiwe123.buzz | High | Score 86/100 | First seen |
| Domain | quiet-whirl-rook-stoon.live | High | Score 86/100 | First seen |
| Domain | speedpi12321.xyz | High | Score 86/100 | First seen |
| Domain | viorsoonlucid.life | High | Score 86/100 | First seen |
| Domain | dollllar881122.icu | High | Score 86/100 | First seen |
| Domain | volvernimo31.life | High | Score 86/100 | First seen |
| URL | http://62.60.156.226/payload/x86_64/amos_bin | High | Score 58/100 | First seen |
| Domain | stoppingpi82.life | High | Score 86/100 | First seen |
| Domain | siteinsights.icu | High | Score 86/100 | First seen |
| Domain | stoppingignpi.buzz | High | Score 86/100 | First seen |
| Domain | killswpi912.life | High | Score 86/100 | First seen |
| Domain | reed-pavcaeor.life | High | Score 86/100 | First seen |
| Domain | datapixel.icu | High | Score 86/100 | First seen |
| Domain | barsuki8822.life | High | Score 86/100 | First seen |
| Domain | webtracelab.icu | High | Score 86/100 | First seen |
| Domain | vitamindpi55.digital | High | Score 86/100 | First seen |
| Domain | ornikol232.life | High | Score 86/100 | First seen |
| Domain | material813.icu | High | Score 86/100 | First seen |
| Domain | analyze-me6.world | High | Score 86/100 | First seen |
| Domain | flowerpii9831.life | High | Score 86/100 | First seen |
| Domain | roddyki9911.icu | High | Score 86/100 | First seen |
| Domain | lunar-quill-fluscriois.live | High | Score 86/100 | First seen |
| Domain | trombler312.life | High | Score 86/100 | First seen |
| Domain | norkapi41.icu | High | Score 86/100 | First seen |
| Domain | googlanalitlcs.live | High | Score 86/100 | First seen |
| Domain | trackmetrica.icu | High | Score 86/100 | First seen |
| Domain | nornikal3pi12.life | High | Score 86/100 | First seen |
| Domain | housemill9911.digital | High | Score 86/100 | First seen |
| Domain | flaempriarnnois.space | High | Score 86/100 | First seen |
| Domain | bloodhorn8123.icu | High | Score 86/100 | First seen |
| URL | http://62.60.216.43/ | High | Score 58/100 | First seen |
| Domain | webgleam.info | High | Score 86/100 | First seen |
| Domain | nick-metry.icu | High | Score 86/100 | First seen |
| Domain | vasino921.life | High | Score 86/100 | First seen |
| Domain | clickstream.icu | High | Score 86/100 | First seen |
| Domain | mesa-seen-dcjcj.live | High | Score 86/100 | First seen |
| Domain | litseaochre.life | High | Score 86/100 | First seen |
| Domain | productpi121.icu | High | Score 86/100 | First seen |
| Domain | godbleesss8912.life | High | Score 86/100 | First seen |
| Domain | googlanalitlcs.icu | High | Score 86/100 | First seen |
| Domain | combenipi9231.xyz | High | Score 86/100 | First seen |
| Domain | millionpi66.website | High | Score 86/100 | First seen |
| Domain | diseltank12.xyz | High | Score 86/100 | First seen |
| Domain | usual-pixx12.digital | High | Score 86/100 | First seen |
| Domain | kineticnode.shop | High | Score 86/100 | First seen |
| Domain | beacontrace.bond | High | Score 86/100 | First seen |
| Domain | girlsonpi823.life | High | Score 86/100 | First seen |
| Domain | rolandypo98.life | High | Score 86/100 | First seen |
| Domain | metrictrace.info | High | Score 86/100 | First seen |
| Domain | vailora231.life | High | Score 86/100 | First seen |
| Domain | otter-trioor-m8jr9.space | High | Score 86/100 | First seen |
| SHA256 | 5390d111dac10f013473e65174481a0054fd58e4d85ec51db4b9716380ad8832 | Medium | Score 53/100 | First seen |
| Domain | secretpi88122.life | High | Score 86/100 | First seen |
| Domain | googlanalitlcs.pro | High | Score 86/100 | First seen |
| Domain | rogethapi2134.life | High | Score 86/100 | First seen |
| Domain | prismlogic.cfd | High | Score 86/100 | First seen |
| Domain | nickylody124.life | High | Score 86/100 | First seen |
| Domain | rokkyho32.life | High | Score 86/100 | First seen |
| Domain | metricspixel.live | High | Score 86/100 | First seen |
| MD5 | e1d28341a66a711f6f2d50fbbd24114b | Medium | Score 53/100 | First seen |
| Domain | pixelmetrics.live | High | Score 86/100 | First seen |
| Domain | wikkkipi12.icu | High | Score 86/100 | First seen |
| Domain | coral-forge-beacon-glioen.live | High | Score 86/100 | First seen |
| Domain | carwowk872.life | High | Score 86/100 | First seen |
| Domain | datapointly.icu | High | Score 86/100 | First seen |
| Domain | krainerpi89124.icu | High | Score 86/100 | First seen |
| Domain | fallow-willow-diogdaiyn.xyz | High | Score 86/100 | First seen |
| Domain | stepbysteppi9.life | High | Score 86/100 | First seen |
| Domain | willynop9821.icu | High | Score 86/100 | First seen |
| Domain | fire-grass12.life | High | Score 86/100 | First seen |
| Domain | borrylistu898214.icu | High | Score 86/100 | First seen |
| Domain | porky94124.icu | High | Score 86/100 | First seen |
| Domain | oldmon56121.icu | High | Score 86/100 | First seen |
| Domain | nickilorr421.icu | High | Score 86/100 | First seen |
| Domain | voyag413.xyz | High | Score 86/100 | First seen |
| Domain | pixellanalit213.buzz | High | Score 86/100 | First seen |
| Domain | stiaxvadkloai.life | High | Score 86/100 | First seen |
| SHA256 | dc5a26792bac723d4a5c9b14e0f17129328aed1d42b2cfa609ea0f9e005b6ee1 | Medium | Score 53/100 | First seen |
| Domain | logicvault.icu | High | Score 86/100 | First seen |
| Domain | metrix-getrix.icu | High | Score 86/100 | First seen |
| Domain | dolpi812.life | High | Score 86/100 | First seen |
| Domain | visitorflow.icu | High | Score 86/100 | First seen |
| Domain | biobkliaum.live | High | Score 86/100 | First seen |
| Domain | pageglance.icu | High | Score 86/100 | First seen |
| Domain | trokny23.life | High | Score 86/100 | First seen |
| Domain | badger-kuis-vnex5.life | High | Score 86/100 | First seen |
| Domain | electroste99.life | High | Score 86/100 | First seen |
| Domain | corrykro.icu | High | Score 86/100 | First seen |
| Domain | rerrioara.live | High | Score 86/100 | First seen |
| Domain | desigions9812.life | High | Score 86/100 | First seen |
| Domain | rokkykopi.icu | High | Score 86/100 | First seen |
| Domain | torrybok11.icu | High | Score 86/100 | First seen |
| Domain | moss-froggaee.space | High | Score 86/100 | First seen |
| Domain | desigino932.life | High | Score 86/100 | First seen |
| Domain | evrything-pix.icu | High | Score 86/100 | First seen |
| Domain | analyze-me3.buzz | High | Score 86/100 | First seen |
| Domain | rukkolpi55.icu | High | Score 86/100 | First seen |
| Domain | googlanalitlcs.xyz | High | Score 86/100 | First seen |
| Domain | costum342183.life | High | Score 86/100 | First seen |
| Domain | coral-zephyr-koarseara.xyz | High | Score 86/100 | First seen |
| Domain | atomento10.icu | High | Score 86/100 | First seen |
| Domain | speakingfepi21.life | High | Score 86/100 | First seen |
| Domain | soilnopi1122.life | High | Score 86/100 | First seen |
| Domain | sotopiingpi91.xyz | High | Score 86/100 | First seen |
| Domain | toothnir23.xyz | High | Score 86/100 | First seen |
| SHA256 | 75e2543fa49ab2efbe78edcf36b0d8c9273c4f97f83147d52c342c7725409ffb | Medium | Score 53/100 | First seen |
| Domain | gpixx.xyz | High | Score 86/100 | First seen |
| Domain | trokuni412.icu | High | Score 86/100 | First seen |
| Domain | googlanalitlcs.online | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…