DEV Community: Daniel J

Yahoo Mail malvertising: two cloaked tech support scam chains

Daniel J — Mon, 12 Oct 2026 13:23:04 +0000

Two scam operations ran ads in the same sponsored slot of AT&T's Yahoo Mail on October 7 and 8, 2026. In whack.sh scans of the original ad click links, only Windows desktops on home broadband received the fake Microsoft security alert and its toll-free number. Our visits from a data center and from a phone received a dating or personal finance article.

The first ad framed the alert over a dating article on checkouters[.]app. The second ad passed through a Branch deep link and a filtering server (TDS) at maizerubyen[.]site. That server sent our home broadband visit to a scam page on Azure static website hosting. The first operation's scam kit appears in 747 public scans of 536 cloud hostnames. The scans run from July 12 to October 10, 2026, the 90 days our archive search reaches.

By Daniel Jones, Founder, Tuxxin LLC. Drafted with AI assistance.

William Vincent, a whack.sh customer, noticed something off about the ads and sent us the original click links. A second review by Kirk of ohey.ca added 31 hostnames and three Azure environments to the kit's footprint.

The story on tuxxin.com lists the reports we filed with each provider and explains what to do after seeing the alert.

The ad and its click tracker

The ad sat in the inbox list like an email. Its sender line read "CHECKOUTERS" and its subject read "(1) New Message". A small "Ad" label marked it as sponsored.

The ad row in AT&T Yahoo Mail, October 2026. Screenshot by William Vincent, cropped to the ad, with personal details removed.

A click passed through Taboola's click tracker under the publisher ID yahoo-mail-att. That is the AT&T edition of Yahoo Mail, which serves att.net, sbcglobal.net, bellsouth.net and other AT&T addresses. Taboola sells the native ads across Yahoo's sites under a 30-year agreement.

The first ad's tracking link listed a cost of 0.25 per click, with no currency.

What each network received

whack.sh opens one link from several networks at once and compares what each receives. We classified every exit address with WorldIP, which reports an address's owner, country and network type.

Ad	Network (WorldIP)	Device	Page served
First ad	Home broadband, Comcast, US	Windows desktop	Full-screen scam frame on one visit, plain article on the next
First ad	Home broadband, Charter, US	Windows desktop	Full-screen scam frame
First ad	Home broadband, Cox, US	Windows desktop	Full-screen scam frame
First ad	Mobile carrier, T-Mobile, US	Android phone	Dating article
Second ad	Data center, OVH, France	Windows desktop	Personal loan article
Second ad	Home broadband, Cox, US	Windows desktop	Scam alert page

whack.sh scan comparison of the second ad, October 8, 2026. The phone numbers are stamped FAKE.

The scam appeared only on visits that arrived through a fresh ad click. We opened the first ad's landing page directly eight times, with and without its tracking codes. Every visit returned the dating article.

The first ad's frame was intermittent. Our Comcast visits received the frame once and the plain article on the next try. No data center visit ran on the first ad's link.

First chain: an Azure frame over a dating article

The first ad led to checkouters[.]app, a dating article site registered on September 23, 2026. On Windows desktops on home broadband, the page covered itself with a full-screen frame served from Microsoft Azure Container Apps.

The frame displayed the fake alert and a toll-free number. The address bar kept showing the dating site.

The frame came from zingaaf23-4.salmonmushroom-f0512d66.westus2.azurecontainerapps[.]io and showed +1 888-883-5786.

Second chain: a Branch link and a filtering server (TDS)

The second ad passed through a Branch deep link, 325235dgsg.app[.]link, and then through maizerubyen[.]site. That server sent our data center visit to a personal finance article on another site.

Our visit from a home broadband address went to a page on Azure static website hosting, w08win10m844n2491c001.z13.web.core.windows[.]net. It showed the alert and the number +1 844-959-2491.

The scam page checked each visitor's location with two IP lookup services and loaded a Tawk.to live chat window. The chat account was created in June 2024.

The same chat account and lookup key appeared on another Azure page on September 24. A Taboola ad and a second Branch deep link, walletsaver.app[.]link, led to that page.

Dating the infrastructure with issued.live

issued.live tracks Certificate Transparency (CT) logs, domain registrations and DNS address history for more than 477 million domains. We used it to date the domains in both chains.

The filtering domain maizerubyen[.]site was registered on September 17, 2026. It went three weeks without a TLS certificate.

Its first certificate, valid from 12:44 UTC on October 8, reached the CT logs at 13:43 UTC. The ad click we analyzed came about two hours later, at 15:51 UTC. issued.live's reverse IP lookup found no other domain on the filtering server (TDS) at 64.177.41[.]125.

The second chain's scam page also loaded a tracking script from userstatics[.]com. That domain was registered in 2020. issued.live first recorded it on its current server, 94.154.32[.]91, on August 13, 2026.

Public certificate logs show certificates for the domain without a break since November 2020. issued.live's certificate history for its current server shows new certificates in July, August and September 2026. Neighboring addresses host sites whose names imitate Polish marketplace offers and Dutch delivery notices.

The domain dates to 2020, and different scam kits load it.

The scam kit runs on hundreds of cloud hostnames

The first operation's scam page comes from a kit, a set of files reused on every host. We found it in 747 public urlscan scans between July 12 and October 10, 2026, the furthest back our search reaches. About 600 of those scans captured the kit itself.

Kirk's review added 31 of those hostnames and three more Azure environments. The scans by month:

Period	Public scans
July 12 to 31	186
August	206
September	275
October 1 to 10	80

The pages sat on 536 different hostnames, most of them on Azure Container Apps across 13 Azure regions. By platform, 382 ran on Azure Container Apps, 106 on Azure Front Door, 34 on Laravel Forge, 9 on Cloudflare Workers, 4 on Cloudflare Pages and 1 on Vercel.

The pages listed 160 phone numbers, 126 of them US toll-free numbers. A Japanese-language version writes North American numbers in the format for dialing from Japan. A few numbers are in Hong Kong, Switzerland and Japan.

The kit's front page sends each visitor to a version for their operating system: Windows, macOS, Android or iOS. The Windows version, in English and Japanese, adds a fake locked screen with a Microsoft account sign-in box. Its fields are read-only, and the box points the visitor to the phone number.

These counts cover only pages that someone submitted to a public scanner. A few archived links carry tags that label the traffic as paid Facebook ads, and at least one carries a push-traffic click ID. These tags point to traffic sources beyond Taboola.

Detection trails the ads

On October 10, none of the 92 vendors on VirusTotal flagged checkouters[.]app. Two vendors rated the filtering domain suspicious, and none rated it malicious. Neither result had changed on October 11.

On the evening of October 11, Microsoft Edge showed a phishing warning for checkouters[.]app. When the warning first appeared, and what triggered it, is unknown.

Status on October 11

We re-checked the 536 hostnames at about 00:40 UTC on October 11 through webfetch.io. Nine still served the kit, and public scans had recorded eight of them in October.

Of the rest, 167 no longer resolved, 108 returned not-found errors and 228 did not answer within 60 seconds. Another 15 showed block or takedown pages from Cloudflare, Laravel Forge and Vercel. The remaining nine returned unrelated pages or errors.

In the same check, the first ad's landing page still loaded, and both Branch deep links still redirected. The second operation's filtering server (TDS) no longer answered. Its deep link sent our visits from data center and ISP addresses to the finance article, and its scam pages from October 8 and September 24 no longer resolved.

These checks ran before we filed the abuse reports listed in the tuxxin.com story.

Indicators

Domains and addresses are defanged. First seen is the earliest date in our scans, public scan archives or issued.live.

Type	Indicator	First seen
Ad landing page	`checkouters[.]app`	2026-10-07
Filtering server (TDS)	`maizerubyen[.]site`	2026-10-08
Filtering server (TDS) address	`64.177.41[.]125`	2026-10-08
Deep link	`325235dgsg.app[.]link`	2026-10-06
Deep link	`walletsaver.app[.]link`	2026-09-24
Scam page	`zingaaf23-4.salmonmushroom-f0512d66.westus2.azurecontainerapps[.]io`	2026-10-08
Scam page	`w08win10m844n2491c001.z13.web.core.windows[.]net`	2026-10-08
Tracker	`userstatics[.]com`	2020-11-05 (registered)
Tracker server	`94.154.32[.]91`	2026-08-13
Phone	+1 844-959-2491	2026-10-08
Phone	+1 888-883-5786	2026-10-08
Phone (seen by William Vincent)	+1 866-949-7055	2026-10-08

The full list of 536 scam kit hostnames, defanged, with the first and last date each was seen, is in yahoo-mail-scam-kit-hosts-2026-10-10.csv.

36988b0009b0a91a55de19380ea36eeac36f22c01d3d20d8708e35700dfefcb9  yahoo-mail-scam-kit-hosts-2026-10-10.csv

Tools used in this investigation

Step	Tool	What it showed
Compare what each network receives	whack.sh multi-source scan	The scam for Windows desktops on home broadband, an article for our data center and phone visits
Rebuild the redirect chain	whack.sh request log	Ad click, deep link, filtering server (TDS) and scam page, hop by hop
Classify each address	WorldIP	Network type, owner and country for each of our exits
Date domains and certificates	issued.live	Registration dates, first certificate times and address history
Map neighbors	issued.live	Domains sharing an address and certificate history per address
Count public sightings	urlscan	747 scans, 536 hostnames and 160 phone numbers
Find more hosts running the kit	Netlas and urlscan (partner review)	31 more hostnames and three more Azure environments
Check vendor detection	VirusTotal	0 of 92 vendors flagged the landing domain
Read older certificate history	crt.sh	Certificates for the tracker since November 2020
Re-check which hosts are still live	webfetch.io	9 of 536 hostnames still served the kit on October 11

Tuxxin LLC, which publishes this article, runs whack.sh, issued.live, WorldIP and webfetch.io.

For coordinated disclosure: contact@tuxxin.com.

Webfetch is live: ScrapingBee-compatible scraping at 38-40% less

Daniel J — Fri, 09 Oct 2026 13:50:02 +0000

Webfetch is a web scraping API: send a URL and get back rendered HTML, plain text, markdown, JSON extracted with CSS or XPath selectors, or a link to a screenshot. Request parameters, defaults, credit costs and status codes match ScrapingBee's HTML API, so an existing integration moves over by changing the base URL and the API key unless it uses AI extraction or screenshots.

A free account starts with 1,000 credits and gets 250 more on the 1st of every month, banking up to 1,000. Signup takes an email address and a six-digit code, with no card. Enter LAUNCH500 as the promo code when you create a free account to get 500 one-time bonus credits. The code works for the first 500 accounts that use it, until December 7, 2026. The credits are spent after the free balance runs out, and they never expire.

Make a request

curl "https://api.webfetch.io/v1/?url=https%3A%2F%2Fexample.com&render_js=false" \
  -H "Authorization: Bearer wfk_your_key"

The api_key query parameter also works, for code written against ScrapingBee. The cost, auto-mode cost, initial status code and resolved URL headers carry the same values under a new prefix, so Spb-cost becomes Wf-Cost.

Official SDKs for JavaScript (Node 18+), Python (3.9+) and PHP (8.1+) are published, with the source at github.com/tuxxin/webfetch-sdk:

npm install @tuxxin/webfetch
pip install webfetch-io
composer require tuxxin/webfetch

The home page runs a real scrape against any URL you enter, with no key, so you can check the output before signing up.

What a request costs

Request	Credits
No JavaScript rendering (`render_js=false`)	1
JavaScript rendering, the default	5
Premium proxy without rendering	10
Premium proxy with rendering	25
Stealth proxy	75
Failed request	0

A request is billed when the target answers with a 2xx, 404, 410 or 413 status, and every other outcome costs nothing. An anti-bot challenge, CAPTCHA or block page comes back as an error with the code challenge_page and costs nothing, including challenge pages served with HTTP 200. Every response carries a Wf-Cost header with the credits charged.

Premium proxy requests leave through static ISP addresses, where ScrapingBee's premium_proxy uses residential ones. Stealth requests always render, in a browser hardened against common headless-detection checks, and bill 75 credits on a mobile exit. At launch, no mobile or residential exit is available, so stealth requests leave through the ISP pool, bill 25 credits and return Wf-Proxy-Downgraded: true.

With mode=auto, Webfetch tries five configurations from cheapest to most expensive and stops at the first that works. The failed attempts are free, so a call costs only the configuration that succeeded, and max_cost sets a ceiling for it.

Plans

Plan	Price a month	Credits a month
Free	$0	1,000 to start, then 250
Starter	$11.99	75,000
Pro	$29.99	250,000
Scale	$59.99	1,000,000
Business	$149.99	3,000,000
Business+	$359.99	8,000,000
Custom	From $499	No datacenter credit cap, on dedicated hardware, quoted per requirement

Pro, Scale, Business and Business+ carry the credit allowances of ScrapingBee's Freelance, Startup, Business and Business+ plans at 38 to 40% below their prices. The comparison uses ScrapingBee's published prices on October 8, 2026. Paid plans bill monthly through PayPal and cancel at any time. The price you sign up at stays locked for as long as the payment method stays active and the subscription does not lapse. Upgrading from the key portal keeps the same key.

MCP server

Webfetch serves two tools over the Model Context Protocol at https://webfetch.io/mcp: fetch_page returns a page as markdown, text or HTML, and extract_data turns selectors into structured JSON. Send the API key as Authorization: Bearer, as on the HTTP API. Each result reports the credits it cost.

{
  "mcpServers": {
    "webfetch": {
      "url": "https://webfetch.io/mcp",
      "headers": { "Authorization": "Bearer wfk_your_key" }
    }
  }
}

Request limits

Webfetch honors robots.txt by default. Turning that off needs a key whose owner has accepted the acceptable use policy, and each such request is logged. Private, loopback, link-local and reserved addresses are refused, and the check repeats on every redirect.

Bandwidth is capped on the wire at 25 MB per request, and at 5 MB through the mobile and residential pools. A request that reaches the cap returns and bills the content fetched so far, marked with Wf-Truncated: true.

Free capacity is best effort: when paid traffic is heavy, a free request can get HTTP 503 with the code free_tier_busy and a Retry-After header, at no cost.

Not in this release

The AI extraction parameters (ai_query, ai_extract_rules, ai_selector), scraping_config and ScrapingBee's dedicated APIs for Google, Amazon, Walmart, YouTube and others are not implemented. A request that sends one of those parameters runs as an ordinary scrape at the usual credit cost and lists the parameter names in the Wf-Unknown-Parameters header. A screenshot comes back as a link in the Wf-Screenshot-Url header, where ScrapingBee returns the image itself.

Webfetch is run by Tuxxin LLC. The documentation covers every parameter, and the ScrapingBee migration guide compares the two services plan by plan.

WorldIP.io has 12 hidden easter eggs and one has been found

Daniel J — Fri, 02 Oct 2026 17:30:02 +0000

WorldIP.io has carried 12 hidden easter eggs for more than six months. In that time one has been found and reported. The other 11 are still unclaimed, and the image above shows one of them running.

The egg in the screenshot

The infrastructure page reports live numbers from the systems behind the site. A map draws the replication mesh: regional hubs on three continents form a continuously replicated backbone, and every point of presence connects through its nearest hub. Below the map, cards list the 12 locations in the fleet, a mix of reverse-DNS scanner nodes and ClickHouse database replicas. The counters refresh every 15 minutes.

With the egg active, green Matrix-style characters fall down both sides of the page and an Exit the Matrix button appears in the lower right corner.

The lower right corner of the infrastructure page with the egg running. Open the image for the full screenshot. How to trigger it is left out.

What WorldIP.io does

WorldIP.io looks up who owns an IP address: the organization, ASN, regional internet registry, CIDR block, reverse DNS and geolocation. It is free, covers all 4.3 billion IPv4 addresses and needs no account. The search box also takes a domain, CIDR range, ASN, organization, country or state.

The data comes from three layers. MaxMind GeoLite2 supplies the country, city and ASN blocks, and each new release is imported as soon as it is published. The delegation files of the five regional internet registries, checked every six hours, show which registry manages each block. Reverse DNS comes from WorldIP.io's own scanner fleet.

The scanner behind the reverse DNS

Scanner nodes in North America, Europe and Asia-Pacific each run a continuous PTR scan over their own slice of the allocated address space, and the results stream into a globally replicated ClickHouse cluster. Scanner v4, released in July 2026, completes a sweep of the routable IPv4 space in under 24 hours.

The scanner sends DNS PTR queries only. It opens no TCP connections, scans no ports and sends no HTTP requests to the addresses it resolves. Every scanner address has a forward-confirmed hostname under worldip.io, so a reverse lookup on a querying address identifies it:

dig -x <querying-IP>

Lookups from the command line

The keyless API answers a single curl call with no key or signup. The IP address is the path:

curl worldip.io/8.8.8.8

The reply is a JSON profile of the address:

{
    "ip": "8.8.8.8",
    "ptr": "dns.google",
    "asn": { "number": 15169, "name": "Google LLC" },
    "org": { "name": "Google, LLC" },
    "country": { "code": "US", "name": "United States" },
    "cidr": "8.8.8.0/24",
    ...
}

Run curl worldip.io with no address and it profiles your own IP. Keyless requests are rate-limited per IP, and the _meta block in each reply reports the limit and how much of it remains.

The REST API adds VPN and proxy classification, trust scores, IPv6 and live BGP routing events. API keys come with the subscription plans, and the public Pulse BGP feeds need no key.

Inside an AI assistant

WorldIP.io runs a Model Context Protocol server at https://worldip.io/mcp, so an assistant can look up an address in the middle of a conversation. It needs no key. To add it to Claude Code:

claude mcp add --transport http worldip https://worldip.io/mcp

The server exposes two read-only tools: lookup_ip for any public IPv4 or IPv6 address, and whats_my_ip for the caller's own address.

The rest of the site

The lookup is one part of WorldIP.io. The site also has a 3D globe of every IPv4 allocation, rankings of IPv4 holdings for all 250 countries, pages for the five regional internet registries, an IPv4 exhaustion counter with a per-registry breakdown, and a news section.

How to report a find

When you trigger an egg, take a screenshot, write down the steps that led to it, and send both through the WorldIP.io contact form.

We removed 289 false finds and 47,000 phantom miles

Daniel J — Fri, 02 Oct 2026 02:42:23 +0000

The site's "Miles Traveled" total went from about 91,000 to about 44,000.

What we cleaned up

Most false finds came from batches of tags scanned one after another during setup. The rest were our own test scans and visits from automated link checkers that opened shared tag links.
Each false find added a leg to its duck's journey. Some later scans had been measured from those false locations, so we re-measured them from the duck's previous real position.
The removed finds had earned no points. All of them were made while signed out, and signed-out scans earn none. We also rechecked one owner's mileage badge against the corrected miles.

What's new

Tap "I found it!" to log a find. Scanning a tag opens a page for that duck. Link previews and link checkers only load the page, so they log nothing. The scanner in the DuckyTrack app logs a find as soon as it reads the tag. In Cruise Mode, it saves finds on your phone until you tap "Go Online & Log My Finds".
Legs faster than 650 mph score zero miles. That is a little over airliner cruising speed. Each leg is timed from the duck's last sighting, or from its release for a first find. The find still counts.
Sharing your location pins only the find you just logged. The map button appears right after your find and works for 30 minutes.
Following a duck by email now takes a confirmation. We email you one link. Open it and tap "Yes, email me" to start updates. Your follow then counts on the Most Followed board. Every follower email now ends with an unsubscribe link, and existing email follows keep working.
The QR code on your tag's download page is now made by DuckyTrack, so your tag's private link stays on DuckyTrack.

Tips for duck owners

Share your duck's journey page and keep the tag link for finders. Anyone who has the link inside your QR or NFC tag can log a find with it.
To test a tag, scan it outside the DuckyTrack app and close the page without tapping the button.
Tap "I released this duck" on its journey page at the spot where you set it loose, and share your location. That pins where the journey starts. The first find's miles count from that pin, or from your last check-in if the duck has one. The first find by someone else sets the release date and hides the link.

Keeping the leaderboards fair

Every duck's journey page already shows the corrected finds and miles, and so do the leaderboards that rank them.

If a find on any duck looks wrong, tap "Report this duck" on its journey page and choose "Fake finds / cheating". Your report goes to our support team, and you can send one without an account.

Thanks for releasing, finding and following ducks with us. Every find you log puts the duck's newest stop on its map.

Nine files, two payloads: a Silver Fox sideloader in an open directory

Daniel J — Tue, 29 Sep 2026 15:11:06 +0000

An HTTP File Server (HFS) on 156.238.123[.]182, port 7294, was serving a complete Chinese-language DLL-sideloading kit with no authentication and directory listing enabled. The kit pairs a genuine Microsoft-signed program with a malicious DLL that starts a two-stage chain: a downloader, then an implant that imports keylogging and clipboard functions. The listing showed eleven files: the signed host program, the sideloaded loader, and nine payload files that reduce to two payloads.

By Daniel Jones, Founder, Tuxxin LLC.

MalwareHunterTeam (@malwrhunterteam on X) first flagged the open directory publicly on September 28, 2026. The analysis of the kit, its payloads and its infrastructure is Tuxxin's.

The malicious samples are on MalwareBazaar and VirusTotal, and the indicators are in an AlienVault OTX pulse.

The open directory

The directory is hxxp://156.238.123[.]182:7294/.

File	Size (bytes)	Contents
`1.1x1`	252,768	Signed Microsoft console program, the sideload host
`1.d00`	172,032	Unsigned DLL, the loader
`mqpbl.xm`, `nqxzer.xm`, `qlnxro.xm`, `xmlakt.xm`	344,064 each	Stage 1 downloader, four copies
`gdtqka.fyx`, `mqucpe.yjl`, `nlehkyc.yxr`, `qbupve.btk`, `xfzwinq.krx`	363,520 each	Stage 2 implant, five copies

The signed host program

1.1x1 is the Microsoft SPD Dump Utility, SPDDUMP.EXE, from Visual Studio 14.51.36244.0. Its signature validates and the file is unmodified. VirusTotal scores it 0 of 70. The operators ship it because it is clean and signed. Treat it as the host half of a sideload pair and keep it out of malicious-file lists.

SPDDUMP.EXE imports two functions from mspdb140.dll: PDBOpen2W and PDBClose.

1.d00 is an unsigned DLL compiled on September 23, 2026. Among a long list of decoy Cygwin exports, it exports those two names. Renamed to spddump.exe and mspdb140.dll and placed in the same folder, the pair makes a signed Microsoft program load the attacker's code.

The loader finds its payload by wildcard

1.d00 contains no URLs and imports no network functions. When it loads, it:

calls FreeConsole(), which hides the console window of SPDDUMP.EXE;
gets its own path with GetModuleFileNameA and trims it to the directory;
builds a wildcard from the string "*." plus an extension and searches its own folder with FindFirstFileA and FindNextFileA;
opens the match with mode "rb", reads it into memory from VirtualAlloc, and runs it through QueueUserAPC.

The loader runs any file in its folder with the matching extension, so the operator can rename the payload for every victim.

Nine files, two payloads

Within each size group, XOR-ing any two files against each other returns zero for the first several hundred kilobytes. A full byte comparison shows that the copies differ by three or four bytes:

mqucpe.yjl vs gdtqka.fyx   ndiff=3    @0x54280  b3 cb 47  ->  33 ca 4d
qbupve.btk vs gdtqka.fyx   ndiff=3    @0x54280  b3 cb 47  ->  5f e5 51

In the stage 2 group, the changed bytes sit in .data padding directly after a hardcoded command-and-control (C2) IP address string. They leave execution unchanged and give each copy a different SHA-256, a technique called hash-busting.

In the stage 1 group, the changed bytes are ASCII text. Each copy carries the filename of the stage 2 file it downloads:

Stage 1 file	Stage 2 file it fetches
`mqpbl.xm`	`mqucpe.yjl`
`nqxzer.xm`	`nlehkyc.yxr`
`qlnxro.xm`	`qbupve.btk`
`xmlakt.xm`	`xfzwinq.krx`

A shared 2 KB loader stub

Both payload types start with position-independent code. The first bytes, 40 55 53 56 57 41 54 41 55 41 56 41 57, are the prologue push rbp, push rbx, push rsi, push rdi, push r12 and onward.

At offset 0x800, 2,048 bytes in, each file holds a complete PE32+ image. Carving at that offset produces valid, analyzable executables. The 2,048-byte stub in front is byte-identical in stage 1 and stage 2:

5f7c25d4f1e5ce47674986d1f39fff1200a395646ccc516dbbdff55e39af7702

VirusTotal and MalwareBazaar had no record of the stub hash at the time of writing.

Stage 1: downloader and decoy

The carved stage 1 executable was compiled on July 11, 2026, and imports WinHTTP. It contains:

hxxp://156.238.123[.]182:7294/, the open directory it came from;
the filename of its paired stage 2 file;
https://www.baidu.com, used as a connectivity check;
process enumeration through CreateToolhelp32Snapshot;
a MessageBoxW call and this string:

您的电脑不支持此版本，请到官网下载最新版以继续安装。

In English: "Your computer does not support this version. Please go to the official website to download the latest version to continue installation."

The victim sees this installer error in Chinese while stage 1 fetches stage 2 in the background.

Stage 2: the implant

The carved stage 2 executable was compiled on August 12, 2026. Its import table shows almost no networking, because the names ws2_32.dll and winmm.dll are XOR-obfuscated inline and resolved at runtime. Its imports include these functions, grouped by capability:

Capability	Imports
Keylogging	`GetAsyncKeyState`, `GetKeyboardState`, `MapVirtualKeyA`, `ToAscii`, `GetForegroundWindow`, `GetWindowTextW`
Clipboard theft	`OpenClipboard`, `IsClipboardFormatAvailable`, `GetClipboardData`
Persistence	`RegCreateKeyExW`, `RegSetValueExW`, `RegisterApplicationRestart`
Injection	`VirtualAlloc`, `VirtualProtect`, `GetThreadContext`, `SetThreadContext`, `CreateProcessW`
Integrity-level check	`OpenProcessToken`, `GetTokenInformation`, `GetSidSubAuthority`

Host artifacts to hunt for:

a mutex matching Local\Mutex_%08X;
a relaunch command line of the form "<path>" --restart-after-pid <pid>.

The C2 address is a plain string in .data: 137.220.156[.]70 in four of the five copies and 137.220.156[.]69 in the fifth. The implant writes the port into a global variable at runtime, so the files alone do not reveal it.

Attribution

This report makes no independent attribution. VirusTotal labels a 41 MB archive on the same staging host, a fake LetsVPN installer package, as trojan.silverfox/wylw.

Silver Fox (银狐) is a documented cluster that targets Chinese-speaking users with trojanized installers of popular software. The kit matches that pattern: a Chinese-language decoy, a Baidu connectivity check and a VPN lure.

LetsVPN lookalike domains

LetsVPN is a legitimate product and the impersonated brand in this operation. The service is blocked in mainland China, so its operators run a large, rotating set of mirror domains with numbered names in the pattern a1-letsvpn, a2-letsvpn.

We enumerated 576 LetsVPN lookalike domains and checked each one against the attacker's hosting ranges. None resolved into attacker infrastructure. They are excluded from the indicators below, because listing them would flag a large number of innocent domains. Resolve lookalike domains against known attacker infrastructure before adding them to a blocklist.

A sibling staging host, April to August 2026

Public URL-scan history returns 44 scans of a second HFS server that served the filename 1.d00:

Path on `hxxp://154.198.50[.]76:8080/`	Relation to this kit
`1.1x1`, `1.d00`	Same sideload filenames
`dlters.xm`	Same `.xm` stage 1 extension
`dusbng.res`	No counterpart on the current host
`/upload`	HFS upload endpoint

Both servers use the HFS page title HFS - 文件列表 ("HFS - file list"). The older host was active from April 2026 to at least August 12, 2026, on a different provider and a different continent. It pivots to the same malware cluster, including KunBang.dll, QQHong_* and Update.dll, reaching the same C2 at 137.220.156[.]69. The two staging hosts belong to one operation.

Detection

The 2,048-byte loader stub is the strongest single signal. It is shared across stages and unaffected by the hash-busting.
Alert on the pair: a signed SPDDUMP.EXE next to an unsigned mspdb140.dll outside a Visual Studio install directory.
QueueUserAPC running memory that was read from a wildcard match in the process's own directory is a narrow behavioral signature.
Payload filenames and payload hashes change per copy by design. Detections built on either alone will miss the next copy.

Indicators of compromise

Indicator	Role	Hosting
`156.238.123[.]182:7294`	HFS staging host and open directory	AS54801 Zillion Network (PH)
`154.198.50[.]76:8080`	Sibling staging host, April to August 2026	AS138995 Antbox Networks (SC)
`137.220.156[.]69`	Stage 2 C2	AS4907 BGPNET (JP)
`137.220.156[.]70`	Stage 2 C2	AS4907 BGPNET (JP)

SHA-256, malicious:

401c5e167f6f17b2b8362c2056f22d8843d1fa52195e89ba4e88d9346d179496  1.d00 (malicious mspdb140.dll)
5f7c25d4f1e5ce47674986d1f39fff1200a395646ccc516dbbdff55e39af7702  shared 2,048-byte loader stub
64ae3a7092ddbd80289a4a0cc1f846f8ef7353d062983d6dd33cef9fbe22f5e6  mqpbl.xm     stage 1
288333007ef4dc1d037a9fd4a738de6880f913685d249665c73ee67091a0a092  nqxzer.xm    stage 1
46de9a3cc65df078d8fa20f0c7bd098e136c030df1053df530a8aca739145301  qlnxro.xm    stage 1
740b1aeab51e61de17f6bc82e02f9335b02bb24133fb73bd96a6870006d4ee1c  xmlakt.xm    stage 1
3f1af26ff035374ae1c4d44a4a581444aa9f92d4baf2f03c3db2221129537473  stage 1, carved PE
7218bc172e68a3c651ba68c7ea4d28e28fc282f871c557b7fbc88624b6621789  gdtqka.fyx   stage 2
7584e6296a476069a2e7b3f41a08903a4a3b2754f10e607317678056744cc4fe  mqucpe.yjl   stage 2
461793559fa43ebc74cb885558ded8a79c32255b3d8cd7b6341478e7dc806168  nlehkyc.yxr  stage 2
bbd64f281d249bfe328b072c0db87b6226c7f4208a8b36edec78bed7b611a24a  qbupve.btk   stage 2
4ea8b2a2438b9d1fd76e110b944ba9156459e4ff0a81aff8aa668d0a4e731f5f  xfzwinq.krx  stage 2
bd520a958988f14e471b09b8c6e8f201ba045bdff647d9110a9aa09b7286e8b2  stage 2, carved PE
c2f0a3e9913a8a36befaa07e67a16df6ce966f10662e6663493f8603673fc76a  fake LetsVPN .zip delivery package

SHA-256, clean. Do not block:

9a09faa9fa833f1810094c1a71e43217ff82e4861e3c63cea7670434b8d8229d  1.1x1 = Microsoft SPDDUMP.EXE (0/70)

Disclosure

On September 29, 2026, Tuxxin LLC contributed the samples to MalwareBazaar and VirusTotal and published the indicators to AlienVault OTX. The legitimate Microsoft binary was excluded from all submissions.

For coordinated disclosure: contact@tuxxin.com.

Pattern search on issued.live finds domains by the shape of their names

Daniel J — Sat, 26 Sep 2026 02:05:02 +0000

issued.live pattern search matches a naming hypothesis against every registrable domain in its corpus, which held more than 454 million domains on September 25, 2026. Written as [a-z]{4,10}agent.com, the hypothesis "a short word followed by agent, in .com" returns the names that fit, each with its nameservers and certificate ID. The endpoint is GET https://issued.live/api/v1/search?name={pattern}, and it comes with the Pro plan at $199 a month.

A naming hypothesis has no wordlist to enumerate, and the space of candidates is combinatorial. The match therefore runs next to the data.

The grammar is written forward, one label at a time

Write the pattern the way you say the name. Each label takes four kinds of token:

Syntax	Matches	Example
`*`	Zero or more of `a-z`, `0-9` and `-`	`*agent.com`
`?`	Exactly one of those characters	`loop?.com`
`[a-z]{4,10}`	A counted run from a character class	`[a-z]{4,10}agent.com`
literal	Itself	`loop-lumen.com`

Grouping, alternation and negation are unsupported. The response returns the compiled expression as regex, so you can see exactly what ran.

Every pattern names a TLD

A pattern must include a TLD label. *agent alone could mean a name or a suffix, and a guess would search the wrong one. *agent.* means every TLD.

Naming a specific TLD sets the cost of the query. issued.live stores names suffix-first, so a pattern that pins the TLD becomes a key range, and a pattern with a wildcard TLD reads the whole key space. The Pro API reference publishes these timings:

Pattern	Anchored on	Scan time
`loop-*.com`	`com.loop-`	0.03 s
`[a-z]{4,10}agent.com`	`com.`	0.7 s
`agent.`	Unanchored	1 to 3.5 s

A literal start to the name lengthens the key prefix: loop-*.com anchors on com.loop-, while the counted class at the front of [a-z]{4,10}agent.com leaves only com.. The response reports anchored and key_prefix, so you can see which case you landed in.

Bounds on a pattern and a page

A character class needs a closed count with an upper bound of 64 or less. [a-z]+ and [a-z]{4,} are refused with 400 bad_request. The cap stops a pattern from silently becoming a full scan.

Parameter	Default	Notes
`name`	Required	Up to 128 characters and 8 labels. A missing or empty value is a 400.
`limit`	500	Up to 1,000 candidates examined per page.
`after`	None	Cursor. Omit it to start, then pass back `next_cursor`.
`ns`	None	Nameserver filter, by exact name or by parent domain.
`first_seen_from`	30 days back	Switches the search to window mode.
`first_seen_to`	Now	Always clamped to now.

Filtering hits by nameserver

ns= matches a nameserver by exact name or by parent domain, so ns.cloudflare.com matches teresa.ns.cloudflare.com and every other nameserver beneath it.

The filter applies after the page is drawn. scanned reports how many candidates the page examined and count how many it returned, and the two differ when ns= removed rows. Keep following next_cursor until it is absent. The cursor advances over candidates, so a page that returns nothing still moves the walk forward.

The reference's pivot workflow runs a search with a nameserver filter, reading the key from an environment variable:

import os, requests

H   = {"Authorization": f"Bearer {os.environ['ISSUED_LIVE_KEY']}"}
api = "https://issued.live/api/v1"
get = lambda path, **kw: requests.get(f"{api}{path}", headers=H, timeout=30, **kw).json()

s = get("/search", params={"name": "loop-*.com", "ns": "ns.cloudflare.com", "limit": 500})
print(s["count"], "names match the grammar on that nameserver")

The reference rates a shared nameserver as a moderate link: "Strong when the pair is account-specific, weak when it is a large provider's default." A shared nameserver pair, a same-day registration and a name that fits the grammar together make a far stronger signal than any one of them alone.

Window mode searches the registration feed by date

Sending first_seen_from or first_seen_to switches the search to window mode. The date leads the sort key there, so the query becomes an index range, measured at 0.094 s. Window mode answers questions such as which names matching this grammar appeared last week. To keep a grammar current, rerun it in window mode with first_seen_from set to the time of the previous run.

Without a window the search runs in corpus mode over every name issued.live holds, paged by key. The mode field says which one ran. Sending only first_seen_to sets the lower bound to 30 days back, and the reply echoes the window it applied. Both bounds take RFC 3339, YYYY-MM-DD HH:MM:SS, YYYY-MM-DD or a Unix timestamp, and a reversed window is a 400.

A window cursor carries a position in time and a corpus cursor carries none. A cursor from the wrong mode gets a 400, so a walk cannot silently restart.

What the answer looks like

An example response for [a-z]{4,10}agent.com at a limit of 100:

{
  "pattern":    "[a-z]{4,10}agent.com",
  "regex":      "^com\\.[a-z]{4,10}agent$",
  "mode":       "corpus",
  "anchored":   true,
  "key_prefix": "com.",
  "count":      100,
  "scanned":    100,
  "limit":      100,
  "truncated":  true,
  "next_cursor": "H2NvbS5hYmJpbnNhZ2VudA",
  "domains": [
    {
      "domain":          "abbinsagent.com",
      "tld":             "com",
      "first_zone_seen": "2026-09-05T22:00:00Z",
      "first_cert_seen": "2026-09-06T04:21:09Z",
      "cert_id":         "b800bf9f6375b6825ca2b92d97bbb06f",
      "ns": ["ns1.zoom.ph", "ns2.zoom.ph"]
    }
  ]
}

regex shows the pattern compiled against the suffix-first key, starting at com.. first_zone_seen records when issued.live first saw the name in a zone file, and cert_id is the key for the certificate endpoint, /api/v1/cert/{cert_id}.

Certificate detail is live for 48 hours. After that, Pro answers from the archive: a lookup with no parameter searches the most recent seven archived days, and ?day=YYYY-MM-DD or ?from=&to= reaches further back, as far as September 9, 2026. An archive lookup takes seconds, and at most two run at once across all callers.

A search takes one of two concurrency slots

Pattern search is an advanced query, and Pro runs two advanced queries at once per account. Reverse IP, range, batch lookup and the provisioning feed take the same slots. Certificate, key, domain, timeline and newly registered domains lookups take none. Pro's 1,200 requests a minute meter the public record API, and the slots bound the advanced queries.

When both slots are busy, a request waits up to five seconds for one, then returns 503 timeout. The status is expected on unanchored searches. Retry once, then narrow the pattern. Branch on the retryable field and the Retry-After header.

Plan and documentation

Pattern search comes with Pro. Plus, at $99 a month, runs one advanced query at a time and has no pattern search. The pricing page compares the plans, the Pro API reference documents each parameter, and the paid plans announcement of September 19, 2026, introduced Basic, Plus and Pro.

Parameters, caps and measurements come from the issued.live Pro API reference, and plan details from the pricing page, both as read on September 25, 2026. More about the author.

Invoice-named scripts drop a DLL-sideloading backdoor behind Pakistan Navy decoys

Daniel J — Fri, 25 Sep 2026 16:05:02 +0000

An open web directory named documents_more_authority_services holds nine small text files, Invoice1.txt to Invoice9.txt. Each file is a one-line Windows command script. When run, a script shows the victim a convincing PDF, installs a backdoor inside a legitimate Microsoft program, sets that program to restart every minute and hides the install folder.

The decoy PDFs show who the operation is aimed at: Pakistan Navy planning minutes, quotations from a Pakistan Navy supply contractor, a Punjab government directory and a personnel form from a state-owned mining corporation.

The command server was live at the time of writing, on September 25th, 2026.

We found the directory through MalwareHunterTeam, who first flagged it publicly (@malwrhunterteam on X). The analysis of the backdoor, its command server and its protocol is Tuxxin's.

The technical writeup is on whack.sh. It covers the infection chain, the backdoor's protocol and commands, and the full indicator list with hashes. whack.sh now detects this kind of malicious staging area.

The decoys and who they point at

Each script opens a different decoy. The filenames below are what a victim sees in their Temp folder.

Decoy filename	What it is
`AMAN 2027 Draft Program.pdf`	Minutes of the Initial Planning Meeting for Exercise AMAN 2027, on the letterhead of the Pakistan Navy's Directorate of Naval Operations, Naval Headquarters Islamabad, dated September 9th, 2026. AMAN is the Navy's multinational exercise. The document lists the Navy participants and the foreign defense attaches who attended.
`Quotation 2231 DT 15 SEP 26-REV (NRDI).pdf`	Revised quotation from Maritime Technical & Support Services (Pvt) Ltd (MTSS), a Pakistan Navy contractor with offices in Islamabad and Karachi. It covers variable-frequency drives for shipboard pumps, references NRDI and is dated September 15th, 2026.
`Quotation 2510 DT 15 SEP 26.pdf`	MTSS quotation for a naval supply item, UHF wireless microphone sets.
`0231-26 (DT 08-07-2026).pdf`	Supplier quotation addressed to MTSS, Karachi, for a NATO-stock-numbered engine part, a fuel-injector supply tube.
`CCC-Helplines-Detail.pdf`	A 26-page directory of Government of Punjab department helplines.
`InformationForm.pdf`	A Pakistan Mineral Development Corporation (PMDC) personal-information form.
`CandidateInformationForm.pdf`	A generic job-application form.
`PDA GRC Concept Note - Final.pdf` and `PDA-Domains.pdf`	Named in the scripts. The server returned a corrupted file for both.

This report omits the names of individuals who appear in the decoys.

The AMAN 2027 minutes

The AMAN 2027 minutes are an internal Navy record. They are dated September 9th, 2026, and they reached the attackers within two weeks of being written.

That suggests the operators already have access to someone on the document's distribution, or to a mailbox that received it.

How a victim gets infected

The directory sits on corecloudwave[.]online and is served over WebDAV on port 7843. WebDAV lets Windows treat a remote web directory as a network folder. Each script ends by disconnecting from that share, which confirms that victims run the scripts from it.

We did not recover the email or shortcut that first points a victim at the share. The directory listing shows a file was removed on September 24th.

When run, a script does six things:

Downloads the decoy PDF from a second port, 7925, and opens it, so the victim sees a document.
Creates the folder C:\Users\Public\Documents\EdgeUpdate\.
Downloads dcntel.dll and a small file named edgeupdate.dat.
Copies the genuine, Microsoft-signed C:\Windows\System32\DeviceCensus.exe into the same folder.
Registers a scheduled task named EdgeUpdate that runs that copy every minute.
Marks the folder hidden and system.

The technique is DLL sideloading. When the trusted Microsoft program starts, it loads dcntel.dll from its own folder before it looks in System32, so it loads the attacker's copy.

The malicious DLL passes six of its seven functions straight through to the real Windows DLL, so nothing visibly breaks. The seventh, GetCensusRegistryLocation, holds the backdoor.

What the backdoor does

dcntel.dll is a 291 KB 64-bit Windows DLL, compiled September 16th, 2026, and unsigned. On the day it was found, 6 of 75 antivirus engines on VirusTotal flagged it, all with generic machine-learning labels and no family name.

Its server address is stored separately, in edgeupdate.dat, as plain hexadecimal. It decodes to viewpipesync[.]online on port 9090.

The implant builds a victim ID from the computer name, user name and process ID, finds its own internal IP address, and then polls its server every 10 seconds. It ignores certificate errors. Whatever the server returns is the next command, and the results go back to the same address.

The backdoor is a compact remote shell. Its commands start and stop an interactive cmd.exe session, change how often it polls and replies, change its lifetime counter, report its settings and exit.

File theft, keylogging and any other task outside the command set require the operator to work by hand in the shell.

Infrastructure

We found two domains behind the operation, both registered through Namecheap and both hosted with UltaHost in Germany.

Detail	`corecloudwave[.]online`	`viewpipesync[.]online`
Role	WebDAV stager (port 7843) and payload server (port 7925)	Command server (port 9090)
IP address	`84.200.192[.]6`	`84.200.193[.]224`, earlier `64.111.93[.]196`
Registered	September 19th, 2026, 04:02 UTC	September 19th, 2026, 03:57 UTC
TLS certificates	Let's Encrypt, September 20th	Let's Encrypt, September 19th and 22nd

The two domains were registered five minutes apart, and each sits alone on its own server.

We found no related infrastructure. The operation appears to be a single, purpose-built setup.

Attribution

This report leaves attribution open.

Two things fit patterns seen in regional espionage in South Asia: the targeting of the Pakistan Navy, its supply chain and Pakistani government bodies; and the lightweight, disposable infrastructure.

We found no code overlap with a known malware family, and targeting alone is insufficient to identify an actor.

Signs of infection

On a Windows machine:

The folder C:\Users\Public\Documents\EdgeUpdate\, marked hidden and system.
A scheduled task named EdgeUpdate that repeats every minute.
DeviceCensus.exe running from any folder outside C:\Windows\System32.

On the network: HTTPS to port 9090 with a URL path starting with /nsearch:, or any request carrying the header X-Proxy-Server: direct.

Domains and IP addresses:

corecloudwave[.]online
viewpipesync[.]online
84.200.192[.]6
84.200.193[.]224
64.111.93[.]196

The full indicator list, with SHA-256 hashes for dcntel.dll, edgeupdate.dat and all nine scripts, is in the whack.sh technical writeup.

Disclosure

On September 25th, 2026, Tuxxin LLC:

notified the hosting provider (UltaHost) and the registrar (Namecheap) of both domains,
shared indicators with Pakistan's national CERT (PKCERT), and
submitted the stager scripts to VirusTotal.

All malicious domains and IP addresses in this report are defanged.

This report is the original work of Tuxxin LLC, published under Creative Commons Attribution-NoDerivatives 4.0. Media and researchers may quote and republish it with attribution to Daniel Jones, Tuxxin LLC. For coordinated disclosure: contact@tuxxin.com.

DeviceCensus.exe DLL sideloading: a dcntel.dll backdoor staged from a WebDAV directory

Daniel J — Fri, 25 Sep 2026 15:50:05 +0000

An open WebDAV directory on corecloudwave[.]online holds nine one-line Windows command scripts that open a decoy PDF, copy the Microsoft-signed DeviceCensus.exe out of System32 and use it to sideload dcntel.dll, a compact remote shell. The implant reads its server address from a hex-encoded config file and polls the command-and-control server viewpipesync[.]online on port 9090. The server was live at the time of writing on September 25, 2026.

By Daniel Jones, Founder, Tuxxin LLC.

The decoy documents and the targeting, which covers the Pakistan Navy, its suppliers and Pakistani government bodies, are written up in the investigation on tuxxin.com.

MalwareHunterTeam (@malwrhunterteam on X) first flagged the open directory publicly. The analysis of the backdoor, its command server and its protocol is Tuxxin's.

The staging directory

The directory is hxxp://corecloudwave[.]online:7843/documents_more_authority_services/. It is served over WebDAV on port 7843, which lets Windows treat it as a network folder.

The nine scripts are text files named Invoice1.txt to Invoice9.txt.

Each script ends by disconnecting from the WebDAV share, which confirms that victims run it from the share. The email or shortcut that points a victim at the share is still unrecovered.

The same host runs a payload server on port 7925, at hxxps://corecloudwave[.]online:7925/api/portal/resources/viewer/<file>?id=730246.

The directory listing shows a file was removed on September 24.

Each stager opens a different decoy PDF. These are the file names a victim sees in their Temp folder:

AMAN 2027 Draft Program.pdf
Quotation 2231 DT 15 SEP 26-REV (NRDI).pdf
Quotation 2510 DT 15 SEP 26.pdf
0231-26 (DT 08-07-2026).pdf
CCC-Helplines-Detail.pdf
InformationForm.pdf
CandidateInformationForm.pdf

The scripts also name PDA GRC Concept Note - Final.pdf and PDA-Domains.pdf. The server returned a corrupted file for both.

What each stager does

Downloads the decoy PDF from the payload server on port 7925 and opens it, so the victim sees a document.
Creates C:\Users\Public\Documents\EdgeUpdate\.
Downloads dcntel.dll and a small file, edgeupdate.dat.
Copies the genuine, Microsoft-signed C:\Windows\System32\DeviceCensus.exe into the same folder.
Registers a scheduled task named EdgeUpdate that runs that copy every minute.
Marks the folder hidden and system.

Sideloading through DeviceCensus.exe

When the copied DeviceCensus.exe starts, it loads dcntel.dll from its own folder before looking in System32, so it loads the attacker's copy.

The malicious dcntel.dll exports seven functions. Six pass straight through to the real Windows DLL, so the host program runs without visible errors. The seventh, GetCensusRegistryLocation, holds the backdoor.

The implant

dcntel.dll is a 291 KB x64 Windows DLL, compiled on September 16, 2026, and unsigned. Its import hash is af2996d19264a47ecbf8fc76c8a4530a.

On the day it was found, 6 of 75 antivirus engines on VirusTotal flagged it, all with generic machine-learning labels and no family name.

The server address sits outside the DLL, in edgeupdate.dat, as plain hexadecimal that decodes to viewpipesync[.]online:9090.

Beaconing

The implant builds a victim ID from the computer name, user name and process ID, and looks up its own internal IP address. It then polls the server every 10 seconds:

GET hxxps://viewpipesync[.]online:9090/nsearch:<COMPUTERNAME>_<username>-<PID>:10
X-Real-IP: <victim's internal IP>
X-Proxy-Server: direct
User-Agent: Mozilla/5.0

The implant ignores certificate errors. Whatever the server returns is the next command.

Results go back as a POST to the same address, wrapped between CMD.USERBEG_#CMD#_ and .USEREND_#CMD#_CMD.

Commands

Command	Effect
`OPEN-SHELL` / `CLOSE-SHELL`	Start or stop an interactive `cmd.exe` session
`sleep`, `jitter`	Change the beacon timing
`SET-IN-LATENCY`, `SET-OUT-LATENCY`	Change the poll and reply intervals
`SET-LIFE`	Change the implant's lifetime counter
`GET-CONFIG`	Report settings (default `Life=2 InLatency=10s OutLatency=200ms`)
`QUIT`	Exit

File theft, keylogging and any other task outside the command set require the operator to work by hand in the shell.

Infrastructure

	corecloudwave[.]online	viewpipesync[.]online
Role	WebDAV stager (7843) and payload server (7925)	Command-and-control (9090)
IP	84.200.192[.]6	84.200.193[.]224 (earlier: 64.111.93[.]196)
Host	UltaHost, Germany	UltaHost, Germany
Registered	2026-09-19 04:02 UTC, Namecheap	2026-09-19 03:57 UTC, Namecheap
TLS	Let's Encrypt, September 20	Let's Encrypt, September 19 and 22

The two domains were registered five minutes apart. Each sits alone on its own server.

We found no related infrastructure. The operation appears to be a single, purpose-built setup.

Attribution

This report names no group. The targeting (the Pakistan Navy and its supply chain, plus Pakistani government bodies) and the lightweight, disposable infrastructure fit patterns seen in regional espionage in South Asia.

We found no code overlap with a known malware family, and the targeting alone does not identify an actor.

Disclosure

On September 25, 2026, Tuxxin LLC:

notified the hosting provider (UltaHost) and the registrar (Namecheap) of both domains,
shared indicators with Pakistan's national CERT (PKCERT), and
submitted the stager scripts to VirusTotal.

Indicators of compromise

Domains: corecloudwave[.]online, viewpipesync[.]online

IPs: 84.200.192[.]6, 84.200.193[.]224, 64.111.93[.]196

URLs:

hxxp://corecloudwave[.]online:7843/documents_more_authority_services/
hxxps://corecloudwave[.]online:7925/api/portal/resources/viewer/<file>?id=730246

SHA-256:

beb166c564b5bebd6cc43f5cff94d8e50efba777012e5525b41873bb5fa5e10f  dcntel.dll
56eb4c4bcb0c0a208bddb0068c23e46ecf23f7c7feebc8422f3255e1f61ad9ae  edgeupdate.dat
4e40cc31d40e2167da3ebfe96968102da9603c11a382ddf9804e68886cbe1639  Invoice1.txt
0371bdd48791c74dfdac1caaaf3950dd5c3647b63aabc10decccac62277ccda5  Invoice2.txt
e66b610918ebf0fcc38ac21236b0b4e59c045100b57e585128bfaa16c1ab2b5b  Invoice3.txt
842dae97804ecce4ac24a1856c4697d0988fb16d998f7cb56966ada5ad28a2c9  Invoice4.txt
347bb04747d1251c27d4d7cc22fc13a49ab195fd4b96645a65483ab723d73860  Invoice5.txt
029a01524a8c77bae57591da662b1c2ea8020da4494509e6242004d6fbe06bf9  Invoice6.txt
96012c510e6ce30de223a2b21e4e9a6e9ec158a5b92b0af0f5992672c03233e5  Invoice7.txt
96e31d090c28ef043fc568696202bdaf8e966fb24183f69b389342b9fa914f47  Invoice8.txt
5f894557672dc4c30a2d4317108deff54bb9d6a23fe9ee2abc0ec7e094b41690  Invoice9.txt

Import hash of dcntel.dll: af2996d19264a47ecbf8fc76c8a4530a

On the endpoint:

Folder C:\Users\Public\Documents\EdgeUpdate\
Scheduled task EdgeUpdate with a 1-minute repeat
DeviceCensus.exe running from any path outside C:\Windows\System32

On the network: HTTPS to port 9090 with a URL path starting with /nsearch:, or any request carrying X-Proxy-Server: direct.

Detection

whack.sh now detects this kind of malicious staging area.

For coordinated disclosure: contact@tuxxin.com.

Referer-gated cloaking: why our scanner arrives with a source

Daniel J — Tue, 22 Sep 2026 13:25:04 +0000

A page can serve one thing to a visitor who arrived from an ad and something else to a visitor who arrived from nowhere. Traffic source picks the branch.

A scanner that opens the link cold states no source. It lands in the branch built for everyone the campaign did not pay for.

Cloaked delivery itself is settled ground, and our writeup on a cloaked link that showed scanners a clean page covers the foundation. That post listed a referer gate among the limits of comparing vantage points.

Our scanner can request a URL with a specified referring source and carry it through the redirect chain.

Why a cold scan lands on the clean page

A browser normally tells a site which page sent the visitor. The Referer field is an ordinary part of a web request. Whatever client makes the request supplies the value itself, and nothing authenticates it.

A source-gated page reads that self-reported value and branches on it. A visitor whose stated source matches the campaign reaches the payload. Everyone else reaches a clean page.

No page sent the automated request, so the field arrives empty. To the page's rule, an empty source is the wrong source, so the clean page is the correct output of the operator's own logic.

The verdict is accurate about that one fetch. It says nothing about what the URL serves the intended audience.

The gate works by requirement instead of detection

Fingerprinting a scanner is work. The operator has to model automation tells, and that model needs maintenance as clients change.

A source gate skips all of it. The operator requires something a checker has no reason to send, and every client that fails to send it sorts itself into the harmless branch.

The page never has to recognize a scanner to defeat one. A better client profile or a cleaner egress changes nothing about the value the page is keyed on.

Cold checkers agree with each other by design

Most public checkers fetch cold, and a cold fetch states no source. Pointed at a source-gated page, they receive the clean branch.

Their results then agree. Agreement across tools reads like confirmation while it repeats one observation several times.

That shared habit correlates the answers, so agreement can grow while the evidence behind it does not.

Source gating is delivery discipline

Campaigns buy specific traffic. An operator who pays for clicks from one channel wants the payload spent on that channel's visitors, and serving anyone else is cost with no return.

Every copy handed out is also a copy that can be collected, submitted and written into a signature. The clean branch costs nothing to give away, so the operator hands it to everyone outside the audience it paid for.

The rule lives in the campaign rather than in any one host, so replacing a domain does not require rewriting it.

Reading these gates as budget control explains behavior that looks strange otherwise. A page can ignore your client fingerprint and still serve you nothing, because it is checking where you say you came from.

What survives the redirect chain

A link rarely answers on the first hop. Clicks pass through tracking links, shorteners and intermediate pages before the destination replies.

What the destination sees depends on what survived those hops. A stated source can be carried forward, rewritten or dropped along the way, and the hop that decides what to serve is the last one.

Two checkers can disagree about the same link without either one malfunctioning. One held the context across the chain and the other lost it, so they asked the destination different questions.

Our scanner can specify a source and hold it through those hops. Where that source is the one the gate is keyed on, the destination answers the way it answers the intended visitor.

An analyst sets the source inside the engine, and choosing which source to try is a judgment call.

The verdict comes from the captured artifact

We fetch the URL from datacenter, residential and mobile networks and keep the real response body. Classification reads what that artifact is and what it does.

Counting how many engines have voted on a domain answers a different question. One domain that reputation engines rated clean served a large obfuscated payload when we fetched it, and the capture is what showed it.

Keeping the body is what makes comparison possible. The same URL fetched two ways produces two artifacts, and the pair is the finding.

Client-type cloaking inverts the usual assumption

Client-type cloaking is an evasion class we see and track, and reading it out of a capture is analyst work today.

The familiar cloak feeds real browsers the payload and automated clients a harmless page. Some hosts run it the other way around.

The file goes to an automated application client. An ordinary web browser receives a firewall block page, and a browser-based check reads that block as a dead end.

The block page is part of the delivery. It answers the observer most likely to be a checker, and it answers with something that reads as safety.

Where source control stops

Source control does not tell you which source to try. A gate keyed to a value nobody guessed returns the clean page, and the space of plausible sources is large.

Any client can state any source, which is what makes the gate cheap to build and cheap to stack. An operator who adds a second condition on top of the source check reopens the gap. The gain is that conditional delivery costs the operator more to hide.

Gates a fetch cannot open

Some branches demand what no fetch can produce:

A valid session established by a real login.
A one-time click token that has already been spent.
An authenticated context tied to a specific account.

Source control does not touch that class. A payload served once per address also defeats the confirming second look, which our earlier post covers alongside the limits around session cookies and the time of day.

Divergence starts a human read

Branching on traffic source is common outside abuse. Hotlink protection, anti-scraping rules, paywalls and partner licensing all decide on the same signal, so a split tells you the page branches and stays quiet about why.

That limit was published with the first post on this subject and it holds unchanged on the source axis. A clean result tells you which sources we tried and when. The sources we did not try stay open.

One line of that published list changes. A checker can now arrive with a source stated, and the rest of the list stands as written.

Checking a link against a source gate

Against a source-gated page, a single cold fetch returns the branch the operator built for checkers. Two fetches of one URL that differ only in the source stated is the cheapest test that gate fails.

A link that answers those two fetches two different ways has told you something a verdict cannot. A multi-egress scan at whack.sh records each fetch and the body it returned.

Mapping a whole domain fleet from one reverse IP lookup

Daniel J — Mon, 21 Sep 2026 13:00:02 +0000

One reverse IP lookup on issued.live returned 532 hostnames, effectively all first observed inside the same four-day window. The endpoint answers what else lives at an address: every hostname the resolvers have recorded answering there, each with the date that pairing was first observed. One address goes in, and a list with structure in it comes back.

Addresses and hostnames below are placeholders. The calls are real, and they run against the Pro API reference.

The inverse lookup is one request

Passive DNS tooling answers what a domain resolves to. The inverse question turns a single observation into a set, which is what moves a thread forward.

curl -sS "https://issued.live/api/v1/ip/198.51.100.24?limit=500" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

The key travels in the header. There is no ?key= parameter, because query strings land in access logs, proxy logs and Referer headers. A key in the URL therefore leaves the request unauthenticated and answers 401.

Each row in hosts[] carries hostname, domain for the registrable domain, ip, first_seen, last_seen and observed. The envelope carries query, addresses, count, truncated, limit, order, and next_cursor when another page exists.

Read truncated first. A limit returns up to that many rows and promises nothing about completeness. A true there means the picture in front of you is partial.

Enumerating an address completely is a cursor walk

limit defaults to 500 and tops out at 50000. Out-of-range values are clamped rather than refused, so a request for a million quietly returns 50000. Busy hosting addresses hold far more names than that.

Past the cap, the cursor is the only correct route. Send ?after= with an empty value to begin, then pass back each response's next_cursor until one arrives without it.

curl -sS "https://issued.live/api/v1/ip/198.51.100.24?after=&limit=50000" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY" > page1.ndjson

The ordering changes when the cursor appears. Without after the page sorts by last_seen descending and cannot be resumed, since a re-observed name moves between pages. With after present the sort is the table's primary key, which never changes for a given observation.

Four parameter names people reach for answer 400: page, offset, skip and cursor. All four were once accepted and ignored, which returned page one with a 200 however many times you asked for page four. Code written against that behavior read the same page in a loop.

At a limit of 5000 or above the answer streams as newline-delimited JSON, one object per line. Records always carry hostname and the trailer carries end, so the two are unambiguous. A stream that dies mid-flight has no trailer and no cursor, and that absence is the error signal.

first_seen dates the association between a name and an address

first_seen is the earliest time the resolvers saw that hostname answer with that address. It records when the name arrived at its current host. When the name was created is a separate fact, and RDAP is where that one lives.

Take a domain registered years ago whose first_seen at its current address is three weeks old. That is an aged name that moved recently. It behaves like a new one while carrying the reputation of an old one.

The gap between the two dates is a reading, and it stays a reading. Treat a change of hands as an interpretation, and never assert who holds a name.

The same field takes a server-side window, on either bound alone:

curl -sS "https://issued.live/api/v1/ip/198.51.100.24?first_seen_from=2026-09-01&first_seen_to=2026-09-05&limit=5000" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

RFC3339, YYYY-MM-DD HH:MM:SS, YYYY-MM-DD and unix seconds all parse, and a missing zone means UTC. A malformed or reversed window answers 400.

Copy the published reasoning into your own API: "A limit is a preference, so we clamp it and answer the question you meant. A timestamp asserts which rows you want, and substituting a different window is how you end up with a gap you cannot see."

These observations begin in August 2026. A window earlier than that comes back empty because nobody was looking yet. Check the window before concluding an address sat unused.

The hostname list has a grammar

Co-location on shared hosting proves little by itself. The timing carried the weight in that case: names that arrive together were deployed together.

The shape of the names is the second measurement. Three greps classified most of that list in a few seconds.

jq -r 'select(.hostname) | .hostname' page1.ndjson | sort -u > names.txt

grep -cE '(clk|clks|trk|trks|track)' names.txt
grep -cE '[a-z]+[0-9]{2,}\.' names.txt
grep -cE '(scrty|sec-|-secure|verify)' names.txt

Of the 532, the click and redirect abbreviations came to 163, the leetspeak variants to 15 and the security-themed lures to 37. A fourth pass over insurance and quote wording caught 27 more. One query enumerated a disposable redirect fleet, and a grep fingerprinted how it names itself.

A grammar returns a candidate set rather than a finding. Cheap names bought in bulk look alike because one script generated them, and unrelated operators land on the same conventions.

What lifts a candidate above coincidence is a second independent link. Co-tenancy on one certificate, a shared public key, an account-specific nameserver pair or a registration inside the same hour each qualify.

Pattern search reaches the members on other hosts

An address holds the members parked there on the day you looked. The rest of the family sits elsewhere, and the grammar is what reaches them.

Pattern search matches a naming hypothesis against the corpus, next to the data. That is the only place it can run, because there is no wordlist and the space is combinatorial.

curl -sS -g \
  "https://issued.live/api/v1/search?name=[a-z]{3,8}clk.com&ns=ns.example-dns.net&limit=500" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

The -g earns its place. Braces and brackets are curl's own globbing syntax, so without --globoff the pattern never reaches the API intact.

Patterns are written forwards, the way you say the name, with * for a run of characters, ? for exactly one, and a counted class such as [a-z]{3,8}. The count is required and bounded, with a ceiling of 64. An open class like [a-z]+ is refused, because an open bound is how a pattern silently becomes a full scan.

Every pattern must name a TLD, so *agent alone is refused and *agent.* means every TLD. Names are stored suffix-first, so pinning one turns the pattern into a key range. The reference measures anchored searches at 0.03 to 0.7 seconds, against 1 to 3.5 seconds for one that reads the whole key space.

The response reports anchored and key_prefix, so you can see which case you landed in.

Window mode reads the registration feed by date

Sending a time bound switches the search into window mode, which reads the registration feed by date. That is the right mode for "which names matching this grammar appeared last week". The reference measures that query at 0.094 seconds.

Cursors carry no meaning between the two modes, and the wrong one answers 400 instead of silently restarting the walk.

Every hit carries ns and cert_id, and the ns filter above is what keeps a grammar from collecting coincidences.

Batch lookup tests 500 candidates in one call

A search plus a key pivot produces a few hundred names. Looking them up one at a time is a few hundred requests against a concurrency gate. Batch lookup takes up to 500 in a single POST.

curl -sS "https://issued.live/api/v1/domains?include=timing" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domains":["name-one.example","name-two.example"]}'

Every input gets a row back in the order you sent it, duplicates included. The reply zips against your list without normalizing anything. Rows come back found, not_found, or rejected where the input never parsed as a registrable domain.

Those last two stay separate on purpose. A batch that dropped unparseable input would let you record a domain as absent when it was never queried.

Any include value drops the per-request cap to 100 names, each carrying up to 10 sub-entries. Sending more names than the cap truncates to it and sets truncated.

Pivot on the certificate, then on the key

A domain record publishes ssl_cert, the 32-hex cert_id, and that value is the bridge into the certificate endpoints.

curl -sS "https://issued.live/api/v1/cert/$CERT_ID" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

curl -sS "https://issued.live/api/v1/spki/$SPKI_SHA256?limit=500" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

The sans array lists the names a certificate covers, which is a link that survives a reverse proxy. spki_sha256 is a hash over the SubjectPublicKeyInfo, so two certificates carrying the same value were issued for one key pair. Often that is a renewal, and sometimes it is one operator across names that share nothing else.

Link	Strength	Why
Shared address	Weak alone	A CDN address fronts unrelated tenants at scale, so co-location proves shared hosting.
Shared nameservers	Moderate	Strong when the pair is account-specific, weak when it is a large provider's default.
Shared certificate	Strong	Names packed onto one certificate were issued together, by one party, for one deployment.
Shared key	Strongest	One key pair across certificates means one holder of one private key.

Read the coverage field on every key pivot before drawing a conclusion. Key hashes were first recorded on September 7, 2026, and certificates ingested earlier cannot be matched on one. A thin result from an older pivot therefore reads as unknown.

Certificate detail stays queryable for 14 days and then lives on in the archived daily files. A 404 for an older id reports that horizon and says nothing about whether the certificate existed.

ja4x fingerprints the issuance software a certificate authority runs. issued.live reports the value and offers no pivot on it. The value space is small enough that a match would return a large share of one CA's output.

Where the range sweep is the wrong instrument

Reverse IP has a sibling that takes a CIDR. Write the prefix slash as a hyphen, since a literal slash is a path separator and will not route.

curl -sS "https://issued.live/api/v1/range/198.51.100.0-24" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

A range covers at most 256 addresses, an IPv4 /24, and anything wider answers 400. On shared cloud space the surrounding /24 belongs to unrelated tenants. A sweep there returns hundreds of neighbors with nothing to do with your thread.

On dedicated hosting that trade-off inverts, and the /24 becomes the fastest way to see a whole rented block. Sweeping anything larger means iterating a /24 at a time.

Concurrency is the limit that bites

The per-minute ceiling rarely stops this work. Advanced queries are bounded by how many run at once on one key: one on Plus, two on Pro.

Reverse IP, range, pattern search, batch lookup and the provisioning feed each take a slot. Certificate, key, domain and timeline lookups take none.

Over the gate a request waits up to five seconds for a slot, then returns 503 timeout. It never queues, so a pile-up of slow queries cannot form. Branch on the retryable field and Retry-After rather than on the status number.

The timeout status stays 503 by design. This origin sits behind a CDN that replaces a 504 with its own error page, stripped of the JSON body.

Serialize a multi-block walk. The gate admits two at a time on Pro anyway, and concurrent cold range queries make each other slower.

The feeds keep the map current

A fleet enumerated on Tuesday is a snapshot. Two cursor-paged feeds turn a finished investigation into a standing one.

curl -sS "https://issued.live/api/v1/provisioning?max_hours_to_cert=6&ns=ns.example-dns.net" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

curl -sS "https://issued.live/api/v1/nrd?certified=1&max_hours_to_cert=1&limit=500" \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

The provisioning feed returns domains registered, certificated and pointed at a host inside one window. Any one of those facts is ordinary. All three inside an afternoon is a domain being stood up to be used.

The hours-to-certificate bound is what keeps that query affordable. On the reference's own measurements, widening it from one hour to six multiplies the candidates in a 72-hour window by roughly 19. Widening it again to 24 hours multiplies them by another 10.

Recent windows are thin by construction, and the response says so. Published coverage figures: 36.9% of candidates carry a DNS observation inside 24 hours, 83.9% inside 72 hours and 96.1% inside a week.

Rows without one are marked not_yet_observed, which records an observation nobody has made yet. It says nothing about whether the name resolves.

The newly registered domains feed runs in ascending time order from a cursor. A consumer resumes exactly where it stopped, so a scheduled job can miss a run without losing an event. Store next_cursor on every page, including the ones where caught_up comes back true.

Sub-hour certification runs at about 1.1% of certified registrations, against 8.4% taking over a week. The tight end of that filter is a small set. max_hours_to_cert requires certified=1, and sending it alone answers 400 instead of quietly doing nothing.

What the plans cover

issued.live opened paid plans on September 19, 2026, three of them. Pattern search, batch lookup and both feeds belong to Pro at $199 a month. Pro also carries 1,200 requests a minute, two advanced queries in flight, and daily files for DNS by vantage point, certificates and address history.

The earlier steps sit lower. Reverse IP, the CIDR sweep, the pivots and the domain timeline by API run on Plus at $99 a month, with one query in flight. Basic at $39 takes the daily domain and DNS files plus the extended record and the domain timeline on the website.

Unkeyed access stays free at 1,000 requests a day per address. Billing is monthly through PayPal, and sign-in is a code sent to your email. Full plan and limit detail sits on the pricing page.

Methodology

Every endpoint, parameter, cap and error code above was checked on September 18, 2026 against the issued.live Pro API reference, last updated September 15, 2026. Plan boundaries come from the pricing page on the same date, and the performance and coverage percentages are that site's published measurements. The 532-hostname classification comes from Tuxxin investigation work, and Daniel Jones reviewed the post before publication.

issued.live paid plans are open: Basic $39, Plus $99, Pro $199

Daniel J — Sat, 19 Sep 2026 13:00:02 +0000

Paid plans are open on issued.live: Basic at $39 a month, Plus at $99 and Pro at $199. Basic opens the extended record on the website and the daily domains and DNS files. Plus adds lookups by address, certificate and public key through the API, and all five daily datasets. Pro adds sweeps across the whole corpus, a second concurrent advanced query and certificate lookup in the permanent archive.

issued.live reads the public Certificate Transparency logs, resolves DNS from seven vantage points and loads ICANN zone files. It records certificates exactly as logged and collects nothing by connecting to a subject's host.

Free covers the public record for any domain with no account and no key: certificate, issuer, certificate expiry, hosting address and current DNS, plus the domain's registration and expiry dates and its registrar. The same URL answers as JSON, Markdown or a web page. The cap is 1,000 requests a day per client address, resetting at 00:00 UTC.

What each plan gets

Basic, at $39 a month

Basic runs at 60 requests a minute with no daily cap, and carries the domains and DNS daily files in csv.zst. It also opens the extended record on the website for any domain you look up: certificate internals, DNS per vantage point, the full address history and the domain timeline.

A Basic key reaches the daily files and the public record API.

Plus, at $99 a month

Plus runs at 300 requests a minute and serves the extended record and the timeline through the API. It suits a hunter working one lead at a time: an address, a certificate, a name.

Reverse IP and CIDR return every hostname our resolvers have recorded answering at an address or a range, with first-seen and last-seen times and an observed count. These observations begin in August 2026.

Pivots by certificate and SPKI return the other names on a certificate and everything sharing a public key, with key-reuse coverage from September 7, 2026. Every certificate reports its JA4X fingerprint, and JA4X has no pivot because a search on one value would return a third of all Let's Encrypt certificates.

The timeline lists every dated event for a domain in order, with the gap since the previous event and a precision of exact, day or observed. A gap between two observed events measures our scan schedule, so filter on precision before fingerprinting.

Plus takes all five datasets as daily files: domains, dns, dns_vantage, certificates and address_history. It runs one advanced query at a time.

Pro, at $199 a month

Pro runs at 1,200 requests a minute and adds the sweeps. Pattern search finds registrable domains whose names fit a pattern, across the whole corpus. The grammar, its limits and an example response are covered on tuxxin.com: Pattern search on issued.live finds domains by the shape of their names. Batch lookup answers up to 500 domains in one call. Two feeds page by cursor: newly registered domains, and provisioning, which lists domains registered, certificated and resolved inside one window.

Pro takes the same five daily files as Plus and runs two advanced queries at once. It is the one plan whose certificate lookups reach the permanent archive once a certificate leaves the 48-hour live window.

Request formats, pagination and error codes for every keyed endpoint are in the Pro API reference.

Concurrency slots

Advanced queries are bounded by how many run at once on your account: one on Plus, two on Pro. Each paid account holds one API key, so the count per key and per account is the same. The per-minute rate applies to the public record API, and the slots bound the advanced queries.

Five endpoints take a slot: reverse IP, range, pattern search, batch lookup and the provisioning feed. The certificate, key, domain and timeline endpoints and the newly registered domains feed are point lookups and take none. Another customer's traffic never consumes your slots, and keyed calls through the issued.live MCP server draw on the same slots as HTTP calls.

A cold reverse-IP range query can read hundreds of millions of rows and hold its database connection for close to 18 seconds. Enough of those at once would take the whole connection pool and the memory behind it, and every other request on the site would stall. When every slot on your account is busy, a new request waits up to five seconds for one and then times out, because an unbounded queue would turn one slow query into a pile-up. The same cost caps a range at 256 addresses, an IPv4 /24.

The four plans side by side

Capability	Free	Basic	Plus	Pro
Price a month	$0	$39	$99	$199
Rate	1,000 a day per address	60 a minute	300 a minute	1,200 a minute
Public record for one domain	Yes	Yes	Yes	Yes
Registration and expiry dates, registrar	Yes	Yes	Yes	Yes
Extended record and timeline on the website	No	Yes	Yes	Yes
Extended record and timeline by API	No	No	Yes	Yes
Reverse IP, CIDR and the certificate and SPKI pivots	No	No	Yes	Yes
Pattern search, batch lookup and the feeds	No	No	No	Yes
Certificate lookup in the archive, past 48 hours	No	No	No	Yes
Daily files	None	Domains and DNS	All five	All five
Full weekly snapshot	No	Domains and DNS	All five	All five
File downloads a day	None	One per file	One per file	One per file
Advanced queries in flight	None	None	One	Two
API keys on the account	None	One	One	One
Published SHA-256 checksums	Yes	Yes	Yes	Yes
Ad-free pages, sign-in and billing	No	Yes	Yes	Yes

The daily files

Files come in two kinds: a daily delta of what changed, and a full weekly snapshot for seeding a new system. Every paid plan gets the snapshot for the datasets it covers. The domains, dns, dns_vantage and address_history files ship as csv.zst, and certificates ships as Parquet. JSON copies were withdrawn on September 23, 2026. Generation starts at midnight US Eastern, and the datasets publish one at a time over the following hours.

You can download each file once a day, an allowance shared between the download page and your key that resets at 00:00 UTC. A free Sample link beside a file on the download page returns its header and five real rows, and a daily checksums.txt needs no key, so anyone can verify a file they already hold.

How long each dataset is kept

Full certificate rows are queryable live for 48 hours, then age out of the live database. Every closed UTC day is archived as Parquet and kept indefinitely. On Pro, the same certificate endpoint searches that archive when a lookup misses the live window, in seconds where live lookups take milliseconds. Interactive archive coverage begins September 9, 2026.

Storage cost sets the window length. Certificates are the one dataset stored as raw observations; the others hold state plus deltas. We costed a 13-month hot window at about 3.6 TB, roughly four times the whole disk, and declined it.

Daily files stay on the download page for 14 days, counting today, and every file published is archived permanently, starting with the files for September 17, 2026. DNS change history runs 18 months, and the current DNS answer is held for as long as the name resolves. Registration data, address history and the reverse-IP index have no expiry. The about page carries the full retention table.

When Free or another service fits better

Free covers anyone reading a handful of domains a day from a shell, with no key to manage.

Anyone asking what a certificate looked like in 2019 should use crt.sh, which answers that for free. Registrant contact details and long whois histories come from other services, and we collect neither. The comparison page weighs issued.live against AllZonefiles.io, Domains-Monitor, WhoisXML API and crt.sh, and says where each of them wins.

Billing and sign-in

Plans bill monthly in advance through PayPal subscriptions and renew automatically. An active, unbroken subscription keeps its price, and a price change takes effect only at a renewal after notice by email. Cancel any time in PayPal, and access runs to the end of the period you have paid for. Part-months are not prorated or refunded.

Sign-in is passwordless: a six-digit code arrives by email, and signing in opens the page that manages your key and billing. You can rotate your API key at any time. A paid plan licenses the data for internal use while the subscription is active, and publishing findings and excerpts is allowed. Redistributing the bulk files, or a substantial part of them, as a dataset is prohibited.

The feature matrix and the subscribe buttons are on the pricing page.

Updated September 25, 2026, to match issued.live's pricing, about, compare, downloads, terms and login pages and the developer documentation. More about the author.

Brevo delivered KongTuke ClickFix to 51 customer sites

Daniel J — Thu, 17 Sep 2026 12:12:30 +0000

Brevo's own delivery infrastructure served malicious JavaScript to 51 customer page domains on September 14, 2026. The injected code drew a fake Cloudflare verification panel and walked visitors through a ClickFix sequence ending in a command shell. The window ran from 16:05 to 20:12 UTC, and by the following day every loader hostname it used had stopped resolving.

Kirk of ADAMnetworks published the technical analysis. Whack.sh took part in the shared investigation.

How the attack works

Two files Brevo serves to its customers carried appended code. The SDK loader at cdn.brevo[.]com/js/sdk-loader.js went from a clean 3,442 bytes to 3,615 or 3,616. The Sibforms bundle at sibforms[.]com/forms/end-form/build/main.js went from a clean 461,411 bytes to 461,584 or 461,585. The one-byte spread is the loader hostname: a page served by cdn11 carries a longer label than one served by cdn2. If you are checking a capture against these numbers, both values are modified.

The appended code is a script tag pointing at a loader host under sendibt1[.]com. That domain is the reason this reached so far: Brevo lists it among its own technical domains, so it is a name a customer following Brevo's own integration guidance would already have allowed. This was delivery through a vendor's genuine infrastructure, and a site owner reviewing their network log would have seen nothing out of place.

The panel the code drew imitated a Cloudflare verification step. It instructed visitors to press Win+R, then Ctrl+V, then Enter. The clipboard carried a command built around conhost.exe --headless and curl, piped into cmd.exe.

What the command retrieved is unknown. Every captured request to the four download servers returned an empty HTTP 444, and a Joe Sandbox run that executed the command on Windows 10 at 18:34:33 recorded the same thing. The tokens are single use: the servers answered the victim and nobody else. Anyone who completed the paste got a payload, and it was not captured.

The panel was served in an iframe requesting fullscreen and clipboard-write permissions, and carried a proof-of-work challenge before it would render. It reported telemetry events named vclick and copy_fail, so the operators were measuring how many visitors completed the paste and how many gave up.

Built ahead of time, and torn down fast

The certificate record dates the buildout well before the attack. Kirk's analysis records a certificate for cdn.sendibt1[.]com issued on August 25, twenty days ahead, and a wildcard for *.sendibt1[.]com on September 8. Certificates for cdn9, cdn10 and cdn11 were issued on September 14 between 16:09 and 16:12 UTC, four minutes after the window opened: capacity added while the campaign was already running.

Seven loader hosts served the campaign. By September 15 all seven returned NXDOMAIN. The whole operation lasted about four hours.

A separate thread in the same research connects the operator to MintsLoader, and it is worth being precise about the distance. The four download servers share a naming scheme with hosts that a MintsLoader sample from September 9 queried. That earlier sample reached a staging host, jg2n36pxkqjfqp7[.]top, and DNS and hosting records tie that host to 97 domains across three addresses on BL Networks' AS399629, all using 15-character lowercase labels under .top. That estate hangs off the September 9 staging host, not off the sendibt1 loaders: it is the same operator by inference, on different infrastructure.

How to stay safe

Treat any instruction to copy a command and paste it into the Run box, PowerShell, or Terminal as the attack itself. A verification step that asks you to run something is a lure. Cloudflare's real challenge never asks you to paste a command.

Close the tab. Nothing is repaired by completing the step.
If you already ran it, treat the machine as compromised and change passwords from a different device.

For teams running a site that loads third-party JavaScript:

Subresource Integrity on vendor scripts turns a modified file into a blocked file. It is the direct control for this attack, and it costs an attribute. A Content-Security-Policy would not have helped here: the malicious host was a domain the vendor documents, so a correctly written policy already trusted it.
Compare your vendor bundles against known-clean byte counts. Both modified sizes above differ from clean by fewer than 200 bytes in a 461 KB file.
Watch endpoints for a shell spawned shortly after browser activity, and specifically for conhost.exe --headless.
Certificate transparency carried the first record of this infrastructure, three weeks early. Watching CT for new names under your vendors' domains is cheap, though be honest about what it buys: a new cdn subdomain on a domain the vendor already documents is routine, so August 25 would have been a row in a log rather than an alarm. Its value here is retrospective, which is how the timeline above was built.

Credit and sources

The research and the writeup are Kirk's, at ADAMnetworks, published September 16, 2026. The report thanks Daniel Jones of Tuxxin LLC, who took part using Whack.sh, and Emiliano of The Matrix Project, for their work on the infrastructure records.

ADAMnetworks report: Brevo delivers KongTuke ClickFix to customer sites
Earlier collaboration: PasteSwitch, 108 crypto-theft ads on a hijacked HBO Max Reddit account