ClearFake / ClickFix 'enterprise2026' cluster — hosting and TDS addresses

Credit: Soumick Kar, who publicly reported a ClickFix intrusion whose injected implant used 158.94.211.92 for command and control (LinkedIn post in the references). These are the durable half: an ip: term keeps firing after the operator rotates to a fresh domain on the same box. All three hosted only campaign domains when this hunt was written, so they are treated as dedicated rather than shared hosting. 158.94.211.92 earlier (spring 2026) also served ScreenConnect installers, a different use of the same address; re-check before trusting a sighting that predates Aug 2026. The neighbouring 158.94.211.0/24 hosts many unrelated malware servers, so the range is deliberately NOT anchored. 91.92.240.194 (a DCRat C2 that cloudsnewenterprise.com and cloudsenterprise2026.com also resolved to) is left out: it is someone else's C2 box first and would read as a different family.