Known malicious kitcriticalphishing
DOUBLECUP — delivery domains & CountLoader C2 (SMQL tracker)
family: doublecup-clickfix-laas
Short link:scanmalware.com/h/171
DOUBLECUP delivery domains and CountLoader C2 domains, as published by SOCRadar.
Anchors
SMQL queryrun
domain:*canva-arts.com OR domain:*cloud-electronic.com OR domain:*cloudscraft.com OR domain:*doublecap.ltd OR domain:*doublecap.live OR domain:*examcanvas.com OR domain:*storagepioneer.com OR domain:*supercloudsaver.com OR domain:*ticgo-cloud.com OR domain:*roqqcloud.com OR domain:*spec-connectweb3.tv OR domain:*alphastore.vg OR domain:*appleid-customertelemetry.glProvenance
Added: 2026-08-04 08:53
The DOUBLECUP indicators are split across several entries in this family, one per indicator class. The YARA entry in this family is the protocol-based anchor that survives infrastructure rotation.
Sightings (12)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| alphastore.vg | a49d1193… | — | query | 2026-09-13 21:50 |
| supercloudsaver.com | e783a250… | — | query | 2026-09-13 17:51 |
| ticgo-cloud.com | 5cf288e3… | — | query | 2026-09-13 11:52 |
| appleid-customertelemetry.gl | 630ec541… | — | query | 2026-09-13 09:53 |
| cap.spec-connectweb3.tv | 54df5010… | — | query | 2026-09-13 07:53 |
| cloudscraft.com | a124a949… | — | query | 2026-09-13 06:51 |
| canva-arts.com | 2c903f53… | — | query | 2026-09-13 05:51 |
| cap-t2.spec-connectweb3.tv | 9c33510e… | — | query | 2026-09-13 03:52 |
| examcanvas.com | 0c5b3ba4… | — | query | 2026-09-13 02:50 |
| roqqcloud.com | 5140d36c… | — | query | 2026-09-13 01:52 |
| storagepioneer.com | be004d50… | — | query | 2026-09-12 22:50 |
| cap-t1.spec-connectweb3.tv | b93c5689… | — | query | 2026-09-12 20:51 |