Known malicious kitcriticalphishing
DOUBLECUP — delivery domains & CountLoader C2 (SMQL tracker)
family: doublecup-clickfix-laas
DOUBLECUP delivery domains and CountLoader C2
Anchors
SMQL queryrun
domain:*canva-arts.com OR domain:*cloud-electronic.com OR domain:*cloudscraft.com OR domain:*doublecap.ltd OR domain:*doublecap.live OR domain:*examcanvas.com OR domain:*storagepioneer.com OR domain:*supercloudsaver.com OR domain:*ticgo-cloud.com OR domain:*roqqcloud.com OR domain:*spec-connectweb3.tv OR domain:*alphastore.vg OR domain:*appleid-customertelemetry.glProvenance
Added: 2026-08-04 08:53
Split from the original single-anchor draft: the combined 29-term query exceeded the SMQL engine cap of 20 filter nodes (validator.MAX_FILTER_NODES), so the cron logged 'invalid SMQL, skipping' every 15 min and the anchor was inert. Same hunt_family, one row per indicator class, each under the cap. The ip: terms are the durable half — they match resolved IPs, so a new domain on the same host still trips. See hunt 169 for the YARA anchor.
Sightings (0)
No sightings recorded yet.