CountLoader servers that redirect every visitor to www.gmx.net — scanned or contacted host, server address

Command-and-control servers of CountLoader, a PowerShell loader that installs further malware and keeps itself running through scheduled tasks. These servers show no page to an ordinary visitor: the web server answers every request with a permanent redirect to www.gmx[.]net, the home page of an unrelated, legitimate German webmail provider, which is not involved. The domains use uncommon top-level domains (.vg, .cc, .gl), Cloudflare name servers and a server address of their own. Public threat lists label alphastore[.]vg, twit-follow[.]vg, urugvai[.]cc, ultahost[.]gl, holiday-forever[.]cc and alpha-centavr[.]cc as CountLoader. SOCRadar's August 2026 report on the DOUBLECUP ClickFix delivery service lists alphastore[.]vg as a DOUBLECUP delivery host and CountLoader server. capsysnet[.]vg, which Microsoft Threat Intelligence named on 2026-10-03 as a later-stage server in a ClickFix campaign that hides its payload in the browser cache, answers with the same redirect. Every domain seen so far on 79.124.59[.]146 is publicly labelled CountLoader or an information stealer.