ScanMalware.com
Known malicious kitcriticalphishing

ClearFake — blockchain contract loaders on compromised sites (Polygon, BSC testnet)

family: clearfake-polygon-loader-2026-10

Script injected into compromised websites. For Windows visitors that are not crawlers it reads a list of servers from a Polygon smart contract (EtherHiding: eth_call to selector 0x3bc5de30 through public RPC nodes), decodes it, and loads <server>/js/all.min.js?m=1, the next stage of a ClickFix chain. The servers rotate through the contract, so the match is on the loader code, not on any host. Older and parallel versions of the same injection read a BNB Smart Chain TESTNET contract instead (the original 2023 EtherHiding design: get() returns the next-stage reader), and check the visitor's location with a public IP-information endpoint first.

Anchors

YARA ruleClearFake_Polygon_Contract_Loader
SMQL queryrun
contacted_host:ip-info.ff.avast.com OR contacted_host:data-seed-prebsc-1-s1.bnbchain.org OR contacted_host:data-seed-prebsc-1-s1.binance.org OR contacted_host:data-seed-prebsc-2-s1.binance.org OR contacted_host:data-seed-prebsc-2-s2.binance.org OR contacted_host:bsc-testnet.drpc.org OR contacted_host:bsc-testnet-rpc.publicnode.com OR contacted_host:bsc-testnet-dataseed.bnbchain.org OR contacted_host:bnb-testnet.api.onfinality.io

Provenance

Added: 2026-10-01 17:22
Requires eth_call, a Polygon RPC host, and the selector or the stage path together with the loader functions, so an ordinary web3 page reading a Polygon contract does not match. Contracts seen: 0xa1cb583820EfE60c840498aaDa3f741Ab6869cBE, 0xF20221C0Cf767EEe759bBE1Fb8dd76EaeF0e5779, 0x91639826046FD209ef96c76CF9089E6Dde2d408A, 0x4F99A81e59311768e786DE5d1c58AC6d354c649d, 0x88411E5440e1482f0ABCB5212dAeab28Cf3332C1. Search anchor (added 2026-10-07): pages that contacted the BSC-testnet RPC nodes or the IP-information endpoint the BSC-testnet variant uses: ip-info[.]ff[.]avast[.]com, data-seed-prebsc-1-s1[.]bnbchain[.]org, data-seed-prebsc-1-s1[.]binance[.]org, data-seed-prebsc-2-s1[.]binance[.]org, data-seed-prebsc-2-s2[.]binance[.]org, bsc-testnet[.]drpc[.]org, bsc-testnet-rpc[.]publicnode[.]com, bsc-testnet-dataseed[.]bnbchain[.]org, bnb-testnet[.]api[.]onfinality[.]io. Measured over 120 days: 46 of 47 scans contacting them carried a blockchain-loader alert, and the other one contacted the full set of kit hosts. A web3 developer page on the BSC testnet could also contact these nodes; such a sighting only shows the banner, it never changes a verdict.
References:

Sightings (109)

HostScanScriptMatchWhen
21-realty.comcffe7b24…—query2026-10-07 15:22
ultdpower.com0065b9f9…—query2026-10-07 15:22
ablecasinos.comc54eadc9…—query2026-10-07 15:22
ungkehh.sitef991b20f…—query2026-10-07 15:22
venus-testnet.vercel.appa1539f9c…—query2026-10-07 15:22
bilisimzamani.net0b671725…—query2026-10-07 15:22
venus-testnet.vercel.app83f881fa…—query2026-10-07 15:22
coastalclearwaterdelivery.com51419c69…—query2026-10-07 15:22
rcrsinnovations.comb898f2e3…—query2026-10-07 15:22
hotelsunsethill.com13206f8f…—query2026-10-07 15:22
cafedesamis.iteaa284bd…—query2026-10-07 15:22
sheffieldra.co.uke935697a…—query2026-10-07 15:22
outlookmagazine.caf9989fee…—query2026-10-07 15:22
5mail.stored9595418…—query2026-10-07 15:22
motivationandlove.com5e110459…—query2026-10-07 15:22
smarthomedirect.com.au051e2f05…—query2026-10-07 15:22
slotonlinemachinemania.comdb93fc81…—query2026-10-07 15:22
coastalclearwaterdelivery.com2eefd77e…—query2026-10-07 15:22
afaonline.org2f6e9ee1…—query2026-10-07 15:22
flowersbyesmeralda.comacaed07d…—query2026-10-07 15:22
bahrainhrs.org20a05923…—query2026-10-07 15:22
mindeyemetchiritema.comcc87df95…—query2026-10-07 15:22
portline-express.com8fd3c64f…—query2026-10-07 15:22
playpokeronlineway.comb0f095d7…—query2026-10-07 15:22
eastmont.net06705a67…—query2026-10-07 15:22
bazzaro.def111a042…—query2026-10-07 15:22
shoetimewholesale.com8bfdcd22…—query2026-10-07 15:22
tee.com.pk2c0131ba…—query2026-10-07 15:22
winnernet.net7d6d05c4…—query2026-10-07 15:22
mp2022.pzszach.pl01dfc080…—query2026-10-07 15:22
f3martelinho.comfbc24042…—query2026-10-07 15:22
lalalapiano.comc8fa4e30…—query2026-10-07 15:22
mcnbholding.com3a632cc3…—query2026-10-07 15:22
gpsite.cloudea44cdb5…—query2026-10-07 15:22
geltonayraviskas.ltfbbbe200…—query2026-10-07 15:22
rodsua.com558cbe25…—query2026-10-07 15:22
experiencethejourney.co.ukc41cc59c…—query2026-10-07 15:22
gastroliver.com.pk9929567c…—query2026-10-07 15:22
theparknonthaburi.com09be98df…—query2026-10-07 15:22
trungnguyendesign.comb9a72755…—query2026-10-07 15:22
service-en-ligne.comebf8239b…—query2026-10-07 15:22
petrotoday.ir03d845bd…—query2026-10-07 15:22
tavor-band.def12745b1…—query2026-10-07 15:22
chitayle.jpc58192df…—query2026-10-07 15:22
bangas.com.bda0e0e1b6…—query2026-10-07 15:22
redsmart.online78f56d07…—query2026-10-07 15:22
zeynelozyasar.com7f04a3df…—query2026-10-07 15:22
planetoptical.it86d584a0…—query2026-10-07 15:22
konverto.in53d1223f…—query2026-10-07 15:22
hartmann-immo-ffb.ded547ceff…—query2026-10-07 15:22
denimology.azurewebsites.netc0e739b7…—query2026-10-07 15:22
wikibio.usf0d8d385…—query2026-10-07 15:22
osmilano.it99e574cc…—query2026-10-07 15:22
digitalisierungscheck.mit-aufwind.ch10c8efdc…—query2026-10-07 15:22
coloradopols.com48477db9…—query2026-10-07 15:22
dakarmidi.netdef56614…—query2026-10-07 15:22
thecrickettalk.com6caedeed…—query2026-10-07 15:22
nationalcricketteamtimelines.com29db3365…—query2026-10-07 15:22
oastoscana.eud49d17e9…—query2026-10-07 15:22
bing.com87ea2d15…—query2026-10-07 15:22
collegiogeometrimessina.it4085db29…—query2026-10-07 15:22
ixpap.com7ba58c68…—query2026-10-07 15:22
www.farmerslabseeds.com#html90fb2f40…https://www.farmerslabseeds.com#htmlyara2026-10-04 23:15
www.pmetal.cl#htmle81095b7…https://www.pmetal.cl#htmlyara2026-10-04 04:17
fullpowerproperties.uk327dfa14…https://fullpowerproperties.uk/#htmlyara2026-10-03 10:27
better-horse.comc0ea4e35…https://better-horse.com/#htmlyara2026-10-03 10:27
bluerockfinancing.com30980f83…https://bluerockfinancing.com/#htmlyara2026-10-03 10:26
celine-gronek.fr60909419…https://celine-gronek.fr/#htmlyara2026-10-03 10:26
centro.ba70585654…https://centro.ba/#htmlyara2026-10-03 04:28
flouz.agency37ab0ebd…https://flouz.agency/#htmlyara2026-10-03 04:28
ciudadelacafamiv.com27753eae…https://ciudadelacafamiv.com/#htmlyara2026-10-02 10:26
baseebook.com72f3d8ae…https://baseebook.com/wp-content/themes/hello-elementor/assets/js/hello-frontend.js?ver=3.4.9yara2026-10-02 04:27
newdigimatic.com#htmld49e3ae6…https://newdigimatic.com#htmlyara2026-10-01 19:17
elektrikclothing.com#html5f4b4cd3…https://elektrikclothing.com#htmlyara2026-10-01 19:17
brixlysafaris.com#htmlbda1ff50…https://brixlysafaris.com#htmlyara2026-10-01 19:17
dein-sandmann.de46847c39…https://dein-sandmann.de/#htmlyara2026-10-01 19:17
naturfotografie-roman-vitt.de#htmlb261c3fc…https://naturfotografie-roman-vitt.de#htmlyara2026-10-01 19:17
www.skoar.gg0e4140c8…https://www.skoar.gg/breaking-news/ocarina-of-time-remake-confirmed-for-development/#htmlyara2026-10-01 19:17
corrieredellaverita.it#html8bb233fb…https://corrieredellaverita.it#htmlyara2026-10-01 19:17
solmechanical.com#htmld8280da1…https://solmechanical.com#htmlyara2026-10-01 19:17
suicidesurvivorguide.com#html7a022eb2…https://suicidesurvivorguide.com#htmlyara2026-10-01 19:17
pacharagems.com#html0ca60b62…https://pacharagems.com#htmlyara2026-10-01 19:17
lack-behnke.de#htmlec02ce3c…https://lack-behnke.de#htmlyara2026-10-01 19:17
lopalooza.org0aebc623…https://lopalooza.org/#htmlyara2026-10-01 19:17
georgebakes.com#htmle5d900e1…https://georgebakes.com#htmlyara2026-10-01 19:17
editions-canaima.com#htmlc57cb5b9…https://editions-canaima.com#htmlyara2026-10-01 19:17
Www.theoryofliving.com#htmle878de64…https://Www.theoryofliving.com#htmlyara2026-10-01 19:17
www.becrepress.com#html95c2e99a…https://www.becrepress.com#htmlyara2026-10-01 19:17
heartandshape.com#html1e118494…https://heartandshape.com#htmlyara2026-10-01 19:17
driftwoodresortmn.com#html77c7f38b…https://driftwoodresortmn.com#htmlyara2026-10-01 17:22
wordpresshjalp.se#html1e258468…https://wordpresshjalp.se#htmlyara2026-10-01 17:22
wordpresshjalp.sea85c1521…https://wordpresshjalp.se/#htmlyara2026-10-01 17:22
parcelcourierline.coma1294de5…https://parcelcourierline.com/#htmlyara2026-10-01 17:22
solarwinds-in.com#html80bf6a8d…https://solarwinds-in.com#htmlyara2026-10-01 17:22
aitesas.com#html245c6082…https://aitesas.com#htmlyara2026-10-01 17:22
ambiancewax.com#htmlec4fc1b7…https://ambiancewax.com#htmlyara2026-10-01 17:22
beatrizmontes.com#htmlb8847741…https://beatrizmontes.com#htmlyara2026-10-01 17:22
maxfel.se8315b668…https://maxfel.se/#htmlyara2026-10-01 17:22
copier.pkfa30a35e…https://copier.pk/product-tag/rawalpindi/?srsltid=afmboooxrxqhx_9ww69ykky56icefwef6mx2d4cyfge187mr1rfxw8ui#htmlyara2026-10-01 17:22
littleolange.com#html399275d6…https://littleolange.com#htmlyara2026-10-01 17:22
wordpresshjalp.see69bda78…https://wordpresshjalp.se/#htmlyara2026-10-01 17:22
cookwithlina.com#htmlab7200b9…https://cookwithlina.com#htmlyara2026-10-01 17:22
maxfel.se340b5064…https://maxfel.se/#htmlyara2026-10-01 17:22
medmark.sa#htmlb3dcaa07…https://medmark.sa#htmlyara2026-10-01 17:22
21-realty.com#htmlcffe7b24…https://21-realty.com#htmlyara2026-10-01 17:22
saggang.com#html1133dc37…https://saggang.com#htmlyara2026-10-01 17:22
logm-justia.com#html5bec6271…https://logm-justia.com#htmlyara2026-10-01 17:22
saggang.com#htmle25fcbb6…https://saggang.com#htmlyara2026-10-01 17:22
maxfel.se#htmldc180c30…https://maxfel.se#htmlyara2026-10-01 17:22