Known malicious kitcriticalphishing
ClearFake / ClickFix 'enterprise2026' cluster — lure, payload and TDS hosts
family: clearfake-enterprise26-2026-08
Compromised WordPress sites read a BNB Smart Chain testnet contract (EtherHiding) that returns a loader for a second-stage script on a look-alike 'cloud enterprise' domain (e.g. cloudsenterprise2026.com/js/my?<8 chars>&ts=<ms>) or a fake CDN host (cdn.claritydelivr.com, cdn.quickdelivr.com, cdn.nodedelivr.com). Later waves route through the traffic-distribution hosts mytds1029380.com and teamftds00.com. The second stage is VM-obfuscated JavaScript that shows a fake verification lure and stages a PowerShell command for the visitor to paste; publicly reported follow-on activity is a .NET RAT compiled at runtime and injected into svchost.exe. Lure domains cloak to cloudflare.com for scanners.
Anchors
SMQL queryrun
contacted_host:cloudenterprise26.com OR contacted_host:cloudsenterprise26.com OR contacted_host:cloudsenterprise2026.com OR contacted_host:cloudsnewenterprise.com OR contacted_host:senterprise2026.com OR contacted_host:zenterprise2026.com OR contacted_host:digitalenterprise2026.com OR contacted_host:teamfenterprise2026.com OR contacted_host:cloudeliveryenterprise.com OR contacted_host:cdn.claritydelivr.com OR contacted_host:claritydelivr.com OR contacted_host:cdn.quickdelivr.com OR contacted_host:cdn.nodedelivr.com OR contacted_host:mytds1029380.com OR contacted_host:teamftds00.comProvenance
Added: 2026-09-25 12:01
contacted_host also covers a direct scan of one of these domains, since the scanned host is itself a contacted host, so no separate domain: terms are needed. Exact hosts only: the *delivr names are look-alikes of legitimate CDN naming, so no wildcard on the apex pattern. The lure domains redirect scanners to www.cloudflare.com, so a sighting whose final page is Cloudflare's homepage is expected, not a false positive. Companion rows: the hosting-IP row (durable across domain rotation) and the loader-hash row.
Sightings (14)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| coastalclearwaterdelivery.com | 2eefd77e… | — | query | 2026-09-25 12:08 |
| konverto.in | 53d1223f… | — | query | 2026-09-25 12:08 |
| wikibio.us | f0d8d385… | — | query | 2026-09-25 12:08 |
| senterprise2026.com | 5fde18b8… | — | query | 2026-09-25 12:08 |
| cloudeliveryenterprise.com | 764e67c2… | — | query | 2026-09-25 12:08 |
| osmilano.it | 99e574cc… | — | query | 2026-09-25 12:08 |
| cloudsenterprise2026.com | 257f8055… | — | query | 2026-09-25 12:08 |
| cloudsenterprise26.com | 1a75a77d… | — | query | 2026-09-25 12:08 |
| cloudenterprise26.com | 53c0bed4… | — | query | 2026-09-25 12:08 |
| cloudenterprise26.com | ded9970d… | — | query | 2026-09-25 12:08 |
| rcrsinnovations.com | b898f2e3… | — | query | 2026-09-25 12:05 |
| coastalclearwaterdelivery.com | 51419c69… | — | query | 2026-09-25 12:04 |
| zenterprise2026.com | a70a5fe3… | — | query | 2026-09-25 12:03 |
| cloudsnewenterprise.com | 35a65a6c… | — | query | 2026-09-25 12:03 |