{
 "type": "bundle",
 "id": "bundle--1f9b711d-fcd7-52a0-a7fd-272445be7f5c",
 "objects": [
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "name": "ByteMantle Research",
   "identity_class": "organization"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--56418c5f-4bf0-54a8-873b-a77976bb1dc4",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): gate-air.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'gate-air.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--cdeec5be-8943-5139-a6a2-ca211d36b591",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): outdoortraderapp.com",
   "description": "website serving a ClickFix lure (likely hacked); an inline script with a PowerShell download command, chained to a smart-contract loader. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'outdoortraderapp.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--c5121910-1c03-55b4-bd8c-82391b99b4f9",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): tdkder.org",
   "description": "website serving a ClickFix lure (likely hacked); read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'tdkder.org']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e812afcf-5a43-514d-bb5a-b41435cc7c4f",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): daraleilm.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'daraleilm.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--4f6a1d48-614a-5004-9995-f32b02d0302a",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): nandhini-pearl.in",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'nandhini-pearl.in']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f8d8f267-05d7-5487-a60c-35f21e309815",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): accarda.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'accarda.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--27ddfb01-2670-577c-aeb4-9e2703b87006",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): myboostup.io",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'myboostup.io']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--bfb360b7-4bbf-51bb-bc1f-c379641a4354",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): ercanmakinabursa.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'ercanmakinabursa.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b723d272-531f-5fa4-95b1-1f44324b38aa",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): man2tidore.sch.id",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'man2tidore.sch.id']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--fb1b1293-9372-5625-bb73-e0f385f0c9b4",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): prashenterprises.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'prashenterprises.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1e8169db-d073-50e8-a6e3-cf1998b12946",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): thegrowthifyagency.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'thegrowthifyagency.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--9047f8fa-639e-596b-89ea-4a3e2fd01fb5",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): capizeats.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'capizeats.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--02d7c721-2087-5392-af0d-ee21ec32d526",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): onebox63.vip",
   "description": "website serving a ClickFix lure (likely hacked); read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'onebox63.vip']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2c68d143-e939-51a5-894d-3e6b0bea8b6a",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): alphacornerstakehq.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'alphacornerstakehq.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--fc80c7d8-c689-5cd4-b6ff-101d010d4769",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): senexconsulting.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'senexconsulting.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--374e6f4c-2a80-514b-b697-fc634808c543",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): allayyinah.sch.id",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'allayyinah.sch.id']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d648d3ea-04e5-504d-b454-0ef462a38983",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): nightdesire.fun",
   "description": "website serving a ClickFix lure (likely hacked); read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'nightdesire.fun']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6ac08fc8-6227-58b8-9a45-d88bbf7961a8",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): www.theforestrecovery.kinsta.cloud",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'www.theforestrecovery.kinsta.cloud']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--54a08626-e87f-5e92-8b0d-16767bdb25dd",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): tipcalculatorusa.com",
   "description": "website serving a ClickFix lure (likely hacked); read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'tipcalculatorusa.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--4300c75c-6414-5476-ab9e-1c538ef6dd22",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): youngwestbury.org.uk",
   "description": "website serving a ClickFix lure (likely hacked); an inline script with a PowerShell download command (full ClickFix chain). Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'youngwestbury.org.uk']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--0002ad89-92c8-506c-9122-18022b0d70a7",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): ledtric.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'ledtric.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2bebbfe9-0393-5105-a917-02dddacd533d",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): studiocavalarisantos.com.br",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'studiocavalarisantos.com.br']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e26cb0f3-5348-5e76-9e75-aee4b9247ca3",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): beritaupdate360.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-05 to 2026-11-05 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'beritaupdate360.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--08cef2cc-fa7c-545d-953a-6e054d832a2c",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): atttowing.com.au",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-06 to 2026-11-06 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'atttowing.com.au']",
   "pattern_type": "stix",
   "valid_from": "2026-11-06T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5765ae8e-2ad5-5028-8815-45919340083a",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): aetsecurity.co.za",
   "description": "website serving a ClickFix lure (likely hacked); read its lure from a smart contract. Observed 2026-11-06 to 2026-11-06 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'aetsecurity.co.za']",
   "pattern_type": "stix",
   "valid_from": "2026-11-06T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f8ea1862-58ca-57ff-99fb-71772eb9b23e",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): gulfbridgerealtors.com",
   "description": "website serving a ClickFix lure (likely hacked); read its lure from a smart contract. Observed 2026-11-09 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'gulfbridgerealtors.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-09T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e99cd4e0-ce48-50b6-b31c-12b823e683ec",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): teespresso.com",
   "description": "website serving a ClickFix lure (likely hacked); read its lure from a smart contract. Observed 2026-11-09 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'teespresso.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-09T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3f4e44b0-31cc-56e5-900c-4b28f5a5093f",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): winncelo.com",
   "description": "website serving a ClickFix lure (likely hacked); the lure and a dangerous clipboard command in the same visit. Observed 2026-11-09 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'winncelo.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-09T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3deb510e-4cf6-5aaa-a6ea-d17e152c90d4",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): primedrivingschoolllc.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard. Observed 2026-11-09 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'primedrivingschoolllc.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-09T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--00a05e91-a335-5d4c-aff0-2ada5fca44dd",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): sabihaa.com",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-09 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'sabihaa.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-09T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--026ee3e2-6132-5b30-a7c1-6bbc7bb7f651",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "website serving a ClickFix lure (likely hacked): joliejaune.tn",
   "description": "website serving a ClickFix lure (likely hacked); put a command on the clipboard; read its lure from a smart contract. Observed 2026-11-09 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "compromised"
   ],
   "pattern": "[domain-name:value = 'joliejaune.tn']",
   "pattern_type": "stix",
   "valid_from": "2026-11-09T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7d26fcfe-8ed7-5f20-9665-77ba87e90d25",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "ClickFix lure page run by the attackers: claudeearlyaccess-fable.cfd",
   "description": "ClickFix lure page run by the attackers; fake Claude early-access page; domain about 24 days old when first seen. Observed 2026-11-05 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "malicious-activity"
   ],
   "pattern": "[domain-name:value = 'claudeearlyaccess-fable.cfd']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2d8ef957-62e1-5b62-b9fa-72e08f7a7914",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "ClickFix lure page run by the attackers: onchaindocfile.com",
   "description": "ClickFix lure page run by the attackers; fake document page; domain 3 days old when first seen. Observed 2026-11-05 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "malicious-activity"
   ],
   "pattern": "[domain-name:value = 'onchaindocfile.com']",
   "pattern_type": "stix",
   "valid_from": "2026-11-05T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5c9486d7-723b-5be6-a242-5570b7ce9fc3",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "ClickFix lure page run by the attackers: docsign.blog",
   "description": "ClickFix lure page run by the attackers; fake document-signing page; domain 4 days old when first seen. Observed 2026-11-06 to 2026-11-06 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "malicious-activity"
   ],
   "pattern": "[domain-name:value = 'docsign.blog']",
   "pattern_type": "stix",
   "valid_from": "2026-11-06T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--cae11231-a35d-57d8-80b1-78a37e6d793c",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "ClickFix lure page run by the attackers: maplezenith.live",
   "description": "ClickFix lure page run by the attackers; lure page; domain 12 days old when first seen. Observed 2026-11-09 to 2026-11-09 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "malicious-activity"
   ],
   "pattern": "[domain-name:value = 'maplezenith.live']",
   "pattern_type": "stix",
   "valid_from": "2026-11-09T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d636e1e9-5780-5539-93e8-940626850aa0",
   "created": "2026-11-12T19:26:02.000Z",
   "modified": "2026-11-12T19:26:02.000Z",
   "created_by_ref": "identity--37e8011d-7fb4-5e87-a536-3c90626ca649",
   "name": "ClickFix lure page run by the attackers: online.projectsupportik.top",
   "description": "ClickFix lure page run by the attackers; lure page behind a redirect; domain 20 days old when first seen. Observed 2026-11-11 to 2026-11-11 (UTC). ClickFix lure sites observed by ByteMantle research browsers, 5\u201311 November 2026 (UTC). A site is listed because it served the lure when we opened it; the owner may have cleaned it since. Own one of these sites and cleaned it? Write to info@bytemantle.com and we update the list.",
   "indicator_types": [
    "malicious-activity"
   ],
   "pattern": "[domain-name:value = 'online.projectsupportik.top']",
   "pattern_type": "stix",
   "valid_from": "2026-11-11T00:00:00.000Z",
   "labels": [
    "clickfix"
   ]
  }
 ]
}