← Back to SOC feed Coverage →

ThreatFox: ClearFake IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
iocjs-clearfakethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-02T23:00:00Z · Confidence: high

Hunt Hypothesis

This hunt targets adversary activity linked to the ClearFake campaign by correlating network and endpoint telemetry against a curated set of 36 specific Indicators of Compromise (IOCs). Proactively searching for these signals in Azure Sentinel is critical because ClearFake’s high-severity footprint often indicates sophisticated initial access or lateral movement that may evade standard signature-based detections.

IOC Summary

Malware Family: ClearFake Total IOCs: 36 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domaingbbzsnq[.]1xgame.cashpayload_delivery2026-07-02100%
domain1xgame.cashpayload_delivery2026-07-02100%
domainejjfjm2l.vip1xbet.netpayload_delivery2026-07-02100%
domainpmaumei[.]1xgame.betpayload_delivery2026-07-02100%
domain1xgame.betpayload_delivery2026-07-02100%
domaintearmbdo.bet1forward.compayload_delivery2026-07-02100%
domainqlrjloxh.jozve.onepayload_delivery2026-07-02100%
domainjozve.onepayload_delivery2026-07-02100%
domaingold-land-8.vortex-sys.in.netbotnet_cc2026-07-0290%
domainbetwinner.betpayload_delivery2026-07-02100%
domainflhrpdn.yekbetkade.compayload_delivery2026-07-02100%
domainyekbetkade.compayload_delivery2026-07-02100%
domainrfedpuuc.falsafekonkour.sitepayload_delivery2026-07-02100%
domainnoir-5.vortex-sys.in.netbotnet_cc2026-07-0290%
domainlbftpzh.takbetkade.compayload_delivery2026-07-02100%
domainmlvgwjn[.]1xforward.propayload_delivery2026-07-02100%
domain1xforward.propayload_delivery2026-07-02100%
domain926ikjry.euroyek.biopayload_delivery2026-07-02100%
domainid10ixg6[.]1x1bet.cashpayload_delivery2026-07-02100%
domain1x1bet.cashpayload_delivery2026-07-02100%
domainaqjyrpm[.]1xforward.orgpayload_delivery2026-07-02100%
domain1xforward.orgpayload_delivery2026-07-02100%
domainfsaxdfy0.hit4.betpayload_delivery2026-07-02100%
domainhit4.betpayload_delivery2026-07-02100%
domainfast-zeit-2.vortex-sys.in.netbotnet_cc2026-07-0290%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["gbbzsnq.1xgame.cash", "1xgame.cash", "ejjfjm2l.vip1xbet.net", "pmaumei.1xgame.bet", "1xgame.bet", "tearmbdo.bet1forward.com", "qlrjloxh.jozve.one", "jozve.one", "gold-land-8.vortex-sys.in.net", "betwinner.bet", "flhrpdn.yekbetkade.com", "yekbetkade.com", "rfedpuuc.falsafekonkour.site", "noir-5.vortex-sys.in.net", "lbftpzh.takbetkade.com", "mlvgwjn.1xforward.pro", "1xforward.pro", "926ikjry.euroyek.bio", "id10ixg6.1x1bet.cash", "1x1bet.cash", "aqjyrpm.1xforward.org", "1xforward.org", "fsaxdfy0.hit4.bet", "hit4.bet", "fast-zeit-2.vortex-sys.in.net", "uusqctu.eurojet.pro", "eurojet.pro", "v1rsowak.xbetone.com", "dedzwcx.enfejarbahis.com", "lsyhgfl.enfejarbahis.com", "enfejarbahis.com", "fmpdxnv.enfejar.poker", "lseczri.enfejar.poker", "gejrdcu.enfejar.poker", "pnz8cbiq.vip1xbet.org", "gold-star-4m.public-shoot.in.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/js.clearfake/