URLhaus Database

You are currently viewing the URLhaus database entry for https://jhculxyr.tires8f.in.net/verification.google which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3804995
URL: https://jhculxyr.tires8f.in.net/verification.google
URL Status:Offline
Host: jhculxyr.tires8f.in.net
Date added:2026-03-25 19:20:12 UTC
Last online:2026-03-26 22:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Abused domain (malware)
SURBL :Not blocked
Quad9 :Blocked
AdGuard :Blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter:Anonymous
Abuse complaint sent (?): Yes (2026-03-25 19:21:11 UTC to abuse{at}cloudflare[dot]com)
Takedown time:1 day, 2 hours, 57 minutes Poor (down since 2026-03-26 22:18:56 UTC)
Tags:ACRStealer ClearFake

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-03-26verification.googledll 69df8847cabe02123eab3c6a1b59afdfac69f18ed532dfce9e6bac86d9513778n/a ACRStealer
2026-03-26verification.googledll 175f0283fe5a7d80c8123e76255dff878544d1f39c112e13d40932c2ce4d1cc4n/a ACRStealer
2026-03-26verification.googledll 70fc8adce4713cd8c8fddea101108c29d7e0d852b725eea8d3821ff7c8b3d89an/a ACRStealer
2026-03-26verification.googledll 62bc3b3b492cf8a588318fd83643d59486b10d45bd858b1d9beeca627af18bacn/a ACRStealer
2026-03-25verification.googledll aa0477d535a2034192f0206216f86abf01d6a72f38490aed4d9b3cacde70a0a8n/aACRStealer