URLhaus Database

You are currently viewing the URLhaus database entry for https://c0nvoy5-field.codcomparable.in.net/verification.google which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3809185
URL: https://c0nvoy5-field.codcomparable.in.net/verification.google
URL Status:flame Online (spreading malware for 1 day, 9 hours, 47 minutes)
Host: c0nvoy5-field.codcomparable.in.net
Date added:2026-03-31 13:31:26 UTC
Threat:Malware download Malware download
URLhaus blocklist:Blocked
Spamhaus DBL :Abused domain (malware)
SURBL :Blocked
Quad9 :Blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter:Anonymous
Abuse complaint sent (?): Yes (2026-04-01 10:00:18 UTC to abuse{at}cloudflare[dot]com)
Tags:ACRStealer ClearFake

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-04-01verification.googledll 74f82374074f0f3fd8e66c9b25ccf068aadb5f38217f7bce7384a614207dbe7cn/a ACRStealer
2026-04-01verification.googledll dd4ce1513732440da10a37042fc4d6ae082cc919b31c03dee7d56ea7076db3c8n/a ACRStealer
2026-04-01verification.googledll 9da0a2d5d86790d615e32d54870656a7917f515c1a44ca2849c2c3e704b0286bn/aACRStealer
2026-04-01verification.googledll 68e47e20011cd303284737ff3cdba23527ecaa2a39df924edd2e749291c80f11n/aACRStealer
2026-03-31verification.googledll 147b20174a0c78fc72b79ca1f78130f601097771d75ae8bf8b173db47d7da199n/aACRStealer
2026-03-31verification.googledll d1fffe10c5413fd0c5d3e9026b8edff1a6864ca5b9efde1bc47bd2bb16e6a16an/a ACRStealer
2026-03-31verification.googledll 2bfd69fbbdb76955490233d563a559c70f172c10d60fced20461d6bdc88cac80n/a ACRStealer