Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Check Point Research uncovered¹ a large-scale operation that impersonated open-source and freeware projects to capture search traffic. The convincing fake project portals loaded a CloudFront-hosted JavaScript staging layer that rerouted download clicks into a strictly gated traffic distribution system (TDS). Downstream redirect chains then steered selected users to malware delivery infrastructure for RemusStealer, AnimateClipper, and the SessionGate framework.
The original analysis publicized 27 network IoCs. Aided by the WhoisXML API MCP Server², we investigated 30 IoCs—eight subdomains, 19 domains, and three IP addresses—after extracting the unique apex domains from the subdomain IoCs and running domain legitimacy and activity checks.
96
Original IoCs Analyzed
Domain and IP indicators from the reported campaign
Key Findings
348
Email-connected domains
186
Additional IP addresses
728
String-connected domains
320
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Domain IoC legitimacy check
- Client traffic and typosquatting analysis
- Domain IoC WHOIS and DNS history analysis
- Email-connected domain discovery
- IP and IP-connected domain discovery
- String-connected domain discovery
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/
- [2] https://main.whoisxmlapi.com/ai/mcp-server