Web threats
Every day Ohey loads the web's worst pages and records what attackers have put on them: fake checks, skimmers, spam, backdoors, phishing pages and the kits that run them.
32,869 sites in the last 30 days
ClickFix is a fake verification page injected into a legitimate website. It tells the visitor to paste a command into Windows Run or a terminal, and that command installs malware. Since 1 August we have matched ClickFix code on 58,468 sites.
27,405 sites in the last 30 days
EtherHiding is a loader technique that lets code on an infected website read its next script or address from a smart contract. Since 1 August we have matched EtherHiding code on 46,746 sites.
748 sites in the last 30 days
A fake browser update is a download lure injected into a compromised website. It selects visitors, replaces the page with an update prompt and asks them to run a file. Since 1 August we have matched fake-update code on 1,944 sites.
446 sites in the last 30 days
Web skimmers are scripts planted on compromised online stores. They read the real checkout fields or draw a fake payment form, then send the shopper's entries to a collector. Since 1 August we have matched web-skimmer code on 657 sites.
7,681 sites in the last 30 days
Phishing kits build fake sign-in, document and payment pages that collect what a visitor enters or relay it to a real service. Since 1 August we have matched phishing-kit code on 18,575 sites.
5,276 sites in the last 30 days
SEO spam uses a legitimate website to promote unrelated search results. Attackers inject hidden backlinks, remote link loaders or doorway-page code into the site. Since 1 August we have matched SEO-spam code on 7,412 sites.
1,298 sites in the last 30 days
Affiliate fraud uses injected scripts and deceptive pages to manufacture tracked visits, clicks or conversions. The code redirects visitors, opens hidden affiliate routes or turns ordinary controls into paid clicks. Since 1 August we have matched affiliate-fraud code on 2,122 sites.
820 sites in the last 30 days
PHP backdoors are files or injected hooks that give an attacker continued access to a website. They can expose a webshell, grant a WordPress administrator session, hide an account, log passwords or load more code. Since 1 August we have matched PHP-backdoor code on 1,134 sites.
446 sites in the last 30 days
Tech-support scams use fake security alerts and browser locks to press visitors into calling an attacker-supplied phone number. Compromised websites send visitors to the warning page through injected loaders and redirects. Since 1 August we have matched this code on 723 sites.
139 sites in the last 30 days
Wallet drainers use fake mint, payment, trading and wallet-repair pages to get visitors to sign away funds or permission to spend them. The page loads a script that connects the wallet and prepares the request. Since 1 August we have matched wallet-drainer code on 482 sites.
770 sites in the last 30 days
iOS exploit kits use browser vulnerabilities to attack iPhones through a website visit. Compromised pages carry hidden frames that load a router or dispatcher, which selects code for the visitor's device and iOS version. Since 1 August we have matched iOS exploit-kit code on 772 sites.
20 sites in the last 30 days
Fake software download sites copy the pages of free Windows tools on look-alike domains. Their Download buttons fetch a ZIP from a server the site looks up at click time, and the page then walks the visitor through extracting and running it. Since 1 August we have matched this code on 20 sites.
Threats with the most sites in the last 30 days first. Phishing kits and wallet drainers mostly run on sites the attackers set up; the other threats run on compromised websites. One site can carry more than one threat. The last column counts compromised websites recaptured at least 25 days after their first match, where there are at least 50.
| Threat | Last 30 days | All sites | New in October | Named kits | Still serving 25 days on |
|---|---|---|---|---|---|
| ClickFix | 32,869 | 58,468 | 16,499 | 59 | 83% of 22,877 |
| EtherHiding | 27,405 | 46,746 | 13,936 | 26 | 83% of 19,172 |
| Phishing kits | 7,681 | 18,575 | 9,974 | 29 | |
| SEO spam | 5,276 | 7,412 | 3,469 | 2 | 82% of 2,557 |
| Affiliate fraud | 1,298 | 2,122 | 946 | 5 | 78% of 622 |
| PHP backdoors | 820 | 1,134 | 218 | 3 | 91% of 565 |
| iOS exploit kits | 770 | 772 | 450 | 1 | |
| Fake browser updates | 748 | 1,944 | 131 | 1 | 81% of 819 |
| Web skimmers | 446 | 657 | 117 | 4 | 87% of 324 |
| Tech-support scams | 446 | 723 | 238 | 2 | 82% of 170 |
| Wallet drainers | 139 | 482 | 100 | 2 | |
| Fake software downloads | 20 | 20 | 2 | 1 |
The 10 kits on the most sites in the last 30 days, across every threat.
| Kit | Threat | Last 30 days | New in October | First match |
|---|---|---|---|---|
| LenAI | ClickFix | 8,598 | 5,230 | |
| ChainBite | ClickFix | 8,049 | 5,154 | |
| GzipGnaw | ClickFix | 2,944 | 1,016 | |
| OverlayWar | ClickFix | 2,694 | 1,575 | |
| LA02 | ClickFix | 1,764 | 1,528 | |
| DriveSurge | ClickFix | 1,598 | 459 | |
| SmartApeSG | ClickFix | 1,597 | 302 | |
| BranchHop | ClickFix | 1,460 | 918 | |
| BW panel | ClickFix | 1,357 | 596 | |
| MassCollect | Phishing kits | 1,311 | 4,603 |
Request a trial and we'll send you a live API key, with the same feed, removals and reasons a customer gets.