Indicators of Compromise

URL

TLP:CLEAR

https://cafcanadasupport.ca/core/client/rbcroyal/

OpenPhish: https://cafcanadasupport.ca/core/client/rbcroyal/

80% confidence

Added

2026-08-12

URL

TLP:CLEAR

https://www.mouvementacced.app/core/client/rbcroyal/

OpenPhish: https://www.mouvementacced.app/core/client/rbcroyal/

80% confidence

Added

2026-08-11

Domain

TLP:CLEAR

partiroyaliste.fr

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

https://mydrive.effem.com/:p:/g/personal/lillian_or_royalcanin_com/IQCJiGo1AoG-S4l-bvBisvdOAXjF7MCOc8gOFskKNmYcSjg

PhishTank: https://mydrive.effem.com/:p:/g/personal/lillian_or_royalcanin_com/IQCJiGo1AoG-S4l-bvBisvdOAXjF7MCOc...

90% confidence

Added

2026-08-08

Domain

TLP:CLEAR

royalcollectioncigars.com

ThreatFox: IClickFix

85% confidence

Added

2026-08-05

URL

TLP:CLEAR

https://mandelaroyals.com

PhishTank: https://mandelaroyals.com

90% confidence

Added

2026-08-05

URL

TLP:CLEAR

https://royal-breeze-dc21.piecestrengthen3327.workers.dev/

ThreatFox: ValleyRAT

85% confidence

Added

2026-08-03

Domain

TLP:CLEAR

royalblacktours.com

ThreatFox: IClickFix

85% confidence

Added

2026-08-01

Domain

TLP:CLEAR

theroyalpizza.com

ThreatFox: ClearFake

85% confidence

Added

2026-07-31

Domain

TLP:CLEAR

joodwh.theroyalpizza.com

ThreatFox: ClearFake

85% confidence

Added

2026-07-31

Domain

TLP:CLEAR

bistroroyal.se

ThreatFox: IClickFix

85% confidence

Added

2026-07-30

Domain

TLP:CLEAR

maharajaroyal.com

ThreatFox: ClearFake

65% confidence

Added

2026-07-27

Domain

TLP:CLEAR

pakroyalgroup.com

ThreatFox: ClearFake

65% confidence

Added

2026-07-26

Domain

TLP:CLEAR

royalfluffyfrenchies.com

ThreatFox: ClearFake

65% confidence

Added

2026-07-26

Domain

TLP:CLEAR

muffinroyalpack.com

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

muffinroyalpack.com

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

www1-royalbank.com-get-verify.info

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

www1-royalbank.com-get-verify.info

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

royaldumps.tw

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

royaldumps.cm

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

royaldumps.tw

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

royaldumps.cm

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

m4jpiubh.royaldoorsspringdale.com

ThreatFox: ClearFake

85% confidence

Added

2026-07-19

Domain

TLP:CLEAR

royaldoorsspringdale.com

ThreatFox: ClearFake

85% confidence

Added

2026-07-19

Domain

TLP:CLEAR

egvmu-ejrp-8rmc.royalbase3.workers.dev

70% confidence

Added

2026-07-14

Domain

TLP:CLEAR

proroyalty.com

ThreatFox: Unknown Loader

85% confidence

Added

2026-07-12

URL

TLP:CLEAR

https://proroyalty.com/

ThreatFox: Unknown malware

85% confidence

Added

2026-07-12

Domain

TLP:CLEAR

royallegacy.co.za

ThreatFox: Unknown Stealer

85% confidence

Added

2026-07-12

Domain

TLP:CLEAR

royalflush168.com

ThreatFox: Unknown Stealer

85% confidence

Added

2026-07-12

Domain

TLP:CLEAR

royalshart.bet

ThreatFox: ClearFake

85% confidence

Added

2026-07-12

Domain

TLP:CLEAR

xz1aa7xc.royalshart.bet

ThreatFox: ClearFake

85% confidence

Added

2026-07-12

Domain

TLP:CLEAR

streetfleshroyalgaming.top

ThreatFox: magecart

85% confidence

Added

2026-05-28

Domain

TLP:CLEAR

eng.lionroyaltourisme.com

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

royaltoursvacations.com

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

royaltyworld.org

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

royaltyhubprinting.com

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

royalmesh.in

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

royalaigle.fr

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

chanzroyaltyfashion.net

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

royalkimons.com

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

thayamkeryroyalinn.in

ThreatFox: Vidar

85% confidence

Added

2026-05-14

URL

TLP:CLEAR

http://plantsroyal.org/css/salomon.rar

MISP: http://plantsroyal.org/css/salomon.rar

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://plantsroyal.org/css/parken.rar

MISP: http://plantsroyal.org/css/parken.rar

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://plantsroyal.org/css/pibody.rar

MISP: http://plantsroyal.org/css/pibody.rar

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://plantsroyal.org/css/dina.rar

MISP: http://plantsroyal.org/css/dina.rar

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://plantsroyal.org/css/dissa.rar

MISP: http://plantsroyal.org/css/dissa.rar

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://plantsroyal.org/css/papalore.rar

MISP: http://plantsroyal.org/css/papalore.rar

50% confidence

Added

2026-05-06

Domain

TLP:CLEAR

plantsroyal.org

MISP: plantsroyal.org

50% confidence

Added

2026-05-06

Domain

TLP:CLEAR

rf.uofahtheroyalforums.net

September hostname

40% confidence

Added

2026-05-06

Domain

TLP:CLEAR

ff9os.uofahtheroyalforums.net

September hostname

40% confidence

Added

2026-05-06