Skip to content
ClickFixReport
Every ClickFix campaign, on the record.

Domain on record

domain, shown defanged for safety: eemmbryequo dot shop

Attacker-controlledFirst seen 2024-09-18 · Last seen 2024-09-18

Ownership assessment

Set up by the attacker.

Our sources describe this domain as infrastructure created for the campaign, rather than a legitimate service that was broken into. No third party is harmed by its appearance in this record.

Blocking
This is the only class we consider safe to block outright, and the only class that appears in the blocklist export files.

Campaigns referencing this domain

Where this came from

  • Reported by Proofpoint on 2024-11-14

    Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape

    Recorded as domain, shown defanged for safety: eemmbryequo dot shop · Command and control · extracted by Machine-extracted, human-reviewed

    Read the original ↗ at Proofpoint

Observation timeline

This is every check we ran, including the ones that found nothing. The bands marked below are days on which we did not look. A gap is not a period of stability — it is an absence of evidence, and any figure derived from this series should be read as a sample rather than as continuous monitoring.

Checks
2
Days covered
2 of 13
Coverage
15%
Longest gap
11 days
  1. Unregisteredrdap

  2. 11 days not observed

    Unregisteredrdap

The series runs from 2026-08-10 to 2026-08-22. Nothing after that date has been checked, and this page makes no claim about it.

What to do with this

Recorded as attacker-controlled by the sources above. If you saw traffic to it, treat the originating host as having reached a ClickFix lure and work through the response steps for Windows or macOS.

Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.

Cite as

ClickFixReport, “eemmbryequo[.]shop”, indicator ID 1a217582-3a84-40d8-8d10-a81f45c8578b, retrieved 2026-08-07.

https://clickfixreport.com/domains/eemmbryequo.shop

Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.