Domain on record
domain, shown defanged for safety: gl dot at dot ply dot gg
Ownership assessment
A shared platform, not a single owner.
This host serves many unrelated customers — a site builder, a paste service, a file host or similar. One customer’s content was used in a ClickFix campaign. The platform operator is not the attacker, and the overwhelming majority of what this host serves is legitimate.
Blocking
Do not block at the host level. Block the exact path or URL that was reported; a host-level block takes out everything else the platform serves.
Campaigns referencing this domain
Where this came from
Reported by Securonix Threat Research on 2025-03-12
Analyzing OBSCURE#BAT: Threat Actors Lure Victims into Executing Malicious Batch Scripts to Deploy Stealthy Rootkits
Recorded as domain, shown defanged for safety: gl dot at dot ply dot gg · Command and control · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this domain. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the domain is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Report the content through the platform’s own abuse process: the operator can remove it, which a block cannot. If you block anything, block the reported path and not the domain.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “gl[.]at[.]ply[.]gg”, indicator ID f57a0766-2142-4ad9-99f4-8f4db1509154, retrieved 2026-08-29.
https://clickfixreport.com/domains/gl.at.ply.gg
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.