GCVE-110-OSM-2026-5903

This package is an operational traffic-cloaking client designed to serve different content to real users versus crawlers/reviewers — a core technique in malicious ad fraud, phishing, and policy-bypass campaigns. The entrypoint POSTs a detailed visitor fingerprint (IP, user-agent, referrer, Cloudflare headers, full URL) to `http://api.clofilter.com/v1/check` with a hardcoded `companyId: '68cbc150080b2f950e969371'`, indicating active use by a specific operator. The API response then drives redirect, iframe injection, or remote HTML loading decisions — the canonical attacker model is showing a clean 'white page' to bots/ad reviewers while delivering a phishing or malvertising page to real victims. The publisher's portfolio includes `uniswapintefrace` (a one-character typosquat of a major DeFi protocol), which strongly indicates this publisher operates in the crypto-theft/phishing space. Four versions were published in under 7 minutes from an 8-day-old account with no repository, consistent with rapid iteration on a live attack tool. ENTRY index.js (main: index.js) EXFIL - Data Encoding for Exfiltration in index.html: "encodeURIComponent(document.referrer" ADDITIONAL FINDINGS - Rapid Version Publishing PAYLOAD FILES index.html INDICATORS (IOCs) - urls: http://api.clofilter.com/v1/check - domains: api.clofilter.com - payloadFileHash: dfb7eb469710d9235e4a98b1911b8eaef9d09a4e12eb3016d18bc0efe3d11605