Message Trace - amos-stealer-fake-claude-code.annotated

visualether · explore

amos-stealer-fake-claude-code.annotated

Sequence Diagram

💻 Victim Mac

🔁 DNS resolver

📢 Ad redirect (uerp)

🎣 Fake Claude Code site

📦 Payload host (lake-90)

📈 Tracker (loop-88)

🚨 AMOS stealer C2

📦 Stage-2 host (delta-canvas)

🔐 Cloudflare DoH

🚪 Backdoor C2

💱 Clipper C2

F2

F4

F9

F38

F40

F42

F76

F1075

F1108

F1767

F1768

F1772

F1802

F1806

F1807

F1822

F2885

F2962

F2964

F2973

F2977

F2981

F2986

F2989

F2995

F2998

F3002

F3007

F3015

F3017

F3021

F3027

F3036

F3151

F3157

F3159

F3166

F3250

F3255

F3259

F6295

F7668

F7671

F7672

F7678

F8166

F8272

F8273

F8277

F8587

F8754

F8771

F8778

F8779

F8781

F8807

F8836

F8838

F8846

F8850

F27874

F27876

F27878

F27884

F27886

Message Details

g/G top/bottom │ PgUp/PgDn messages │ c collapse all │ click field name to copy ready