Known malicious kithighphishing
Webmail & brand credential-phishing kits (July 2026)
family: credential-phishing-kits-202607
Short link:scanmalware.com/h/145
Five credential-phishing hosts confirmed in July 2026: webmail/Poczta login clones on throwaway hosting (hfmthsga.vercel.app, pljnsad.vercel.app, mid-scarlet-rqxuosjc.edgeone.dev, pub-<hash>.r2.dev), plus meritking2542.com (MeritKing casino brand abuse). All render a password form whose action self-POSTs, uses javascript:, or posts to a blob with the target email embedded.
Anchors
SMQL queryrun
domain:hfmthsga.vercel.app OR domain:pljnsad.vercel.app OR domain:mid-scarlet-rqxuosjc.edgeone.dev OR domain:pub-1bae389293eb48d58e53398a6e375d75.r2.dev OR domain:meritking2542.comProvenance
Added: 2026-07-02 16:30
Sightings (37)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 5b080b4c… | — | query | 2026-10-23 10:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 3294400e… | — | query | 2026-10-16 09:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | b247ec6d… | — | query | 2026-10-09 08:50 |
| pljnsad.vercel.app | 0b91d62c… | — | query | 2026-10-02 07:51 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 5fe97fa7… | — | query | 2026-10-02 07:50 |
| hfmthsga.vercel.app | a427b669… | — | query | 2026-09-25 06:50 |
| pljnsad.vercel.app | d67ea385… | — | query | 2026-09-25 06:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | a99551f6… | — | query | 2026-09-25 06:50 |
| hfmthsga.vercel.app | ff8af660… | — | query | 2026-08-18 22:51 |
| pljnsad.vercel.app | 1b117a52… | — | query | 2026-08-18 20:51 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 82d5df0d… | — | query | 2026-08-18 19:51 |
| hfmthsga.vercel.app | cc68afc0… | — | query | 2026-08-07 12:50 |
| pljnsad.vercel.app | 90d298d1… | — | query | 2026-08-07 11:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 89c162aa… | — | query | 2026-08-07 11:50 |
| hfmthsga.vercel.app | 4e8a643f… | — | query | 2026-07-30 20:50 |
| pljnsad.vercel.app | bb600fc4… | — | query | 2026-07-30 19:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 88e15be6… | — | query | 2026-07-30 19:50 |
| hfmthsga.vercel.app | 87335576… | — | query | 2026-07-23 18:50 |
| pljnsad.vercel.app | 6999e124… | — | query | 2026-07-23 18:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 951241d3… | — | query | 2026-07-23 18:50 |
| hfmthsga.vercel.app | 86884d28… | — | query | 2026-07-16 17:50 |
| pljnsad.vercel.app | 5dd56d9d… | — | query | 2026-07-16 17:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 0cf177e8… | — | query | 2026-07-16 17:50 |
| hfmthsga.vercel.app | 08dce2d0… | — | query | 2026-07-09 16:50 |
| pljnsad.vercel.app | d87f9431… | — | query | 2026-07-09 16:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 5859852c… | — | query | 2026-07-09 16:50 |
| meritking2542.com | 60db5f30… | — | query | 2026-07-07 16:27 |
| meritking2542.com | fe10c47e… | — | query | 2026-07-06 01:46 |
| meritking2542.com | d4942850… | — | query | 2026-07-04 04:28 |
| mid-scarlet-rqxuosjc.edgeone.dev | 3fa6b132… | — | query | 2026-07-03 07:35 |
| meritking2542.com | 4eb05898… | — | query | 2026-07-02 18:38 |
| hfmthsga.vercel.app | 27863ea6… | — | query | 2026-07-02 15:50 |
| pljnsad.vercel.app | ae43a5b3… | — | query | 2026-07-02 15:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 5f767023… | — | query | 2026-07-02 15:50 |
| meritking2542.com | 830b0659… | — | query | 2026-07-02 15:14 |
| meritking2542.com | 5c434aca… | — | query | 2026-07-02 14:09 |
| mid-scarlet-rqxuosjc.edgeone.dev | 429a0ee1… | — | query | 2026-07-02 14:03 |