Known malicious kithighother
J365 Gambling Platform — gui-base.js
family: j365-gambling-platform
Short link:scanmalware.com/h/2
Chinese-language illegal online-gambling platform served from a rotating set of brand-prefixed landing domains (j365*.xyz, lvs*.vip, hgty*.vip, hg*.vip, usdbetvip*.biz, xpj*.com — including punycoded variants) backed by a small set of operator CDN hosts on pham.xin and yqdkrj.com under the path /ftl/commonPage/. Offers fish-shooter, casino, sports, chess games. gui-base.js is the kit's shared UI framework.
Anchors
Provenance
Added: 2026-05-26 13:17
Anchor #1 of 3 for the family. Seen on da3b55/dxext9/huf5as/jn5ec4.pham.xin and 2hsuoj.yqdkrj.com. Zero leakage to legitimate hosts in the corpus.
Sightings (12)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| dxext9.pham.xin | b41463be… | https://dxext9.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-05-12 01:00 |
| 2hsuoj.yqdkrj.com | 8afd8d88… | https://2hsuoj.yqdkrj.com/ftl/commonPage/js/gui-base.js | byte | 2026-05-08 20:18 |
| jn5ec4.pham.xin | d73884d6… | https://jn5ec4.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-28 08:10 |
| dxext9.pham.xin | 544f622c… | https://dxext9.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-26 15:34 |
| huf5as.pham.xin | 262d732b… | https://huf5as.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-23 21:31 |
| da3b55.pham.xin | 62dfa3a5… | https://da3b55.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-23 20:04 |
| da3b55.pham.xin | 6c31dc8b… | https://da3b55.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-23 19:25 |
| da3b55.pham.xin | 635fc42f… | https://da3b55.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-23 17:40 |
| huf5as.pham.xin | 6fe623fd… | https://huf5as.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-23 15:55 |
| da3b55.pham.xin | 3f2ed933… | https://da3b55.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-23 15:10 |
| 2hsuoj.yqdkrj.com | 3f1a24b1… | https://2hsuoj.yqdkrj.com/ftl/commonPage/js/gui-base.js | byte | 2026-04-23 10:31 |
| da3b55.pham.xin | e8318d6c… | https://da3b55.pham.xin/ftl/commonPage/js/gui-base.js | byte | 2026-04-23 02:49 |