Known malicious kithighother
UTA0565 — spoofed media and NGO sites delivering the Chrome/Windows 0-day chain
family: uta0565-chrome-0day-2026-09
Short link:scanmalware.com/h/201
Domains published by Volexity for UTA0565, a Chinese threat actor that used chained Google Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) zero-days in early September 2026. Phishing emails linked to look-alike sites (americanprgoress[.]top, chinadigitaltimes[.]top, borneobulletins[.]top) that show the real site's content and load the exploit kit in a hidden iframe (/config.html, title site-config). The payload, CLEANGULP, calls back over HTTP to thecovnresation[.]com.
Anchors
SMQL queryrun
domain:americanprgoress.top OR domain:chinadigitaltimes.top OR domain:borneobulletins.top OR domain:thecovnresation.com OR domain:thecovnresation.net OR domain:personclouds.com OR domain:outsourcingwise.net OR domain:halal-navi.net OR domain:halaltak.net OR contacted_host:americanprgoress.top OR contacted_host:chinadigitaltimes.top OR contacted_host:borneobulletins.top OR contacted_host:thecovnresation.com OR contacted_host:thecovnresation.net OR contacted_host:personclouds.com OR contacted_host:outsourcingwise.net OR contacted_host:halal-navi.net OR contacted_host:halaltak.netProvenance
Added: 2026-09-23 15:19
Matches a page scanned directly on one of these exact domains, or any page that requested one. Includes the five domains Volexity linked by registration pattern at medium confidence (personclouds.com, outsourcingwise.net, halal-navi.net, halaltak.net, thecovnresation.net). Exact hostnames only; the legitimate sites they imitate are not matched.
Sightings (0)Atom feed
No sightings recorded yet.