Known malicious kitcriticalphishing

Fake 'AEGIS VPN' subscription page: phone number, card and CVC sent to Telegram, with the operator's questions relayed back live

family: aegis-vpn-telegram-relay-kit-2026-11

A fake 'AEGIS VPN' subscription page in Russian, priced in roubles, asks the visitor to sign in with a phone number before paying and then for the card number, expiry date and CVC. Each step is sent to the operators' Telegram bot straight from the visitor's browser, and the page keeps checking the bot for an answer: when an operator replies, the reply appears on the page as a 'question from the administrator' that the visitor has to answer, once after the phone number and again after the card details. That lets the operator ask for whatever confirmation the visitor has just received while it is still valid.

Anchors

Hunting ruleTelegram_Operator_Reply_Relay_Kit
SMQL queryrun
telegram_bot:9024409347 OR favicon_hash:-387710338 OR title:"AEGIS VPN — Премиум защита" OR contacted_host:vpnaegis.site OR contacted_host:www.vpnaegis.site OR contacted_host:vpnaegis2.site OR contacted_host:www.vpnaegis2.site OR contacted_host:sofel.site OR contacted_host:bugaltera-kilo.click OR ip:193.233.75.208

Provenance

Added: 2026-11-01 08:23
Matches the page's own code wherever it is served and whatever it is themed as: the browser-side loop that sends each step to Telegram and accepts replies only from the operators' accounts, together with the page's step screens. A leftover heading shows the same page was used before for an esports-themed lure. Also tracks the known hosts, the server they share, the bot, the page icon and the title. One copy was served over plain HTTP only; its HTTPS address shows a different site from the same server.

Sightings (9)Atom feed

HostScanScriptMatchScanned
vpnaegis.site2e403aa8…http://vpnaegis.site/#htmlrule2026-11-01 08:06
vpnaegis.site2e403aa8…—query2026-11-01 08:06
vpnaegis2.site4a8188ff…https://vpnaegis2.site/#htmlrule2026-11-01 08:03
vpnaegis2.site4a8188ff…—query2026-11-01 08:03
bugaltera-kilo.clickcee3416a…—query2026-11-01 08:03
vpnaegis.site473582ec…—query2026-11-01 08:03
sofel.site5d1a1d7a…—query2026-10-31 19:37
vpnaegis2.site9c256707…https://vpnaegis2.site/#htmlrule2026-10-31 19:36
vpnaegis2.site9c256707…—query2026-10-31 19:36