TITAN iOS exploit panel: routes iPhones to the Coruna or DarkSword exploit chain (iOS stealer)

Content anchors: a hunting rule on the router's structure (the two iOS version windows, the chain names it routes to, the /go frame and the visit report), not on the TITAN name, so a renamed copy still matches; and the structural hash of the router script, which survives renamed variables and reformatting. The exploit stages themselves (the DarkSword loader, its remote-code-execution module and worker, and the post-exploitation collectors) are matched by a separate rule for the DarkSword exploit kit, which covers every deployment of that code. Search anchor (tracking only): the panel title, its icon and the server address 62.182.84[.]123. The rest of the panel's indicators, including its upload ports, are shared through threat-intelligence channels rather than listed here. Desktop browsers see only the router page and, on port 8080, the first DarkSword stages; the data-stealing stage is fetched only by a vulnerable iPhone.