ScanMalware.com
Known malicious kithighother

J365 Gambling Platform — CometMarathon.js

family: j365-gambling-platform
Short link:scanmalware.com/h/4

Long-poll companion to Comet.js — secondary WebSocket channel used by the J365 illegal-gambling platform.

Anchors

content sha256e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf
canonical AST28055543dc238a25163b5899996f0174e5c641c2e88e84a140f573a69b465d96
TLSHT1FB42424B6CF75081592B32B50F9F24447239D8572605E81C7DCCAAE08F98B6C1B6BFB8

Provenance

Added: 2026-05-26 13:17
Anchor #3 of 3. Companion to Comet.js. Zero leakage outside the kit CDN.

Sightings (12)Atom feed

HostScanScriptMatchScanned
dxext9.pham.xinb41463be…https://dxext9.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-12 01:00
2hsuoj.yqdkrj.com8afd8d88…https://2hsuoj.yqdkrj.com/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-08 20:18
jn5ec4.pham.xind73884d6…https://jn5ec4.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-28 08:10
dxext9.pham.xin544f622c…https://dxext9.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-26 15:34
huf5as.pham.xin262d732b…https://huf5as.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-23 21:31
da3b55.pham.xin62dfa3a5…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-23 20:04
da3b55.pham.xin6c31dc8b…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-23 19:25
da3b55.pham.xin635fc42f…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-23 17:40
huf5as.pham.xin6fe623fd…https://huf5as.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-23 15:55
da3b55.pham.xin3f2ed933…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-23 15:10
2hsuoj.yqdkrj.com3f1a24b1…https://2hsuoj.yqdkrj.com/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-23 10:31
da3b55.pham.xine8318d6c…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-04-23 02:49