Known malicious kithighother
Miku / Singapore VPS operator — open-directory tooling file names (OCR)
family: infrahunter-sg-vps-miku-2026-08
Any directory listing ('Directory listing for' or 'Index of /') whose screenshot OCR shows one of the operator's distinctive file names: ulneurls (list of webhook-accepting New API targets), succeaccounts (confirmed fraud accounts), ffuf443 (ffuf output), fscanx (fscan variant directory) or freshen (from freshen_socks5.py, the SOCKS5 proxy-pool refresher). This row keeps matching after an IP change; the ip: row does not.
Anchors
SMQL queryrun
(title:"Directory listing for" OR title:"Index of /") AND (ocr:ulneurls OR ocr:succeaccounts OR ocr:ffuf443 OR ocr:fscanx OR ocr:freshen)Provenance
Added: 2026-09-14 09:13
Matches on text read from the screenshot, not on the listing's links. Screenshot text recognition drops underscores (a capture read 'freshen _socks5.py' and 'glider socks5.conf'), so the terms are underscore-free fragments; succeaccounts is included in case a future capture is sharper. 'freshen' is generic on its own, which is why the directory-listing title is required. The operator names these files, so this entry survives a server move, though a listing too long to fit the screenshot can hide the names. The YARA entry in this family matches the listing HTML directly.