Known malicious kithighphishing
btbuu Fake Crypto Exchange — kline.min.js
family: btbuu-fake-crypto-exchange
Fake crypto-derivatives exchange kit. Operator-deployed K-line / Contract / Trade UI across btbuu.com, wbitx.cfd, trade-maxs.com, evergreen-capital.org. Path pattern /Public/Static/js/*, page pattern /Contract/index, /Trade/index?type=buy&symbol=*. Earlier sweep had bounced on the kit's pako.min.js (real zlib library) — these are the operator-specific files.
Fingerprint anchors
Provenance
Added by: analyst
Added: 2026-05-26 14:39
Anchor #1 of 2. kline.min.js — operator-specific K-line chart code, 12,655 nodes.
Sightings (10)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| wbitx.cfd | 96bbc667… | https://wbitx.cfd/Public/Static/js/kline.min.js | byte | 2026-05-24 22:59 |
| wbitx.cfd | 2f746098… | https://wbitx.cfd/Public/Static/js/kline.min.js | byte | 2026-05-24 22:51 |
| wbitx.cfd | 9d3c53b7… | https://wbitx.cfd/Public/Static/js/kline.min.js | byte | 2026-05-24 22:31 |
| wbitx.cfd | d5a15786… | https://wbitx.cfd/Public/Static/js/kline.min.js | byte | 2026-05-24 21:58 |
| trade-maxs.com | fb92d2c9… | https://trade-maxs.com/Public/Static/js/kline.min.js | byte | 2026-05-24 16:10 |
| trade-maxs.com | 4799538d… | https://trade-maxs.com/Public/Static/js/kline.min.js | byte | 2026-05-24 15:30 |
| evergreen-capital.org | d6791f0f… | https://evergreen-capital.org/Public/Static/js/kline.min.js | byte | 2026-05-24 06:54 |
| trade-cex.com | ee525377… | https://trade-cex.com/Public/Static/js/kline.min.js | structure | 2026-05-24 01:18 |
| btbuu.com | 801bdf96… | https://btbuu.com/Public/Static/js/kline.min.js | byte | 2026-05-23 16:31 |
| btbuu.com | 82af296c… | https://btbuu.com/Public/Static/js/kline.min.js | byte | 2026-05-23 08:29 |