Known malicious kitcriticalphishing
Microsoft 365 alert-mail phishing: Cloudflare Tunnel "fail" gate and university-named hosts
family: ms365-alert-mail-failgate-2026-10
Short link:scanmalware.com/h/320
Phishing links that arrived inside genuine Microsoft 365 alert e-mails pointed to shared-cloud-manager[.]folio[.]io[.]vn, a host served through a Cloudflare Tunnel. The kit filters its visitors: anyone it rejects receives HTTP 403 and a small "Loading ..." page with a visually hidden "fail" heading over a full-page frame of an unrelated news site, so no lure is shown. The same operator runs hostnames named after universities under free .io.vn, .id.vn and .web.id names and on two origin servers, 103.253.42[.]155 and 5.181.3[.]204, which answer every path with a decoy page titled "Advanced Team Full Page". This hunt matches the gate's reject page by its structure, and tracks the decoy page, the operator's domains and the two origin servers.
Anchors
YARA ruleFailGate_Iframe_Decoy_Kit
SMQL queryrun
yara_rule:AdvancedTeam_Origin_Iframe_Decoy OR title:"Advanced Team Full Page" OR domain:*.folio.io.vn OR domain:*.cycus.id.vn OR domain:*.overtech.web.id OR domain:*.calendarsharingsafesharingcasereview.org OR contacted_host:shared-cloud-manager.folio.io.vn OR contacted_host:isegypt.bwa.biz.id OR contacted_host:alarming.avrelectric.com OR ip:103.253.42.155 OR ip:5.181.3.204Provenance
Added: 2026-10-29 19:21
Active since July 2026. The gate shows its lure only to visitors who arrive with a valid link, so a capture of these hosts is either the reject page or the decoy. The decoy page alone is weaker evidence than the gate page, since a third party could serve the same page, so it is tracked here rather than used as a detector. Several of the operator's hostnames are subdomains added to unrelated third-party domains; those are not listed. The two origin addresses are rented servers and may later pass to other tenants.
Sightings (8)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| shared-cloud-manager.folio.io.vn | 20a0f76d… | — | query | 2026-10-29 19:33 |
| shared-cloud-manager.folio.io.vn | 20a0f76d… | https://shared-cloud-manager.folio.io.vn/#html | yara | 2026-10-29 19:33 |
| shared-cloud-manager.folio.io.vn | 20a0f76d… | https://shared-cloud-manager.folio.io.vn/ | yara | 2026-10-29 19:33 |
| alarming.avrelectric.com | 0fd1e2f8… | — | query | 2026-10-29 16:49 |
| uteedu.cycus.id.vn | 6e9d1456… | — | query | 2026-10-29 16:49 |
| shared-cloud-manager.folio.io.vn | a80a92d1… | https://shared-cloud-manager.folio.io.vn/#html | yara | 2026-10-29 16:49 |
| shared-cloud-manager.folio.io.vn | a80a92d1… | — | query | 2026-10-29 16:49 |
| badshamart.com | 57630065… | — | query | 2026-07-01 16:18 |