Overlord remote-access tool control panels, including the 'TankRat' rebrand
Login pages of control panels for Overlord, an open-source remote-access tool whose Windows agent gives the operator live screen control on visible and hidden desktops, keystroke and clipboard capture, file and shell access and a SOCKS relay over a WebSocket channel. The panel's name, logo and colours are configurable. One operator runs it as 'TankRat', a Chinese-language login with an authenticator-code field, behind fake Malaysian tax-notice downloads that side-load a loader into signed Windows programs and fetch the agent from a code-hosting release. A match means a page built from the panel's login template, or a scan of a known panel host such as devin-us[.]com, fileserver.devin-hk[.]shop, viva-glade[.]shop, peelgroup[.]store, yesjob[.]life or cdn.fileserveronlineweb[.]com.
Anchors
favicon_hash:1708493336 OR favicon_hash:492611779 OR title:"TankRat" OR contacted_host:devin-us.com OR contacted_host:fileserver.devin-hk.shop OR contacted_host:viva-glade.shop OR contacted_host:peelgroup.store OR contacted_host:yesjob.life OR contacted_host:cdn.fileserveronlineweb.com OR ip:103.59.101.28 OR ip:85.137.60.92 OR ip:176.97.117.181 OR ip:213.111.157.107Provenance
Sightings (22)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| cdn.fileserveronlineweb.com | cea9eca4… | https://cdn.fileserveronlineweb.com/#html | rule | 2026-11-04 08:12 |
| cdn.fileserveronlineweb.com | cea9eca4… | — | query | 2026-11-04 08:12 |
| yesjob.life | 353543a5… | https://yesjob.life/#html | rule | 2026-11-04 08:12 |
| yesjob.life | 353543a5… | — | query | 2026-11-04 08:12 |
| peelgroup.store | e9a3c298… | https://peelgroup.store/#html | rule | 2026-11-04 08:12 |
| peelgroup.store | e9a3c298… | — | query | 2026-11-04 08:12 |
| viva-glade.shop | fc949694… | https://viva-glade.shop/#html | rule | 2026-11-04 08:12 |
| viva-glade.shop | fc949694… | — | query | 2026-11-04 08:12 |
| fileserver.devin-hk.shop | ef7d72b8… | https://fileserver.devin-hk.shop/#html | rule | 2026-11-04 08:12 |
| fileserver.devin-hk.shop | ef7d72b8… | — | query | 2026-11-04 08:12 |
| devin-us.com | 25dc1018… | https://devin-us.com/#html | rule | 2026-11-04 08:12 |
| devin-us.com | 25dc1018… | — | query | 2026-11-04 08:12 |
| server.tocher33.online#html | cb6660cc… | https://server.tocher33.online#html | rule | 2026-10-28 03:47 |
| server.tocher33.online | cb6660cc… | — | query | 2026-10-28 03:47 |
| fileserver.devin-hk.shop#html | 8d779c3e… | https://fileserver.devin-hk.shop#html | rule | 2026-10-14 23:09 |
| fileserver.devin-hk.shop | 8d779c3e… | — | query | 2026-10-14 23:09 |
| checkdomfilellc.us | b8125595… | https://checkdomfilellc.us/#html | rule | 2026-09-17 18:47 |
| checkdomfilellc.us | b8125595… | — | query | 2026-09-17 18:47 |
| overlord.milky1337.ru | 53c1b0d4… | https://overlord.milky1337.ru/#html | rule | 2026-09-14 00:47 |
| overlord.milky1337.ru | 53c1b0d4… | — | query | 2026-09-14 00:47 |
| voltexa.win | b0447b5d… | https://voltexa.win/#html | rule | 2026-09-13 03:47 |
| voltexa.win | b0447b5d… | — | query | 2026-09-13 03:47 |