ScanMalware.com
Known malicious kithighphishing

Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor)

family: turnstile-gate-kit-202609

A fake Cloudflare challenge served by the phishing kit itself (HTTP 200, no cf-mitigated header): the kit renders its own Turnstile widget and, on success, auto-submits a POST form with id cfForm (callback verifyCallback_CF) back to itself, which only then serves the credential page. Automated visitors that cannot pass the gate only ever see this page. Matched by a YARA rule on the page HTML.

Anchors

YARA ruleTurnstile_Gate_Kit_cfForm

Provenance

Added: 2026-09-17 08:07
Condition: id="cfForm" AND verifyCallback_CF AND the Turnstile script, file size under 64 KB. Never Turnstile or the title alone, which would also match legitimate sites. Tested against recent captures of thousands of hosts, including Turnstile pages and 'Just a moment' titles: it matched only confirmed kit hosts.

Sightings (77)

HostScanScriptMatchWhen
5eb23635.lodasaf228.workers.dev7bb26019…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-10-01 08:54
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev5f9e7dda…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-10-01 07:55
fc2617cf.4346164a315335d9f00d2c36.workers.devd9981f44…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-10-01 07:55
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev2dfdebc0…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-10-01 07:54
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev0f17cf01…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-10-01 07:54
flat-base-63d9.fr1ilt.workers.dev31b454d9…https://flat-base-63d9.fr1ilt.workers.dev/jtFQ3exWXBuZqo1IPc2z/DZR9jteug0/ioYRaffOe0authgen/0zBY7n7/jtFQ3exWXBuZqo1IPc2z/victim/GkwlZ9/example.com/jtFQ3exWXBuZqo1IPc2zDZR9jteug0#htmlyara2026-09-29 12:46
c9e059a1.73634c9b2b1a997bd44876e7.workers.dev471d1cbd…https://c9e059a1.73634c9b2b1a997bd44876e7.workers.dev/#htmlyara2026-09-29 04:55
642395e2.73634c9b2b1a997bd44876e7.workers.deve5012a80…https://642395e2.73634c9b2b1a997bd44876e7.workers.dev/#htmlyara2026-09-29 03:55
3147459c.92ea2438071f378d2627edbe.workers.dev6f5f9874…https://3147459c.92ea2438071f378d2627edbe.workers.dev/#htmlyara2026-09-29 01:54
7ddce2d9.7fc087fbd273b757485ac4d5.workers.dev3eff6ef6…https://7ddce2d9.7fc087fbd273b757485ac4d5.workers.dev/#htmlyara2026-09-28 00:55
52f1897b.5648702dd4d5255cab645104.workers.dev731d3318…http://52f1897b.5648702dd4d5255cab645104.workers.dev/#htmlyara2026-09-26 18:53
5eb23635.lodasaf228.workers.dev778b9dfd…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-24 07:52
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev8f8147f7…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-24 06:54
fc2617cf.4346164a315335d9f00d2c36.workers.devb4fae47b…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-24 06:53
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev36d39aa0…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-24 06:53
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev8f4d33a5…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-24 06:52
karrasconsulting.net88c8b96f…https://karrasconsulting.net/instqll/adobe#htmlyara2026-09-20 00:48
1f43a3e4.57b79ffb3043f32930fb5bee.workers.devad554a04…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:08
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev9d126b8a…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:08
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev9b648bc5…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:08
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev0868424d…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:08
5eb23635.lodasaf228.workers.devc005b789…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:08
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev6cbda942…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:08
fc2617cf.4346164a315335d9f00d2c36.workers.dev061470c0…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:08
1f43a3e4.57b79ffb3043f32930fb5bee.workers.devf89850e2…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:08
5eb23635.lodasaf228.workers.dev7ec2854e…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:08
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev64cf0454…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:08
fc2617cf.4346164a315335d9f00d2c36.workers.dev61cc51aa…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:08
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev5ba42bf0…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:08
5eb23635.lodasaf228.workers.dev52447cc0…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:08
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev4745a4e5…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:08
5eb23635.lodasaf228.workers.dev290d403a…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:08
5eb23635.lodasaf228.workers.devc0214225…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:08
fc2617cf.4346164a315335d9f00d2c36.workers.deve91653ef…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:08
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.devb2b48194…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:08
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.devc2a72a02…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.dev89ca0038…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev3bcb122f…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev2641f3fc…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.devaab439c6…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.dev28ee8c03…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
5eb23635.lodasaf228.workers.devbbe856fe…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.devfac8ac72…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.devc7d04933…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev50bf01d5…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
1f43a3e4.57b79ffb3043f32930fb5bee.workers.devc609a3e8…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.devfa74b12e…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev8a34840f…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:07
5eb23635.lodasaf228.workers.devf3927bda…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev2e11c9fb…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.dev108f28fc…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.devbc9e874f…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.dev1f595e49…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev17585b47…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
5eb23635.lodasaf228.workers.deve95520d7…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:07
5eb23635.lodasaf228.workers.devdaf29c51…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev475b1325…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.devef46737a…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev34ab2d99…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev5584b24c…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev4740097a…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.devd2cbea4c…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
5eb23635.lodasaf228.workers.dev66f26e19…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev3145fa04…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev7970873c…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev81a1604d…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.dev9dede419…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.devaa84452b…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev3a230d34…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev0f9d42db…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev017d1637…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
5eb23635.lodasaf228.workers.dev129d599c…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:07
fc2617cf.4346164a315335d9f00d2c36.workers.dev774143bc…https://fc2617cf.4346164a315335d9f00d2c36.workers.dev/#htmlyara2026-09-17 08:07
e1e6e4c7.e1e1de714f370d6f275a8fde.workers.devebc331fa…https://e1e6e4c7.e1e1de714f370d6f275a8fde.workers.dev/#htmlyara2026-09-17 08:07
1f43a3e4.57b79ffb3043f32930fb5bee.workers.devefe7c93a…https://1f43a3e4.57b79ffb3043f32930fb5bee.workers.dev/[email protected]#htmlyara2026-09-17 08:07
ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev6d4e31ef…https://ae0be76a.f27ae0085b7b841aecc4fa2f.workers.dev/#htmlyara2026-09-17 08:07
5eb23635.lodasaf228.workers.devfe6cf664…https://5eb23635.lodasaf228.workers.dev/#htmlyara2026-09-17 08:07