ScanMalware.com
Known malicious kithighother

J365 Gambling Platform — CometMarathon.js

family: j365-gambling-platform

Long-poll companion to Comet.js — secondary WebSocket channel used by the J365 illegal-gambling platform.

Fingerprint anchors

content sha256e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf
canonical AST28055543dc238a25163b5899996f0174e5c641c2e88e84a140f573a69b465d96
TLSHT1FB42424B6CF75081592B32B50F9F24447239D8572605E81C7DCCAAE08F98B6C1B6BFB8

Provenance

Added by: analyst
Added: 2026-05-26 13:17
Anchor #3 of 3. Companion to Comet.js. Zero leakage outside the kit CDN.

Sightings (12)

HostScanScriptMatchWhen
dxext9.pham.xinb41463be…https://dxext9.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-25 00:50
2hsuoj.yqdkrj.com8afd8d88…https://2hsuoj.yqdkrj.com/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-25 00:08
jn5ec4.pham.xind73884d6…https://jn5ec4.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 21:12
dxext9.pham.xin544f622c…https://dxext9.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 21:00
huf5as.pham.xin262d732b…https://huf5as.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 20:41
da3b55.pham.xin62dfa3a5…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 20:40
da3b55.pham.xin6c31dc8b…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 20:40
da3b55.pham.xin635fc42f…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 20:39
huf5as.pham.xin6fe623fd…https://huf5as.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 20:38
da3b55.pham.xin3f2ed933…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 20:38
2hsuoj.yqdkrj.com3f1a24b1…https://2hsuoj.yqdkrj.com/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 20:37
da3b55.pham.xine8318d6c…https://da3b55.pham.xin/ftl/commonPage/js/websocket/CometMarathon.jsbyte2026-05-24 20:34