Known malicious kitcriticalphishing
Tigo El Salvador Brand Impersonation — index.js #1
family: latam-tigo-sv-phish-1b7d
Brand-impersonation phishing kit targeting Tigo El Salvador (major LATAM telecom). 19 hosts on .cc/.help/.click/.art/.sbs/.top with tigo-prefixed names (sv-tigo.cc, tigoboss.help, tigosrwvp.help, tigovseop.click, tigovspom.help, …). Page title: "La primera Red 5G de El Salvador | Tigo El Salvador" (direct quote from real Tigo SV marketing). URL path /apps/SV_PT_01/assets/index-*.js — sister to the Telcel MX MX_PT_06 kit, same operator.
Fingerprint anchors
Provenance
Added by: analyst
Added: 2026-05-26 18:41
Anchor #1 of 2. 19 hosts. /apps/SV_PT_01/assets/index-<hash>.js path.
Sightings (25)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| tigosvspt.help | f3c4ab5a… | https://tigosvspt.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 20:52 |
| tigoboss.help | d9b3c62c… | https://tigoboss.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 20:38 |
| tigovseop.sbs | 0de1c6ed… | https://tigovseop.sbs/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 17:45 |
| tigovseop.top | 285311b7… | https://tigovseop.top/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 17:20 |
| tigovseop.sbs | 6cadf62d… | https://tigovseop.sbs/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 17:20 |
| tigovseop.art | 4a7118d7… | https://tigovseop.art/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 17:13 |
| tigovseop.click | 84cea537… | https://tigovseop.click/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 16:39 |
| tigovseop.top | 8f78a216… | https://tigovseop.top/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 16:36 |
| tigovsopa.click | 29bb916c… | https://tigovsopa.click/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 16:26 |
| tigosrtvp.help | f27a488b… | https://tigosrtvp.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 16:16 |
| tigovsopa.help | 8bd012c9… | https://tigovsopa.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 16:14 |
| tigosnvrp.help | fc751d3e… | https://tigosnvrp.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 16:06 |
| tigosvopas.click | 4d24374b… | https://tigosvopas.click/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:45 |
| tigosdvtp.help | 58a4f460… | https://tigosdvtp.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:39 |
| tigosdvtp.help | 1e1e4e1a… | https://tigosdvtp.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:33 |
| tigovsopa.help | ea406cb5… | https://tigovsopa.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:31 |
| tigosvopas.help | d44ac900… | https://tigosvopas.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:28 |
| tigosvopas.help | ddf7898d… | https://tigosvopas.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:22 |
| tigosrwvp.help | 90f41fe7… | https://tigosrwvp.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:21 |
| tigosrevp.help | fc5516e0… | https://tigosrevp.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:15 |
| tigosvopas.click | 3f16a14e… | https://tigosvopas.click/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 15:14 |
| tigonosep.click | 95ab036b… | https://tigonosep.click/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 13:39 |
| tigovspom.help | 8446e720… | https://tigovspom.help/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 12:38 |
| sv-tigo.cc | 12708a47… | http://sv-tigo.cc/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 06:27 |
| tigo-sv.cc | 68a06f13… | https://tigo-sv.cc/apps/SV_PT_01/assets/index-DutFSlu3.js | byte | 2026-05-24 05:56 |