ScanMalware.com
Known malicious kithighphishing

Webmail & brand credential-phishing kits (2026-07-02 audit)

family: credential-phishing-kits-202607

5 credential-phishing hosts confirmed TP in the 2026-07-02 health-alert verdict audit: webmail/Poczta login clones on throwaway hosting (hfmthsga.vercel.app, pljnsad.vercel.app, mid-scarlet-rqxuosjc.edgeone.dev, pub-<hash>.r2.dev), plus meritking2542.com (MeritKing casino brand-abuse). All render a password form; actions self-POST / javascript: / blob-with-embedded-target-email. smql-tier anchor (does not drive verdicts).

Anchors

SMQL queryrun
domain:hfmthsga.vercel.app OR domain:pljnsad.vercel.app OR domain:mid-scarlet-rqxuosjc.edgeone.dev OR domain:pub-1bae389293eb48d58e53398a6e375d75.r2.dev OR domain:meritking2542.com

Provenance

Added: 2026-07-02 16:30

Sightings (20)

HostScanScriptMatchWhen
hfmthsga.vercel.app87335576…—query2026-07-23 18:54
pub-1bae389293eb48d58e53398a6e375d75.r2.dev951241d3…—query2026-07-23 18:53
pljnsad.vercel.app6999e124…—query2026-07-23 18:52
hfmthsga.vercel.app86884d28…—query2026-07-16 17:54
pub-1bae389293eb48d58e53398a6e375d75.r2.dev0cf177e8…—query2026-07-16 17:52
pljnsad.vercel.app5dd56d9d…—query2026-07-16 17:52
hfmthsga.vercel.app08dce2d0…—query2026-07-09 16:53
pub-1bae389293eb48d58e53398a6e375d75.r2.dev5859852c…—query2026-07-09 16:52
pljnsad.vercel.appd87f9431…—query2026-07-09 16:52
meritking2542.com60db5f30…—query2026-07-07 16:29
meritking2542.comfe10c47e…—query2026-07-06 01:50
meritking2542.comd4942850…—query2026-07-04 04:30
mid-scarlet-rqxuosjc.edgeone.dev3fa6b132…—query2026-07-03 07:45
meritking2542.com4eb05898…—query2026-07-02 18:45
hfmthsga.vercel.app27863ea6…—query2026-07-02 15:50
pljnsad.vercel.appae43a5b3…—query2026-07-02 15:50
pub-1bae389293eb48d58e53398a6e375d75.r2.dev5f767023…—query2026-07-02 15:50
meritking2542.com830b0659…—query2026-07-02 15:14
meritking2542.com5c434aca…—query2026-07-02 14:09
mid-scarlet-rqxuosjc.edgeone.dev429a0ee1…—query2026-07-02 14:03