Known malicious kithighphishing
Webmail & brand credential-phishing kits (July 2026)
family: credential-phishing-kits-202607
Five credential-phishing hosts confirmed in July 2026: webmail/Poczta login clones on throwaway hosting (hfmthsga.vercel.app, pljnsad.vercel.app, mid-scarlet-rqxuosjc.edgeone.dev, pub-<hash>.r2.dev), plus meritking2542.com (MeritKing casino brand abuse). All render a password form whose action self-POSTs, uses javascript:, or posts to a blob with the target email embedded.
Anchors
SMQL queryrun
domain:hfmthsga.vercel.app OR domain:pljnsad.vercel.app OR domain:mid-scarlet-rqxuosjc.edgeone.dev OR domain:pub-1bae389293eb48d58e53398a6e375d75.r2.dev OR domain:meritking2542.comProvenance
Added: 2026-07-02 16:30
Sightings (34)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| pljnsad.vercel.app | 0b91d62c… | — | query | 2026-10-02 07:53 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 5fe97fa7… | — | query | 2026-10-02 07:53 |
| hfmthsga.vercel.app | a427b669… | — | query | 2026-09-25 06:55 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | a99551f6… | — | query | 2026-09-25 06:54 |
| pljnsad.vercel.app | d67ea385… | — | query | 2026-09-25 06:54 |
| hfmthsga.vercel.app | ff8af660… | — | query | 2026-08-18 22:53 |
| pljnsad.vercel.app | 1b117a52… | — | query | 2026-08-18 20:53 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 82d5df0d… | — | query | 2026-08-18 19:53 |
| hfmthsga.vercel.app | cc68afc0… | — | query | 2026-08-07 12:53 |
| pljnsad.vercel.app | 90d298d1… | — | query | 2026-08-07 11:53 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 89c162aa… | — | query | 2026-08-07 11:52 |
| hfmthsga.vercel.app | 4e8a643f… | — | query | 2026-07-30 20:53 |
| pljnsad.vercel.app | bb600fc4… | — | query | 2026-07-30 19:53 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 88e15be6… | — | query | 2026-07-30 19:53 |
| hfmthsga.vercel.app | 87335576… | — | query | 2026-07-23 18:54 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 951241d3… | — | query | 2026-07-23 18:53 |
| pljnsad.vercel.app | 6999e124… | — | query | 2026-07-23 18:52 |
| hfmthsga.vercel.app | 86884d28… | — | query | 2026-07-16 17:54 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 0cf177e8… | — | query | 2026-07-16 17:52 |
| pljnsad.vercel.app | 5dd56d9d… | — | query | 2026-07-16 17:52 |
| hfmthsga.vercel.app | 08dce2d0… | — | query | 2026-07-09 16:53 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 5859852c… | — | query | 2026-07-09 16:52 |
| pljnsad.vercel.app | d87f9431… | — | query | 2026-07-09 16:52 |
| meritking2542.com | 60db5f30… | — | query | 2026-07-07 16:29 |
| meritking2542.com | fe10c47e… | — | query | 2026-07-06 01:50 |
| meritking2542.com | d4942850… | — | query | 2026-07-04 04:30 |
| mid-scarlet-rqxuosjc.edgeone.dev | 3fa6b132… | — | query | 2026-07-03 07:45 |
| meritking2542.com | 4eb05898… | — | query | 2026-07-02 18:45 |
| hfmthsga.vercel.app | 27863ea6… | — | query | 2026-07-02 15:50 |
| pljnsad.vercel.app | ae43a5b3… | — | query | 2026-07-02 15:50 |
| pub-1bae389293eb48d58e53398a6e375d75.r2.dev | 5f767023… | — | query | 2026-07-02 15:50 |
| meritking2542.com | 830b0659… | — | query | 2026-07-02 15:14 |
| meritking2542.com | 5c434aca… | — | query | 2026-07-02 14:09 |
| mid-scarlet-rqxuosjc.edgeone.dev | 429a0ee1… | — | query | 2026-07-02 14:03 |