Known malicious kithighother
Crypto task-scam (刷单) app — 2053752f module (content anchor)
family: crypto-task-scam-appflow
Client-rendered uni-app/Vue H5 crypto task-order scam (刷单): deposit USDT (TRC20), earn commissions on tasks, invite-code pyramid. Renders BLANK, so screenshots, page text and form analysis see nothing. Anchored on the rebuild-stable canonical AST hash: Vite content-hashed filenames and bundle hashes rotate per deploy, but the code structure survives. Each anchored module has only been seen on webapp-run.us.
Anchors
Provenance
Added: 2026-07-17 21:33
Only non-trivial modules are used as anchors, so generic helper code shared with other apps does not match.
Sightings (3)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| webapp-run.us | a306f270… | https://webapp-run.us/assets/index-BKJUIWv9.js#webpack-module:updateWithdrawalStatus | structure | 2026-07-17 22:27 |
| webapp-run.us | 993bbf29… | https://webapp-run.us/assets/index-BKJUIWv9.js#webpack-module:updateWithdrawalStatus | structure | 2026-07-17 21:48 |
| webapp-run.us | 5785c102… | https://webapp-run.us/assets/index-BKJUIWv9.js#webpack-module:updateWithdrawalStatus | structure | 2026-07-17 21:41 |