Known malicious kithighphishing
Poczta (Polish WP webmail) phishing kit — page YARA (content anchor)
family: poczta-webmail-kit-202607
YARA content anchor for the Poczta webmail credential-phishing kit (sibling of tlsh/smql hunt #146). Custom authForm harvesting login/pass to first-party /api/login then redirecting to the real brand. Live auto-collection via trg_hunt_sightings_record_yara.
Anchors
YARA rulePoczta_Webmail_Phishing_Kit
Provenance
Added: 2026-07-07 13:17
2026-07-07: rule deployed in js-fingerprinter2 v2.3.19 (custom/poczta_webmail_kit.yar); FP-tested clean against the genuine poczta.wp.pl page. Keyed on kit structure (authForm/userLogin/userPass + /api/login exfil), not brand strings. Gives family #146 a ground-truth content tier (tlsh/smql are verdict-inert). Sightings accrue as the updated scanner matches new hosts.
Sightings (32)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| mssdold.vercel.app#html | dbb22547… | http://mssdold.vercel.app#html | yara | 2026-07-23 19:55 |
| pljnsad.vercel.app | 6999e124… | https://pljnsad.vercel.app/#html | yara | 2026-07-23 18:58 |
| hfmthsga.vercel.app | 87335576… | https://hfmthsga.vercel.app/#html | yara | 2026-07-23 18:56 |
| www.jjhdgtv.vercel.app | 826f68df… | https://www.jjhdgtv.vercel.app/#html | yara | 2026-07-23 16:54 |
| www.mmbxcdfg.vercel.app | cb884fed… | http://www.mmbxcdfg.vercel.app/#html | yara | 2026-07-23 16:54 |
| tommbtaq.vercel.app#html | ec48a947… | http://tommbtaq.vercel.app#html | yara | 2026-07-23 16:53 |
| tommbtaq.vercel.app | 65a900e2… | https://tommbtaq.vercel.app/#html | yara | 2026-07-23 16:53 |
| mmbxcdfg.vercel.app | 70dc8e3f… | https://mmbxcdfg.vercel.app/#html | yara | 2026-07-23 05:55 |
| mssdold.vercel.app#html | cf8a011b… | http://mssdold.vercel.app#html | yara | 2026-07-16 18:52 |
| pljnsad.vercel.app | 5dd56d9d… | https://pljnsad.vercel.app/#html | yara | 2026-07-16 17:56 |
| hfmthsga.vercel.app | 86884d28… | https://hfmthsga.vercel.app/#html | yara | 2026-07-16 17:55 |
| tommbtaq.vercel.app#html | 610a1cce… | http://tommbtaq.vercel.app#html | yara | 2026-07-16 15:51 |
| tommbtaq.vercel.app | 469f87ec… | https://tommbtaq.vercel.app/#html | yara | 2026-07-16 15:51 |
| www.jjhdgtv.vercel.app | 133f734a… | https://www.jjhdgtv.vercel.app/#html | yara | 2026-07-16 14:54 |
| www.mmbxcdfg.vercel.app | f89d3433… | http://www.mmbxcdfg.vercel.app/#html | yara | 2026-07-16 14:54 |
| mmbxcdfg.vercel.app | a2749b41… | https://mmbxcdfg.vercel.app/#html | yara | 2026-07-16 04:52 |
| mssdold.vercel.app#html | dc3210e1… | http://mssdold.vercel.app#html | yara | 2026-07-09 17:52 |
| hfmthsga.vercel.app | 08dce2d0… | https://hfmthsga.vercel.app/#html | yara | 2026-07-09 16:55 |
| pljnsad.vercel.app | d87f9431… | https://pljnsad.vercel.app/#html | yara | 2026-07-09 16:51 |
| tommbtaq.vercel.app#html | 3e832467… | http://tommbtaq.vercel.app#html | yara | 2026-07-09 14:51 |
| tommbtaq.vercel.app | a0b43805… | https://tommbtaq.vercel.app/#html | yara | 2026-07-09 13:54 |
| www.mmbxcdfg.vercel.app | b680ce3f… | http://www.mmbxcdfg.vercel.app/#html | yara | 2026-07-09 13:54 |
| www.jjhdgtv.vercel.app | f9370711… | https://www.jjhdgtv.vercel.app/#html | yara | 2026-07-09 13:54 |
| mmbxcdfg.vercel.app | ca058e36… | https://mmbxcdfg.vercel.app/#html | yara | 2026-07-09 03:51 |
| tommbtaq.vercel.app | 44ebdf10… | https://tommbtaq.vercel.app/#html | yara | 2026-07-07 13:23 |
| pljnsad.vercel.app | ae43a5b3… | https://pljnsad.vercel.app/#html | yara | 2026-07-07 13:23 |
| tommbtaq.vercel.app#html | 7a1f3dea… | http://tommbtaq.vercel.app#html | yara | 2026-07-07 13:23 |
| www.jjhdgtv.vercel.app | 8ed079e9… | https://www.jjhdgtv.vercel.app/#html | yara | 2026-07-07 13:23 |
| mmbxcdfg.vercel.app | e02afc1f… | https://mmbxcdfg.vercel.app/#html | yara | 2026-07-07 13:22 |
| hfmthsga.vercel.app | 27863ea6… | https://hfmthsga.vercel.app/#html | yara | 2026-07-07 13:21 |
| mssdold.vercel.app#html | c602fbd0… | http://mssdold.vercel.app#html | yara | 2026-07-07 13:21 |
| www.mmbxcdfg.vercel.app | 8bb94cef… | http://www.mmbxcdfg.vercel.app/#html | yara | 2026-07-07 13:21 |