ScanMalware.com
Known malicious kithighphishing

Poczta (Polish WP webmail) phishing kit — page YARA (content anchor)

family: poczta-webmail-kit-202607

YARA content anchor for the Poczta webmail credential-phishing kit (sibling of the TLSH fuzzy-hash entry in this family). A custom authForm sends the login and password to a first-party /api/login endpoint, then redirects the victim to the real brand.

Anchors

YARA rulePoczta_Webmail_Phishing_Kit

Provenance

Added: 2026-07-07 13:17
Keyed on kit structure (the authForm / userLogin / userPass fields and the /api/login exfiltration), not brand strings, and tested clean against the genuine poczta.wp.pl login page that the kit copies.

Sightings (32)

HostScanScriptMatchWhen
mssdold.vercel.app#htmldbb22547…http://mssdold.vercel.app#htmlyara2026-07-23 19:55
pljnsad.vercel.app6999e124…https://pljnsad.vercel.app/#htmlyara2026-07-23 18:58
hfmthsga.vercel.app87335576…https://hfmthsga.vercel.app/#htmlyara2026-07-23 18:56
www.jjhdgtv.vercel.app826f68df…https://www.jjhdgtv.vercel.app/#htmlyara2026-07-23 16:54
www.mmbxcdfg.vercel.appcb884fed…http://www.mmbxcdfg.vercel.app/#htmlyara2026-07-23 16:54
tommbtaq.vercel.app#htmlec48a947…http://tommbtaq.vercel.app#htmlyara2026-07-23 16:53
tommbtaq.vercel.app65a900e2…https://tommbtaq.vercel.app/#htmlyara2026-07-23 16:53
mmbxcdfg.vercel.app70dc8e3f…https://mmbxcdfg.vercel.app/#htmlyara2026-07-23 05:55
mssdold.vercel.app#htmlcf8a011b…http://mssdold.vercel.app#htmlyara2026-07-16 18:52
pljnsad.vercel.app5dd56d9d…https://pljnsad.vercel.app/#htmlyara2026-07-16 17:56
hfmthsga.vercel.app86884d28…https://hfmthsga.vercel.app/#htmlyara2026-07-16 17:55
tommbtaq.vercel.app#html610a1cce…http://tommbtaq.vercel.app#htmlyara2026-07-16 15:51
tommbtaq.vercel.app469f87ec…https://tommbtaq.vercel.app/#htmlyara2026-07-16 15:51
www.jjhdgtv.vercel.app133f734a…https://www.jjhdgtv.vercel.app/#htmlyara2026-07-16 14:54
www.mmbxcdfg.vercel.appf89d3433…http://www.mmbxcdfg.vercel.app/#htmlyara2026-07-16 14:54
mmbxcdfg.vercel.appa2749b41…https://mmbxcdfg.vercel.app/#htmlyara2026-07-16 04:52
mssdold.vercel.app#htmldc3210e1…http://mssdold.vercel.app#htmlyara2026-07-09 17:52
hfmthsga.vercel.app08dce2d0…https://hfmthsga.vercel.app/#htmlyara2026-07-09 16:55
pljnsad.vercel.appd87f9431…https://pljnsad.vercel.app/#htmlyara2026-07-09 16:51
tommbtaq.vercel.app#html3e832467…http://tommbtaq.vercel.app#htmlyara2026-07-09 14:51
tommbtaq.vercel.appa0b43805…https://tommbtaq.vercel.app/#htmlyara2026-07-09 13:54
www.mmbxcdfg.vercel.appb680ce3f…http://www.mmbxcdfg.vercel.app/#htmlyara2026-07-09 13:54
www.jjhdgtv.vercel.appf9370711…https://www.jjhdgtv.vercel.app/#htmlyara2026-07-09 13:54
mmbxcdfg.vercel.appca058e36…https://mmbxcdfg.vercel.app/#htmlyara2026-07-09 03:51
tommbtaq.vercel.app44ebdf10…https://tommbtaq.vercel.app/#htmlyara2026-07-07 13:23
pljnsad.vercel.appae43a5b3…https://pljnsad.vercel.app/#htmlyara2026-07-07 13:23
tommbtaq.vercel.app#html7a1f3dea…http://tommbtaq.vercel.app#htmlyara2026-07-07 13:23
www.jjhdgtv.vercel.app8ed079e9…https://www.jjhdgtv.vercel.app/#htmlyara2026-07-07 13:23
mmbxcdfg.vercel.appe02afc1f…https://mmbxcdfg.vercel.app/#htmlyara2026-07-07 13:22
hfmthsga.vercel.app27863ea6…https://hfmthsga.vercel.app/#htmlyara2026-07-07 13:21
mssdold.vercel.app#htmlc602fbd0…http://mssdold.vercel.app#htmlyara2026-07-07 13:21
www.mmbxcdfg.vercel.app8bb94cef…http://www.mmbxcdfg.vercel.app/#htmlyara2026-07-07 13:21