Known malicious kitcriticalphishing

Cloudflare Workers Phishing Kits (device-code / EvilToken & brand lures)

family: cloudflare_workers_phishing

High-risk phishing kits hosted on Cloudflare Workers (*.workers.dev) — disposable gibberish-subdomain hosts impersonating brands (Adobe / Microsoft / DocuSign / GitHub / banks). Includes form-less device-code / OAuth-consent (EvilToken-style) kits that lure victims into authorising a Microsoft device code on the real identity provider, plus credential-harvest clones. Anchored on the throwaway platform + the AI malice verdict, so it captures the family without per-site rules.

Anchors

YARA ruleEvilTokens_Ghost_Loader
SMQL queryrun
device_code_phishing:true OR ocr:devicelogin OR domain:*-s-account.workers.dev

Provenance

Added: 2026-06-30 15:13
Created 2026-06-30 from a user-reported device-token/EvilToken kit (gcpu-...workers.dev, Adobe Acrobat Sign lure to MS device-code token theft; bedrock FN fixed in v1.3.60). SMQL anchor backfills the existing scan corpus; ongoing matches require a periodic re-run (SMQL hunts have no insert-time trigger). | re-anchored 2026-07-01: verdict:HIGH→device-code signal (device_code_phishing flag + devicelogin OCR lure); prior circular verdict anchor removed

Sightings (200)

HostScanScriptMatchWhen
whm.9086whm.whm.whm.citydwww.admin.as.152-53-37-155.plesk.page80d2e099query2026-09-12 19:16
sp30ct-zemik-biz-kavel-nadex.pages.devbc64ae91query2026-09-12 18:23
quantum-auth.pages.dev748c571equery2026-09-12 18:15
ihsyy-cbq-rnp7-1ob3h-11-09-2026-hh.pages.devf5bb9026query2026-09-12 17:00
querulous-gray-eatldo5p-dpq6znv6r855.edgeone.dev54e2793cquery2026-09-12 15:20
zfrip-klim-vrop-759-vrik-fravox-zaz-427.pages.devd0520cafquery2026-09-12 14:50
msv175low-yrpkwyr-1v8t0g-msv52c.pages.dev96e342fdquery2026-09-12 13:48
facebookk-k.vercel.appa886e57dquery2026-09-12 13:46
verified-platform-fb2171.vercel.appbe887ec4query2026-09-12 12:50
sdffht3.pages.dev6e3c677fquery2026-09-12 12:50
7t60y-ix3-chlx-vi11r-11-09-2026-hh.pages.devf9949065query2026-09-12 12:49
xernqavi-mpt-borvexo-r8d2me61.pages.devc82c207cquery2026-09-12 12:49
trp1m-8ex-k8u1-6ltsa-11-09-2026-hh.pages.dev70c27b8equery2026-09-12 12:22
protective-magenta-tet48fle-dp4rwjdywwys.edgeone.dev707f0367query2026-09-12 11:42
lucky-win26-27-dpxlg58qlp88.edgeone.devf2c1f84equery2026-09-12 10:54
7t60y-ix3-chlx-vi11r-11-09-2026-hh.pages.dev428d0dd3query2026-09-12 07:13
ar24-sigma.vercel.app7fd8bbd2query2026-09-12 06:52
iahnp-g5p-0jym-r1nwm-11-09-2026-hh.pages.dev1e6848f7query2026-09-12 06:29
ar24-sigma.vercel.app4333c5d5query2026-09-12 05:54
secure-server-landing-page--richmanagementt.replit.app1f0128c3query2026-09-12 05:52
jkstr12wsed-htpmqskr-8m4h7g-jks91c378.pages.dev7bf5116aquery2026-09-12 05:33
sardineext.vercel.appc54b6ebequery2026-09-12 03:53
appropriate-peach-qqgcy0q6.edgeone.dev655af428query2026-09-12 02:53
considerable-orange-q8rwmb3p.edgeone.dev08c4c552query2026-09-12 02:53
whm.citydwww.admin.as.152-53-37-155.plesk.pagec8e56dcfquery2026-09-12 02:24
sp30ct-vadok-biz-zemur-kalix.pages.dev2ca192b3query2026-09-12 02:14
verified-platform-fb2171.vercel.app49f16779query2026-09-12 01:48
implicit-tan-01gwwgbs-dpuncu3zbrn8.edgeone.dev07d6e538query2026-09-12 01:23
secure-link-c96a.amcobisolutions.workers.dev0261cc64query2026-09-12 00:50
lktvr057nhw-ghfcyfyn-1w8v9g-pz611a.pages.dev6d76307cquery2026-09-12 00:48
netflix-two-mu.vercel.app8ebc2b3aquery2026-09-12 00:47
dark-saime-ai-mod-dpvzkxrf8t9d.edgeone.dev8dbc0ca7query2026-09-11 23:57
l2ktopup-dpxny3vemyct.edgeone.dev8b46002fquery2026-09-11 22:05
j1pk8-ry1-obdt-hy7sw-11-09-2026-hh.pages.dev347d46e8query2026-09-11 21:59
sp30ct-vadun-biz-qemik-zorek.pages.dev5d2fe1fdquery2026-09-11 20:11
q30o3-yzl-ow30-ugdsf-11-09-2026-hh.pages.devafe8c8c0query2026-09-11 17:36
moudhgsr-dp4lyapywtjw.edgeone.dev43e4584fquery2026-09-11 16:52
pho63-dpdvht00jabz.edgeone.dev62dd6370query2026-09-11 14:23
sp12ct-morsel-biz-kavren-holdik.pages.dev461795c0query2026-09-11 13:54
sp12ct-morsel-biz-kavren-holdik.pages.dev13c762dequery2026-09-11 12:57
sp12ct-pramik-biz-zoldor-kersel.pages.dev9dec7f93query2026-09-11 12:56
sp12ct-pramik-biz-zoldor-kersel.pages.devd38a550equery2026-09-11 12:56
sp12ct-prandik-biz-zorsel-kemdor.pages.deve4a7ad62query2026-09-11 12:56
sp12ct-prandik-biz-zorsel-kemdor.pages.devb632d2f9query2026-09-11 12:56
bankofamerica-uscom.vercel.app2908f081query2026-09-11 12:52
bankofamerica-uscom.vercel.appfa868969query2026-09-11 12:50
my-swisscomm.vercel.app9ecef866query2026-09-11 12:50
sp30ct-madok-biz-qurik-zavel.pages.dev4f350f33query2026-09-11 12:48
sp26ct-teski-biz-pelun-varka.pages.dev35ebe3bfquery2026-09-11 12:48
drivan-kolpex-3bfa02-grht-r2406dne.pages.dev706a36eaquery2026-09-11 12:35
yrpkw775bf-msvskr-5y2t9g-yrpks50c.pages.devd8a25d65query2026-09-11 10:37
vertiv-command-center.pages.devc1aa2933query2026-09-11 09:52
owner-saime-vai-hgnice-ai-hack-dpavwq8olye2.edgeone.dev1ab2e580query2026-09-11 09:23
glonex-fursa-a7c109-wplm-monvek.pages.dev5fc4f159query2026-09-11 09:09
pjq49-170nhw-tdr52-fyn-3y8x0g-kxv81-611a.pages.devf904451dquery2026-09-11 08:17
sumon-vai-ai-hack-dpjgp6cf2zpa.edgeone.dev09d7bb3dquery2026-09-11 06:32
detrouble-site.pages.devbdf7fc5aquery2026-09-11 02:27
bankofamerica-uscom.vercel.appad49ca64query2026-09-11 01:49
my-swisscomm.vercel.appda3be12cquery2026-09-11 01:47
s3.us-east-2.amazonaws.com4564473dquery2026-09-11 00:48
wild-sunset-9c10.jernzen26.workers.devcd0d5be9query2026-09-11 00:48
mahir-ai-bot-dp2q6i75pts4.edgeone.deva69f1fcfquery2026-09-11 00:22
tdr52-890nh-kxv81-lpw-7w4r2e-tdr52-95c.pages.dev3662bad2query2026-09-10 23:14
sp30ct-kador-biz-zumix-navel.pages.dev221a0458query2026-09-10 22:28
distant-jade-sfey62ym-dpofubr3mu0h.edgeone.dev3be16628query2026-09-10 20:50
kxv81-5jfdran-hwn64-lpw-9v6t8d-hwn64-366a.pages.dev89a50ae1query2026-09-10 20:29
kxv81-973mjw-pjq49-rel-9w4t1g-hwn64-344a.pages.dev00438ee9query2026-09-10 20:05
sp30ct-zurel-biz-qavik-nomad.pages.dev4d63218aquery2026-09-10 18:24
prescout.pages.dev5bfa6111query2026-09-10 17:51
sp30ct-zunav-biz-karel-vomix.pages.dev02b2b6c5query2026-09-10 17:37
appealbykz-dphur2wqe2hh.edgeone.dev932d10d1query2026-09-10 17:02
mbj85vstr-ghfcy61mja-9w3v7g-lk241n.pages.dev1b8f4430query2026-09-10 16:05
reporting-atelier4.pages.dev9ec467afquery2026-09-10 14:08
projectsapp-one.vercel.app206c1bdcquery2026-09-10 13:47
easy-bank-peach.vercel.app1423a348query2026-09-10 13:47
easy-bank-peach.vercel.app50410128query2026-09-10 13:46
resonate-foco.pages.dev8d0b9c67query2026-09-10 13:44
kxv81-078mjw-pjq49-rel-9w6t2g-hwn64-166a.pages.devbb2e7962query2026-09-10 12:57
netflix-two-mu.vercel.app192bb845query2026-09-10 12:50
netflix-two-mu.vercel.app234337b0query2026-09-10 12:49
potwierdzenie-bezpieczenstwa.vercel.app43f86e7bquery2026-09-10 12:47
boss-naim-vip-hack-dpmlm4uhv726.edgeone.dev0ed6fdc3query2026-09-10 12:39
sp30ct-lavik-biz-qemur-zodak.pages.deve36b2e13query2026-09-10 12:30
xelvik-plenor-f73ad5-hfht-g2406ado.pages.deve3cbf785query2026-09-10 12:25
rx-rifat-premium-vip-ai-dpvjtfdtid8f.edgeone.devd9493373query2026-09-10 11:30
still-cyan-urjw6t9a-dpnsg49cqv1n.edgeone.dev8a9cdd0aquery2026-09-10 10:20
hwn64-1fhpxo-zmb73-mja-5z6x8c-hwn64-16c.pages.dev09606505query2026-09-10 10:16
zwlxtwhm.1whm.www.www.www.admin.da.152-53-37-155.plesk.pageac5bc275query2026-09-10 09:15
attft-website.pages.dev06372351query2026-09-10 04:39
brief-lavender-wl9sdolf-dpy3idyrqu87.edgeone.dev6d95a9c6query2026-09-10 04:18
myssuwww.staging.staging.www.ny.152-53-37-155.plesk.pagea9640769query2026-09-10 04:03
vow8ubo4zcpwalpcyjv.vercel.appe5c94955query2026-09-10 01:46
owner-siam-vai-vip-hack-dpf0w97tzqcq.edgeone.dev275a0c3fquery2026-09-10 00:43
kxlrq079kf-fghzdpdr-3z0r4c-wp199c.pages.dev8081bea3query2026-09-09 23:50
vnxkp1eskra-tjrmlwur-8y3w9d-zp733a.pages.dev6ae4a51dquery2026-09-09 21:20
www.dev.admin.www.mw.152-53-37-155.plesk.page520caa89query2026-09-09 18:35
berqumi-gld-belmita-p9t4fk52.pages.devf1b98bcequery2026-09-09 17:56
navquro-gld-belxita-r6t2hc95.pages.deve75f8c27query2026-09-09 17:41
www.www.api.as.152-53-37-155.plesk.page0f44a8eequery2026-09-09 15:18
madarrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr-dp3kfe6l8rto.edgeone.dev6968c1eaquery2026-09-09 14:41
kzenedge.vercel.app8e5c60d8query2026-09-09 12:53
hwn64-87bfrn-zmb73-skr-5y6t7g-hwn64-10cgrg.pages.dev36eaea0cquery2026-09-09 11:59
yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev14d2f8a8query2026-09-09 10:12
sr-premium-dp9i1m3dddsc.edgeone.devb6396464query2026-09-09 09:36
mithun-vai-personal-ai-hack-dpijbk3hkauz.edgeone.dev26a0abf5query2026-09-09 09:21
earn4bd-dpry47g4w305.edgeone.dev004a83ebquery2026-09-09 07:35
qelmavi-gld-zormita-a5x8hc13.pages.dev13e5fd5dquery2026-09-09 05:19
sad-rhodes.104-36-18-170.plesk.page44a27232query2026-09-09 02:38
exuberant-violet-leyu05lu-dpbfis18b1j7.edgeone.dev8f252477query2026-09-09 02:12
gmail-account.vercel.app2af40915query2026-09-09 00:49
gmail-account.vercel.app16fd6f50query2026-09-09 00:48
above-harlequin-m1tsesof-dpg3vke551gg.edgeone.deve66bc90dquery2026-09-08 23:04
porvik-clenda-b7d204-rgtt-ponvek.pages.dev4583dc54query2026-09-08 17:22
berqula-gld-lenvori-r5t7fq261.pages.dev6e424893query2026-09-08 17:17
sp30ct-norix-biz-zavel-kemur.pages.dev849bdb78query2026-09-08 16:16
yrpkw8grzgo-msvlsi-5z5x2b-yrpks11c.pages.dev1bf36603query2026-09-08 15:52
verifybluecheckmark-eight.vercel.app5cf5c016query2026-09-08 14:52
verifybluecheckmark-eight.vercel.appa97b8af6query2026-09-08 14:48
wptjn16kwg-fghzd83pli-6vz82d-wp38k.pages.dev1832b054query2026-09-08 14:48
bermita-gld-zarqumi-p7t2dk95.pages.devdd265655query2026-09-08 14:48
facebookk-k.vercel.app4e617ed2query2026-09-08 14:46
rfboszrqhnvrhepbubq.vercel.app61ab75b9query2026-09-08 13:50
rfboszrqhnvrhepbubq.vercel.app0f4e1b52query2026-09-08 13:50
lpr47-155pz-mvk62-155ls-4b1c5d-lpr47-155c.pages.devc642896bquery2026-09-08 13:49
nlgjh52vstr-bcfxs38mja-0n4l8g-rt918n.pages.devaf3b3db3query2026-09-08 13:47
skat-vrib-plon-903-krez-splantox-vub-156.pages.dev1b79da12query2026-09-08 13:47
spra-froz-glim-609-dvon-skraver-znip-378.pages.deva9861f56query2026-09-08 13:47
lhjnd52skrp-yktpmyk-7j0i4e-lhq99c.pages.deva3f77032query2026-09-08 12:51
hwn64-775bf-zmb73-skr-5y2t9g-hwn64-50c.pages.dev326de824query2026-09-08 12:51
projectsapp-one.vercel.appa4c02509query2026-09-08 12:49
facebookk-k.vercel.appfc9f94d0query2026-09-08 12:48
drysdalebaconmcstravick.vercel.appe6e04bd5query2026-09-08 12:48
kxv81-161mj-pjq49-ren-9w6x1g-hwn64-477a.pages.dev30e60555query2026-09-08 12:48
comepay-help-line-support25.vercel.app029b5b1aquery2026-09-08 12:47
amazon-landing-page-umber.vercel.app3e40cebequery2026-09-08 12:47
amazon-landing-page-umber.vercel.app38c5159dquery2026-09-08 12:47
comepay-help-line-support25.vercel.app119ce70fquery2026-09-08 12:47
owner-rafi-vai-ai-dpwuyk0iqg3f.edgeone.devbd7a027fquery2026-09-08 12:41
ffglorygtbot-dp2s56dbrs9k.edgeone.dev5bea1586query2026-09-08 11:39
sp30ct-murev-biz-qalon-zadex-8bv.pages.dev89fcc7b5query2026-09-08 11:14
kxv81-161mj-pjq49-ren-9w6x1g-hwn64-477a.pages.dev69e1f5daquery2026-09-08 08:55
zmb73-175low-hwn64-hwn-1v8t0g-zmb73-52c.pages.devd6d2e993query2026-09-08 06:37
wptjn16kwg-fghzd83pli-6vz82d-wp38k.pages.deved3637bcquery2026-09-08 04:02
bermita-gld-zarqumi-p7t2dk95.pages.dev9993d3dfquery2026-09-08 03:02
kzenedge.vercel.appbb5abfbcquery2026-09-08 00:51
kzenedge.vercel.app3fe30059query2026-09-08 00:50
ubiquitous-barnacles.vercel.app780e7d16query2026-09-08 00:50
airbnb2-delta.vercel.app8e232d79query2026-09-08 00:49
ddpay-support-help-line-support-sec-lime.vercel.app0f05d52equery2026-09-08 00:49
ddpay-support-help-line-support-sec-lime.vercel.appdcdd1bc2query2026-09-08 00:49
mirtavo-gld-quelnix-b8t5pf71.pages.devb24cda35query2026-09-08 00:48
comepay-support.vercel.apped3f98b4query2026-09-08 00:48
newbellbil.netlify.appee99128cquery2026-09-08 00:48
given-cyan-fjx85flu-dpqhihpn05ev.edgeone.dev2339d031query2026-09-08 00:43
arif-drm-deathly-deasing-injector-tms-engine-dp5ph61mnoqt.edgeone.dev32b5c715query2026-09-08 00:16
kawaiifm-dpj94si946wk.edgeone.dev8d7b6159query2026-09-08 00:10
wellsfargo-worl.vercel.app7f70968fquery2026-09-07 19:54
belvora-gld-xarmeti-p2t9hc75.pages.devb8881827query2026-09-07 19:53
belvora-gld-xarmeti-p2t9hc75.pages.dev3da45476query2026-09-07 19:53
berquna-gld-lartora-p4t1dk98.pages.dev99ee04c4query2026-09-07 19:53
berquna-gld-lartora-p4t1dk98.pages.devd248a43equery2026-09-07 18:55
cwngs51lkwg-pxqzvpli-9ce26c-cwn77c-cku.pages.dev8b038da2query2026-09-07 18:55
cwngs51lkwg-pxqzvpli-9ce26c-cwn77c-cku.pages.dev67c4f269query2026-09-07 18:55
marlavo-gld-fentora-a8x9hc63.pages.dev8e83505aquery2026-09-07 18:54
marlavo-gld-fentora-a8x9hc63.pages.devbd693211query2026-09-07 18:54
mornela-gld-fentora-a6x4fc954.pages.dev1c23aa15query2026-09-07 18:54
norzeta-gld-fentela-r5t2hp76.pages.devae752d62query2026-09-07 18:54
norzeta-gld-fentela-r5t2hp76.pages.deva6e201c7query2026-09-07 18:54
mornela-gld-fentora-a6x4fc954.pages.dev9237a822query2026-09-07 18:54
qurnela-gld-belmora-a1x5dw94.pages.dev649ef5c6query2026-09-07 18:54
norzeta-gld-zartavi-r9t2pc76.pages.dev5bf60600query2026-09-07 18:53
norzeta-gld-zartavi-r9t2pc76.pages.dev13228ce2query2026-09-07 18:53
qurnela-gld-belmora-a1x5dw94.pages.dev8c9defdaquery2026-09-07 18:53
vormora-gld-belmora-p6t4fk83.pages.dev5e997e9cquery2026-09-07 18:24
oqhg-4ximxo-1ryj-14yra-uvrs3.pages.devf3cea00aquery2026-09-07 18:00
sp11ct-bravik-biz8-lorpex-vansel.pages.devb5a261bbquery2026-09-07 17:54
sp11ct-bravik-biz8-lorpex-vansel.pages.dev6f5f3c06query2026-09-07 17:54
sp11ct-corzen-biz8-vemral-koltra.pages.dev3e265bc4query2026-09-07 17:54
sp11ct-corzen-biz8-vemral-koltra.pages.dev6173ec71query2026-09-07 17:54
sp11ct-darnok-biz8-veltra-kosmir.pages.devc9dc123fquery2026-09-07 17:54
sp11ct-darnel-biz8-somvik-pralor.pages.devde38ab17query2026-09-07 17:53
sp11ct-darnel-biz8-somvik-pralor.pages.devb4453e38query2026-09-07 17:53
sp11ct-dolvar-biz8-kresik-lunmer.pages.dev0e53f073query2026-09-07 17:53
sp11ct-darnok-biz8-veltra-kosmir.pages.devdc3191daquery2026-09-07 17:53
sp11ct-dolvar-biz8-kresik-lunmer.pages.dev410b4a70query2026-09-07 17:53
ur0-owe4wd-b0joqa-wu8m3-eobh72.pages.dev8116b924query2026-09-07 17:04
sp11ct-felnor-biz8-tarsik-velmor.pages.dev7a1bb6f1query2026-09-07 16:55
sp11ct-felnor-biz8-tarsik-velmor.pages.dev86a6e1d1query2026-09-07 16:54
sp11ct-fornex-biz8-kelzor-madrix.pages.devbec53a3equery2026-09-07 16:54
sp11ct-hanvek-biz8-solmer-pranix.pages.dev301739a7query2026-09-07 16:54
sp11ct-fornex-biz8-kelzor-madrix.pages.devd1637401query2026-09-07 16:54
sp11ct-hanvek-biz8-solmer-pranix.pages.dev076e70b7query2026-09-07 16:53
sp11ct-horlin-biz8-cravex-norzil.pages.deve084c08dquery2026-09-07 16:53
sp11ct-horlin-biz8-cravex-norzil.pages.dev8e736512query2026-09-07 15:55
sp11ct-jarnix-biz8-korlin-vestra.pages.deva970f35dquery2026-09-07 15:54
sp11ct-keltra-biz8-vormex-drasil.pages.dev26c9d14bquery2026-09-07 15:54
sp11ct-jarnix-biz8-korlin-vestra.pages.dev3039eaf2query2026-09-07 15:53
sp11ct-karsen-biz8-zoltra-femvik.pages.deveacecea4query2026-09-07 15:53
sp11ct-keltra-biz8-vormex-drasil.pages.deva8d42323query2026-09-07 15:53
sp11ct-karsen-biz8-zoltra-femvik.pages.dev675ede57query2026-09-07 15:53