Known malicious kithighphishing
Poczta (Polish webmail) phishing kit — page content-hash
family: poczta-webmail-kit-202607
Byte-identical Polish-webmail ("Poczta") credential-phishing kit deployed across many throwaway *.vercel.app gibberish subdomains. Anchor = exact page TLSH (fuzzy_hashes->>tlsh); same ssdeep + favicon mmh3 -75849909. Generalizes across the campaign (caught 6 hosts at creation vs the 2 in hunt #145). Rule engine rates these low (known FN class); AI flags HIGH_RISK credential phishing. NOTE: smql/tlsh anchor is backfill-only (no live trigger) — re-backfill to catch new hosts, or add a YARA rule for live auto-collection. Provenance: 2026-07-02 health-alert verdict audit.
Anchors
SMQL queryrun
tlsh:T1D0B273735161332C950BD92867B4174AA256E42BE58F62C4B6BE1724DFC7E82CDB328CProvenance
Added: 2026-07-02 16:36
Sightings (24)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| mssdold.vercel.app | dbb22547… | — | query | 2026-07-23 19:53 |
| hfmthsga.vercel.app | 87335576… | — | query | 2026-07-23 18:54 |
| pljnsad.vercel.app | 6999e124… | — | query | 2026-07-23 18:52 |
| tommbtaq.vercel.app | ec48a947… | — | query | 2026-07-23 16:53 |
| jjhdgtv.vercel.app | 826f68df… | — | query | 2026-07-23 16:52 |
| mmbxcdfg.vercel.app | cb884fed… | — | query | 2026-07-23 16:52 |
| mmbxcdfg.vercel.app | 70dc8e3f… | — | query | 2026-07-23 05:53 |
| mssdold.vercel.app | cf8a011b… | — | query | 2026-07-16 18:52 |
| hfmthsga.vercel.app | 86884d28… | — | query | 2026-07-16 17:54 |
| pljnsad.vercel.app | 5dd56d9d… | — | query | 2026-07-16 17:52 |
| tommbtaq.vercel.app | 610a1cce… | — | query | 2026-07-16 15:52 |
| tommbtaq.vercel.app | 469f87ec… | — | query | 2026-07-16 15:52 |
| jjhdgtv.vercel.app | 133f734a… | — | query | 2026-07-16 14:55 |
| mmbxcdfg.vercel.app | f89d3433… | — | query | 2026-07-16 14:54 |
| mmbxcdfg.vercel.app | a2749b41… | — | query | 2026-07-16 04:52 |
| mmbxcdfg.vercel.app | ca058e36… | — | query | 2026-07-09 03:52 |
| jjhdgtv.vercel.app | 8ed079e9… | — | query | 2026-07-02 16:56 |
| mssdold.vercel.app | c602fbd0… | — | query | 2026-07-02 16:04 |
| hfmthsga.vercel.app | 27863ea6… | — | query | 2026-07-02 15:50 |
| pljnsad.vercel.app | ae43a5b3… | — | query | 2026-07-02 15:50 |
| tommbtaq.vercel.app | 7a1f3dea… | — | query | 2026-07-02 12:50 |
| tommbtaq.vercel.app | 44ebdf10… | — | query | 2026-07-02 12:50 |
| mmbxcdfg.vercel.app | 8bb94cef… | — | query | 2026-07-02 12:50 |
| mmbxcdfg.vercel.app | e02afc1f… | — | query | 2026-07-02 02:50 |