ScanMalware.com
Known malicious kithighphishing

Poczta (Polish webmail) phishing kit — page content-hash

family: poczta-webmail-kit-202607
Short link:scanmalware.com/h/146

Byte-identical Polish-webmail ("Poczta") credential-phishing kit deployed across many throwaway *.vercel.app gibberish subdomains. Tracked by the page's exact TLSH fuzzy hash; the pages also share an ssdeep hash and a favicon hash (mmh3 -75849909). Generalizes across the campaign better than a host list. A YARA entry in this family matches the kit's structure directly.

Anchors

SMQL queryrun
tlsh:T1D0B273735161332C950BD92867B4174AA256E42BE58F62C4B6BE1724DFC7E82CDB328C

Provenance

Added: 2026-07-02 16:36

Sightings (24)

HostScanScriptMatchWhen
mssdold.vercel.appdbb22547…—query2026-07-23 19:53
hfmthsga.vercel.app87335576…—query2026-07-23 18:54
pljnsad.vercel.app6999e124…—query2026-07-23 18:52
tommbtaq.vercel.appec48a947…—query2026-07-23 16:53
jjhdgtv.vercel.app826f68df…—query2026-07-23 16:52
mmbxcdfg.vercel.appcb884fed…—query2026-07-23 16:52
mmbxcdfg.vercel.app70dc8e3f…—query2026-07-23 05:53
mssdold.vercel.appcf8a011b…—query2026-07-16 18:52
hfmthsga.vercel.app86884d28…—query2026-07-16 17:54
pljnsad.vercel.app5dd56d9d…—query2026-07-16 17:52
tommbtaq.vercel.app610a1cce…—query2026-07-16 15:52
tommbtaq.vercel.app469f87ec…—query2026-07-16 15:52
jjhdgtv.vercel.app133f734a…—query2026-07-16 14:55
mmbxcdfg.vercel.appf89d3433…—query2026-07-16 14:54
mmbxcdfg.vercel.appa2749b41…—query2026-07-16 04:52
mmbxcdfg.vercel.appca058e36…—query2026-07-09 03:52
jjhdgtv.vercel.app8ed079e9…—query2026-07-02 16:56
mssdold.vercel.appc602fbd0…—query2026-07-02 16:04
hfmthsga.vercel.app27863ea6…—query2026-07-02 15:50
pljnsad.vercel.appae43a5b3…—query2026-07-02 15:50
tommbtaq.vercel.app7a1f3dea…—query2026-07-02 12:50
tommbtaq.vercel.app44ebdf10…—query2026-07-02 12:50
mmbxcdfg.vercel.app8bb94cef…—query2026-07-02 12:50
mmbxcdfg.vercel.appe02afc1f…—query2026-07-02 02:50