Known malicious kithighphishing
Random-TLD Multi-Domain Rotation Kit — main.v2.js
family: hevvugu-multi-domain
Short link:scanmalware.com/h/16
Single shared main.v2.js deployed across 17 throwaway domains on cheap/suspicious TLDs (.icu, .sbs, .cfd, .cyou, .shop, .wiki, .one, .asia, .club). Includes telegran.one — Telegram brand impersonation. All 17 hosts serve the same script, so one fingerprint covers the whole rotation.
Anchors
Provenance
Added: 2026-05-26 14:39
Single anchor — the kit serves the same main.v2.js across all 17 known sister domains.
Sightings (84)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| hua456t.xyz | 22ccda8b… | https://hua456t.xyz/main.v2.js | structure | 2026-04-08 11:06 |
| hua456t.xyz | 22ccda8b… | https://hua456t.xyz/main.v2.js | structure | 2026-04-08 11:06 |
| hua456t.xyz | 22ccda8b… | https://hua456t.xyz/main.v2.js | structure | 2026-04-08 11:06 |
| claw111a.xyz | fca24554… | https://claw111a.xyz/main.v2.js | structure | 2026-04-06 03:20 |
| bot789c.xyz | 1bb0a9e8… | https://bot789c.xyz/main.v2.js | structure | 2026-04-06 02:31 |
| bot789c.xyz | 1bb0a9e8… | https://bot789c.xyz/main.v2.js | structure | 2026-04-06 02:31 |
| bot789c.xyz | 5ea2425a… | https://bot789c.xyz/main.v2.js | structure | 2026-04-05 20:51 |
| testxyz123.top | ef98f6a6… | https://testxyz123.top/main.v2.js | structure | 2026-04-05 13:45 |
| testxyz123.top | ef98f6a6… | https://testxyz123.top/main.v2.js | structure | 2026-04-05 13:45 |
| tech000f.xyz | 8b13fe1b… | https://tech000f.xyz/main.v2.js | structure | 2026-04-04 10:01 |
| ai123h.xyz | f06ed6dc… | https://ai123h.xyz/main.v2.js | structure | 2026-04-04 06:50 |
| ai123h.xyz | f06ed6dc… | https://ai123h.xyz/main.v2.js | structure | 2026-04-04 06:50 |
| ai123h.xyz | f06ed6dc… | https://ai123h.xyz/main.v2.js | structure | 2026-04-04 06:50 |
| hua456t.xyz | aa693d07… | https://hua456t.xyz/main.v2.js | structure | 2026-04-03 20:51 |
| hua456t.xyz | aa693d07… | https://hua456t.xyz/main.v2.js | structure | 2026-04-03 20:51 |
| testxyz123.top | 195a93b1… | https://testxyz123.top/main.v2.js | structure | 2026-04-03 03:29 |
| zeltrixx.top | 8ea84911… | https://zeltrixx.top/main.v2.js?v=2 | structure | 2026-03-18 22:14 |
| zeltrixa.top | 051e944f… | https://zeltrixa.top/main.v2.js?v=2 | structure | 2026-03-18 17:38 |
| zeltrinz.top | e2219d47… | https://zeltrinz.top/main.v2.js?v=2 | structure | 2026-03-18 16:52 |
| zeltrinz.top | a99cc459… | https://zeltrinz.top/main.v2.js?v=2 | structure | 2026-03-17 06:51 |
| zeltrinz.top | a99cc459… | https://zeltrinz.top/main.v2.js?v=2 | structure | 2026-03-17 06:51 |
| zeltrinz.top | a99cc459… | https://zeltrinz.top/main.v2.js?v=2 | structure | 2026-03-17 06:51 |
| zeltrinz.top | a99cc459… | https://zeltrinz.top/main.v2.js?v=2 | structure | 2026-03-17 06:51 |
| zeltrixx.top | c50b5049… | https://zeltrixx.top/main.v2.js?v=2 | structure | 2026-03-17 00:27 |
| zeltrixx.top | c50b5049… | https://zeltrixx.top/main.v2.js?v=2 | structure | 2026-03-17 00:27 |
| zeltrixx.top | c50b5049… | https://zeltrixx.top/main.v2.js?v=2 | structure | 2026-03-17 00:27 |
| telegran.one | fa3ccd07… | https://telegran.one/main.v2.js | byte | 2026-03-16 09:59 |
| zeltrixa.top | e2132556… | https://zeltrixa.top/main.v2.js?v=2 | structure | 2026-03-16 08:13 |
| zeltrixa.top | e2132556… | https://zeltrixa.top/main.v2.js?v=2 | structure | 2026-03-16 08:13 |
| zeltrixo.top | 93d3bdd1… | https://zeltrixo.top/main.v2.js?v=2 | structure | 2026-03-15 18:17 |
| zeltrixo.top | 93d3bdd1… | https://zeltrixo.top/main.v2.js?v=2 | structure | 2026-03-15 18:17 |
| hurvovo.cyou | 0619c150… | https://hurvovo.cyou/main.v2.js | byte | 2026-03-15 08:34 |
| zelviro.top | 8d672d59… | https://zelviro.top/main.v2.js?v=2 | structure | 2026-03-15 07:49 |
| munvigo.cfd | 31416df6… | https://munvigo.cfd/main.v2.js | byte | 2026-03-15 03:00 |
| munvigo.cfd | 31416df6… | https://munvigo.cfd/main.v2.js | byte | 2026-03-15 03:00 |
| 862m23.icu | 12e6d172… | https://862m23.icu/main.v2.js | byte | 2026-03-15 02:51 |
| karvexo.cfd | a188ca39… | https://karvexo.cfd/main.v2.js?v=2 | structure | 2026-03-14 17:19 |
| karvexo.cfd | a188ca39… | https://karvexo.cfd/main.v2.js?v=2 | structure | 2026-03-14 17:19 |
| karvexo.cfd | a188ca39… | https://karvexo.cfd/main.v2.js?v=2 | structure | 2026-03-14 17:19 |
| hevvugu.icu | 1216a1b0… | https://hevvugu.icu/main.v2.js | byte | 2026-03-14 17:17 |
| hevvugu.icu | 1216a1b0… | https://hevvugu.icu/main.v2.js | byte | 2026-03-14 17:17 |
| hevvugu.icu | 1216a1b0… | https://hevvugu.icu/main.v2.js | byte | 2026-03-14 17:17 |
| hevvugu.icu | 1216a1b0… | https://hevvugu.icu/main.v2.js | byte | 2026-03-14 17:17 |
| hevvugu.icu | 1216a1b0… | https://hevvugu.icu/main.v2.js | byte | 2026-03-14 17:17 |
| selnixzfo.shop | e9e48b50… | https://selnixzfo.shop/main.v2.js | byte | 2026-03-14 12:15 |
| selnixzfo.shop | e9e48b50… | https://selnixzfo.shop/main.v2.js | byte | 2026-03-14 12:15 |
| selnixzfo.shop | e9e48b50… | https://selnixzfo.shop/main.v2.js | byte | 2026-03-14 12:15 |
| selnixzfo.shop | b0c47292… | https://selnixzfo.shop/main.v2.js | byte | 2026-03-14 10:31 |
| selnixzfo.shop | b0c47292… | https://selnixzfo.shop/main.v2.js | byte | 2026-03-14 10:31 |
| gnvrog.cfd | 8dd907da… | https://gnvrog.cfd/main.v2.js | byte | 2026-03-14 10:26 |
| narviko.top | 26829e4f… | https://narviko.top/main.v2.js?v=2 | structure | 2026-03-14 05:12 |
| pernixzga.shop | 20a5fbc8… | https://pernixzga.shop/main.v2.js | byte | 2026-03-13 18:52 |
| pernixzga.shop | 20a5fbc8… | https://pernixzga.shop/main.v2.js | byte | 2026-03-13 18:52 |
| pernixzga.shop | 20a5fbc8… | https://pernixzga.shop/main.v2.js | byte | 2026-03-13 18:52 |
| sevvopa.cfd | e384b945… | https://sevvopa.cfd/main.v2.js | byte | 2026-03-13 12:01 |
| sevvopa.cfd | e384b945… | https://sevvopa.cfd/main.v2.js | byte | 2026-03-13 12:01 |
| sevvopa.cfd | e384b945… | https://sevvopa.cfd/main.v2.js | byte | 2026-03-13 12:01 |
| sevvopa.cfd | e384b945… | https://sevvopa.cfd/main.v2.js | byte | 2026-03-13 12:01 |
| sevvopa.cfd | e384b945… | https://sevvopa.cfd/main.v2.js | byte | 2026-03-13 12:01 |
| dulvici.sbs | 815b338d… | https://dulvici.sbs/main.v2.js | byte | 2026-03-13 03:43 |
| morvixzde.shop | 93880b9a… | https://morvixzde.shop/main.v2.js | byte | 2026-03-13 03:32 |
| keriox.sbs | 9fe2d8da… | https://keriox.sbs/main.v2.js | byte | 2026-03-12 19:55 |
| keriox.sbs | 9fe2d8da… | https://keriox.sbs/main.v2.js | byte | 2026-03-12 19:55 |
| keriox.sbs | 9fe2d8da… | https://keriox.sbs/main.v2.js | byte | 2026-03-12 19:55 |
| dulvici.sbs | 5469a919… | https://dulvici.sbs/main.v2.js | byte | 2026-03-12 09:58 |
| wusmula.icu | abfb3586… | https://wusmula.icu/main.v2.js | byte | 2026-03-12 06:32 |
| wusmula.icu | abfb3586… | https://wusmula.icu/main.v2.js | byte | 2026-03-12 06:32 |
| wusmula.icu | abfb3586… | https://wusmula.icu/main.v2.js | byte | 2026-03-12 06:32 |
| wusmula.icu | abfb3586… | https://wusmula.icu/main.v2.js | byte | 2026-03-12 06:32 |
| senvaro.top | bac2b01d… | https://senvaro.top/main.v2.js?v=2 | structure | 2026-03-12 01:31 |
| melviro.cfd | 3c02e9e9… | https://melviro.cfd/main.v2.js?v=2 | structure | 2026-03-12 00:35 |
| worvicu.icu | ca24535f… | https://worvicu.icu/main.v2.js | byte | 2026-03-11 22:41 |
| worvicu.icu | ca24535f… | https://worvicu.icu/main.v2.js | byte | 2026-03-11 22:41 |
| norvaxzbi.shop | a437ba98… | https://norvaxzbi.shop/main.v2.js | byte | 2026-03-11 22:11 |
| norvaxzbi.shop | a437ba98… | https://norvaxzbi.shop/main.v2.js | byte | 2026-03-11 22:11 |
| gnvrog.cfd | fe375148… | https://gnvrog.cfd/main.v2.js | byte | 2026-03-11 11:36 |
| gnvrog.cfd | fe375148… | https://gnvrog.cfd/main.v2.js | byte | 2026-03-11 11:36 |
| norvaxzbi.shop | 946623f5… | https://norvaxzbi.shop/main.v2.js | byte | 2026-03-11 11:06 |
| pelvaro.cfd | a56f1e76… | https://pelvaro.cfd/main.v2.js?v=2 | structure | 2026-03-11 00:59 |
| pelvaro.cfd | a56f1e76… | https://pelvaro.cfd/main.v2.js?v=2 | structure | 2026-03-11 00:59 |
| marvona.top | 34e41554… | https://marvona.top/main.v2.js?v=2 | structure | 2026-03-10 12:26 |
| hevvugu.icu | 168ab89a… | https://hevvugu.icu/main.v2.js | byte | 2026-03-10 02:33 |
| hevvugu.icu | 168ab89a… | https://hevvugu.icu/main.v2.js | byte | 2026-03-10 02:33 |
| hevvugu.icu | 168ab89a… | https://hevvugu.icu/main.v2.js | byte | 2026-03-10 02:33 |