Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.
299 hunts·35 hit in the last 24 hours·59,477 sightings
highbtbuu-fake-crypto-exchangephishingmatches by scriptadded 2026-05-26
Fake crypto-derivatives exchange kit. Operator-deployed K-line / Contract / Trade UI across btbuu.com, wbitx.cfd, trade-maxs.com, evergreen-capital.org. Path pattern /Public/Static/js/*, page pattern /Contract/index, /Trade/index?type=buy&symbol=*. The kit also bundles the genuine pako.min.js zlib library, which is not used as an anchor; these are the operator-specific files.
criticalbluemoon-shadowpad-2026-09othermatches by queryadded 2026-09-12
A scanned page that CONTACTS the actor's infrastructure - the compromised-victim case, rather than someone scanning the C2 itself. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09).
criticalinfrahunter-sg-vps-miku-2026-08othermatches by queryadded 2026-09-14
Chinese-speaking operator (alias "Miku", SSH key comment summadeus@DESKTOP-VD5TFRQ). Activity: New API Stripe-webhook quota fraud; FOFA- and LLM-assisted mapping of Vietnamese military and police assets; credential spraying and subdomain enumeration against Pakistani defence domains; and a SQL injection to JSP web shell compromise of a Mexican billing platform. 69.48.228.86 (BL Networks AS399629, SG) serves the actor's open directories on :80 and :9001 and a chisel reverse-tunnel C2 server on :443. 38.246.232.11 (NetLab Global AS979, US) is a compromised New API gateway on :3000 that the operator uses as its LLM backend.
highinfrahunter-sg-vps-miku-2026-08othermatches by YARAadded 2026-09-14
A directory listing (Python http.server 'Directory listing for', or nginx/Apache 'Index of /') that exposes two or more of the operator's own tool and output file names. Tool files: New API quota fraud (succeaccounts.txt, ulneurls.txt), asset mapping (classify_assets.py, probe_vps.py, uu_search1), the SOCKS5/HTTP proxy pool (freshen_socks5.py, build_conn_pool.py, build_http_plain.py, refresh_http_pool.sh, glider_socks5.conf, verify3.py). Recon output: ffuf443.json. Matched by a YARA rule on the page HTML.
mediuminfrahunter-sg-vps-miku-2026-08othermatches by queryadded 2026-09-14
A Python http.server directory listing (title 'Directory listing for …') served from AS399629 BL Networks, the provider behind the operator's 69.48.228.86. The row exists to surface a redeployment of the same open-directory habit on a fresh BL Networks IP.
highinfrahunter-sg-vps-miku-2026-08othermatches by queryadded 2026-09-14
Any directory listing ('Directory listing for' or 'Index of /') whose screenshot OCR shows one of the operator's distinctive file names: ulneurls (list of webhook-accepting New API targets), succeaccounts (confirmed fraud accounts), ffuf443 (ffuf output), fscanx (fscan variant directory) or freshen (from freshen_socks5.py, the SOCKS5 proxy-pool refresher). This row keeps matching after an IP change; the ip: row does not.
criticaldoublecup-clickfix-laasphishingmatches by YARA + queryadded 2026-08-04
Rented ClickFix delivery service active since June 2026. Operators embed a fixed frontend snippet into their own lure pages; DOUBLECUP hosts the steganographic PNG, the session endpoints and the encryption keys. Stage 1 is a clipboard command that finds the cached PNG by exact file size and carves an embedded script out of it, so nothing is downloaded at execution time. Stage 2 derives its decryption key from the victim's public IP, meaning the payload will not decrypt in an offline sandbox. Observed payloads: CountLoader 4.5p (Windows PowerShell and macOS Mach-O) and DeviceManager, a Python RAT that resolves C2 from Ethereum/Polygon smart contracts (EtherHiding) and tunnels over DNS using microsoft.com as a decoy apex.
highnested-subdomain-sister-86c0phishingmatches by scriptadded 2026-05-26
Sister of the existing `nested-subdomain-9003` kit using wildcard-DNS abuse with deeply-nested random subdomains: lycl.cjilea.b7ryzkx.com, lypz.j9ado3.ikxoxfjp.com, uicl.oiusnx0w0.c7m26j3n2k.com:3443 (also serving on non-standard port 3443).
highclick-tld-kit-1f93phishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA across 17 hostnames mostly on .click TLD (bpqsfyum.click, deddrvta.click, hxrygdhl.click, …) plus shakti.top and tea01.bahfn.cn. Different operator from a260ef.
criticalcaptivecrunch-storm2945phishingmatches by queryadded 2026-08-02
Microsoft-reported campaign (2026-07-31): Storm-2945 (Midnight Blizzard / SVR) manipulates hospitality captive-portal traffic to deliver fake browser/OS updates (CornFlake RAT, ChocoShell stealer) and steal Microsoft 365 credentials via device-code-flow and AiTM phishing. Anchors: campaign domains (incl. statistic-g.com, community DNS pivot), C2/AiTM IPs, and the FruitStone operator-panel title "CloudSync Console".
highpoczta-webmail-kit-202607phishingmatches by queryadded 2026-07-02
Byte-identical Polish-webmail ("Poczta") credential-phishing kit deployed across many throwaway *.vercel.app gibberish subdomains. Tracked by the page's exact TLSH fuzzy hash; the pages also share an ssdeep hash and a favicon hash (mmh3 -75849909). Generalizes across the campaign better than a host list. A YARA entry in this family matches the kit's structure directly.
highcrypto-task-scam-appflowothermatches by scriptadded 2026-07-17
Client-rendered uni-app/Vue H5 crypto task-order scam (刷单): deposit USDT (TRC20), earn commissions on tasks, invite-code pyramid. Renders BLANK, so screenshots, page text and form analysis see nothing. Anchored on the rebuild-stable canonical AST hash: Vite content-hashed filenames and bundle hashes rotate per deploy, but the code structure survives. Each anchored module has only been seen on webapp-run.us.
highcrypto-task-scam-appflowothermatches by scriptadded 2026-07-17
Client-rendered uni-app/Vue H5 crypto task-order scam (刷单): deposit USDT (TRC20), earn commissions on tasks, invite-code pyramid. Renders BLANK, so screenshots, page text and form analysis see nothing. Anchored on the rebuild-stable canonical AST hash: Vite content-hashed filenames and bundle hashes rotate per deploy, but the code structure survives. Each anchored module has only been seen on webapp-run.us.
highcrypto-task-scam-appflowothermatches by scriptadded 2026-07-17
Client-rendered uni-app/Vue H5 crypto task-order scam (刷单): deposit USDT (TRC20), earn commissions on tasks, invite-code pyramid. Renders BLANK, so screenshots, page text and form analysis see nothing. Anchored on the rebuild-stable canonical AST hash: Vite content-hashed filenames and bundle hashes rotate per deploy, but the code structure survives. Each anchored module has only been seen on webapp-run.us.
highcrypto-task-scam-appflowothermatches by scriptadded 2026-07-17
Client-rendered uni-app/Vue H5 crypto task-order scam (刷单): deposit USDT (TRC20), earn commissions on tasks, invite-code pyramid. Renders BLANK, so screenshots, page text and form analysis see nothing. Anchored on the rebuild-stable canonical AST hash: Vite content-hashed filenames and bundle hashes rotate per deploy, but the code structure survives. Each anchored module has only been seen on webapp-run.us.
highcrypto-task-scam-appflowothermatches by scriptadded 2026-07-17
Client-rendered uni-app/Vue H5 crypto task-order scam (刷单): deposit USDT (TRC20), earn commissions on tasks, invite-code pyramid. Renders BLANK, so screenshots, page text and form analysis see nothing. Anchored on the rebuild-stable canonical AST hash: Vite content-hashed filenames and bundle hashes rotate per deploy, but the code structure survives. Each anchored module has only been seen on webapp-run.us.
highcrypto-task-scam-appflowothermatches by scriptadded 2026-07-17
Client-rendered uni-app/Vue H5 crypto task-order scam (刷单): deposit USDT (TRC20), earn commissions on tasks, invite-code pyramid. Renders BLANK, so screenshots, page text and form analysis see nothing. Anchored on the rebuild-stable canonical AST hash: Vite content-hashed filenames and bundle hashes rotate per deploy, but the code structure survives. Each anchored module has only been seen on webapp-run.us.
highcrypto-task-scam-appflowothermatches by scriptadded 2026-07-17
Client-rendered uni-app/Vue H5 crypto task-order scam (刷单): deposit USDT (TRC20), earn commissions on tasks, invite-code pyramid. Renders BLANK, so screenshots, page text and form analysis see nothing. Anchored on the rebuild-stable canonical AST hash: Vite content-hashed filenames and bundle hashes rotate per deploy, but the code structure survives. Each anchored module has only been seen on webapp-run.us.
mediumsnowshoe-mailer-kit-2026-09othermatches by queryadded 2026-09-28
Web kit installed on bulk-mail ('snowshoe') spam-sending servers. Each throwaway domain sits on its own IP at a small hosting provider (Apache on Ubuntu, wildcard certificates) and serves three things: a decoy homepage titled 'Home | <domain>' that reprints a New York Times RSS section so the sender looks like a real website; a click tracker at /redirect.html?od=<token> that sends real recipients on to affiliate offers (online casinos, 'you won' prize pages, fake security warnings) and bounces recognised security scanners to a major brand's homepage; and an /out.php?email=<address> 'Unsubscribe' page pre-filled with the recipient's address, which confirms to the sender that the address is live. The domains are randomly named (e.g. thapiourgo[.]com, quisenagid[.]net, kulas.allidity[.]info, rempel.mereanreng[.]org), often with a surname as subdomain, and are replaced within weeks. Seen since at least December 2024 and still active in September 2026.
