Threat Hunting

Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.

299 hunts·34 hit in the last 24 hours·59,477 sightings

Add hunt

Last hit, across 299 hunts

SortGroup by family

Severity

Showing 151–180 of 299 hunts · sorted by last hit

hhmh Numbered Brand Series — chunk-vendors
highhhmh-numeric-891dphishingmatches by scriptadded 2026-05-26
10-host numbered series: hanhan12.com + hhmh1[386|387|388|389|390|397|398|399|400].com.
sightings
14
hosts
14
last hit
3 months ago
Meta 'Page Appeal' kit — main.ca88c9b6.js cohort (content anchor)
highmeta-page-appealphishingmatches by scriptadded 2026-07-07
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. This entry tracks one build of the kit's React bundle.
sightings
10
hosts
10
last hit
3 months ago
Multi-Brand pages.dev Phish Kit — yandex js.js
criticalmultibrand-pagesdev-phishphishingmatches by scriptadded 2026-05-27
360-yandex-mail cohort js.js — 9 hosts.
sightings
12
hosts
10
last hit
3 months ago
Tokyo Financial Exchange Impersonation #2 — chunk-vendors
criticaltokyo-financial-exchange-5833phishingmatches by scriptadded 2026-05-26
Companion build of the Tokyo Financial Exchange impersonation kit. Same host (tokyofinancialexchange.work) but second chunk hash — different cohort build of the same kit.
sightings
2
hosts
2
last hit
4 months ago
Tokyo Financial Exchange Impersonation #1 — chunk-vendors
criticaltokyo-financial-exchange-bd76phishingmatches by scriptadded 2026-05-26
1 host so far (tokyofinancialexchange.work) impersonating Tokyo Financial Exchange (real Japanese exchange). Anchored on script structure, so future rebuilds of the kit also match.
sightings
2
hosts
2
last hit
4 months ago
Microsoft Attack Simulation Training
benignmicrosoft-attack-simulatorbenignmatches by queryadded 2026-06-24
Microsoft Defender for O365 "Attack simulation training" — Microsoft-owned decoy domains serving Microsoft-branded login pages for phishing-awareness testing. Benign; tracked for inventory only. The whole fleet shares one TLS certificate (issuer Microsoft Corporation, CN www.attemplate.com, 131 SANs), which is how it is tracked.
sightings
3
hosts
3
last hit
4 months ago
Random-Domain Vue Scam Kit (icu/sbs/shop/cyou) — chunk-vendors
highrandom-domain-kit-0e990cphishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA deployed across 63 random-letter hostnames on .icu/.sbs/.cyou/.shop TLDs. Hostnames are keyboard-mash strings (e.g. baiiwerogkasdfg.sbs, bbqupospdkgkaj.shop, bjioqjksdjkskzx.cyou).
sightings
76
hosts
64
last hit
4 months ago
Wildcard-DNS Port-3443 Cohort — chunk-vendors
highwildcard-port3443-aa15phishingmatches by scriptadded 2026-05-26
4-host wildcard-DNS abuse sister of nested-subdomain-9003, serving on non-standard port 3443: tyyx.dakowe.1bdbr3.com:3443, tyyx.ooios.mgqlfa.com:3443.
sightings
8
hosts
5
last hit
4 months ago
Random-Letter Multi-TLD Kit (shop/cyou/icu/sbs) — 16h
highrandom-letter-multitld-8999phishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA across 16 random-letter hostnames on .shop/.cyou/.icu/.sbs TLDs.
sightings
19
hosts
16
last hit
5 months ago
Random-Letter Multi-TLD Kit (cyou/icu/shop/sbs) — 16h
highrandom-letter-multitld-95edphishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA across 16 random-letter hostnames on .cyou/.icu/.shop/.sbs TLDs.
sightings
17
hosts
16
last hit
5 months ago
Random-Letter Multi-TLD Kit (icu/shop/cyou/sbs) — 15h
highrandom-letter-multitld-9cbaphishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA across 15 random-letter hostnames on .icu/.shop/.cyou/.sbs TLDs.
sightings
16
hosts
15
last hit
5 months ago
slh Numbered Series + slhofworld — chunk-vendors
highslh-numeric-9aa7phishingmatches by scriptadded 2026-05-26
4-host numbered brand series: slh005.com, slh006.com, …, slhofworld.vip.
sightings
4
hosts
4
last hit
5 months ago
J365 Gambling Platform — CometMarathon.js
highj365-gambling-platformothermatches by scriptadded 2026-05-26
Long-poll companion to Comet.js — secondary WebSocket channel used by the J365 illegal-gambling platform.
sightings
12
hosts
5
last hit
5 months ago
J365 Gambling Platform — gui-base.js
highj365-gambling-platformothermatches by scriptadded 2026-05-26
Chinese-language illegal online-gambling platform served from a rotating set of brand-prefixed landing domains (j365*.xyz, lvs*.vip, hgty*.vip, hg*.vip, usdbetvip*.biz, xpj*.com — including punycoded variants) backed by a small set of operator CDN hosts on pham.xin and yqdkrj.com under the path /ftl/commonPage/. Offers fish-shooter, casino, sports, chess games. gui-base.js is the kit's shared UI framework.
sightings
12
hosts
5
last hit
5 months ago
J365 Gambling Platform — Comet.js
highj365-gambling-platformothermatches by scriptadded 2026-05-26
Custom WebSocket C2/heartbeat code (/websocket/Comet.js) used by the J365 illegal-gambling platform. Operator-specific real-time channel for bet placement, balance updates, and admin control.
sightings
12
hosts
5
last hit
5 months ago
Chinese Kaiyun Gambling Kit — js/app
highcn-kaiyun-gambling-7460phishingmatches by scriptadded 2026-05-27
42-host Chinese gambling operator running "Kaiyun" brand impersonation across cn-kaiyunapp.vip, zh-kaiyuntiyu.vip, danti4833.com subdomains with random hostname prefixes. Path pattern /js/app.<hash>.js. Kaiyun (开云) is a known Chinese gambling brand frequently impersonated; "kaiyun" naming + Chinese-numeric subdomains is a strong operator signature.
sightings
42
hosts
42
last hit
5 months ago
[X][N].cn Random-Pattern Kit — chunk-vendors
highletterhex-cn-25f3phishingmatches by scriptadded 2026-05-26
7-host operator on .cn TLD with letter+digit random pattern: j3h1k9.cn, m9u6y0.cn, n4c6v5.cn, p4i6o3.cn, q4x9v6.cn, q7e2r6.cn, q8t4y7.cn.
sightings
14
hosts
7
last hit
5 months ago
Pages.dev Vue Investment Scam — pimco cohort chunk-vendors
highpagesdev-vue-investment-scamphishingmatches by scriptadded 2026-05-26
PIMCO-impersonation cohort of the Pages.dev Vue investment-scam kit. PIMCO (Pacific Investment Management Company) is a major real-world asset manager — this kit lures users into a fake investment platform under that brand.
sightings
4
hosts
4
last hit
5 months ago
Golden Shield AI Investment Scam — chunk-vendors
highgoldenshieldai-47907aphishingmatches by scriptadded 2026-05-26
4-host operator running "Golden Shield AI" investment-scam brand across multi-TLD: goldenshieldai.homes, goldenshieldai.lat, goldenshieldai.online. Same brand, throwaway TLDs.
sightings
5
hosts
4
last hit
5 months ago
Meituan Brand Impersonation + Chinese Names — chunk-vendors
highmeituan-impersonation-c171phishingmatches by scriptadded 2026-05-26
Operator across 16 hosts impersonating Meituan (Chinese super-app): qiqimeituan.xyz, shengmeituan.xyz, plus generic Chinese-themed names (songsong123.xyz, tangtang123.asia, zhanxupeng6.asia) and qazwsxNNN.asia placeholders.
sightings
22
hosts
16
last hit
5 months ago
xpj/uuyl Numeric Lottery/Gambling — chunk-vendors
highxpj-uuyl-1a5ephishingmatches by scriptadded 2026-05-26
7-host operator: 266229.com, 500698.com, 500798.com, klyl6.net, www.uuyl.net, www.uuyl.xyz, xpj2487.com. Chinese-style numeric gambling/lottery brands.
sightings
9
hosts
7
last hit
5 months ago
Azure Static Web Apps Sister Cohort — chunk-vendors
highazure-swa-sister-119aphishingmatches by scriptadded 2026-05-26
Sister of the existing `cloud-storage-abuse-72ea` kit. 5 hosts on Azure Static Web Apps: abw219, hk3091, london25, nsd90317, xdl719 — geographic-cohort naming (HK=Hong Kong, london, etc.) suggests targeted-region phishing.
sightings
9
hosts
5
last hit
5 months ago
CME/NYSE Multi-Broker Sister Cohort — chunk-vendors
criticalmulti-broker-sister-e21cphishingmatches by scriptadded 2026-05-26
Sister cohort of multi-broker-impersonation-195a. 3 hosts: cmenyses.com (CME+NYSE), cmekeya.com (CME+Keya). Same operator running additional broker-name combinations.
sightings
3
hosts
3
last hit
5 months ago
Shopify Brand Impersonation — chunk-vendors
criticalshopify-impersonation-5512phishingmatches by scriptadded 2026-05-26
1 host (shoopeifyus.com) impersonating Shopify. Triple-vowel "shoopeify" + "us" suffix is a textbook brand-typo phishing pattern.
sightings
5
hosts
1
last hit
6 months ago
Tigo El Salvador Brand Impersonation — index.js #2
criticallatam-tigo-sv-phish-1b7dphishingmatches by scriptadded 2026-05-26
Companion build of the Tigo SV kit — same 19 hosts, second anchor chunk.
sightings
25
hosts
19
last hit
6 months ago
Tigo El Salvador Brand Impersonation — index.js #1
criticallatam-tigo-sv-phish-1b7dphishingmatches by scriptadded 2026-05-26
Brand-impersonation phishing kit targeting Tigo El Salvador (major LATAM telecom). 19 hosts on .cc/.help/.click/.art/.sbs/.top with tigo-prefixed names (sv-tigo.cc, tigoboss.help, tigosrwvp.help, tigovseop.click, tigovspom.help, …). Page title: "La primera Red 5G de El Salvador | Tigo El Salvador" (direct quote from real Tigo SV marketing). URL path /apps/SV_PT_01/assets/index-*.js — sister to the Telcel MX MX_PT_06 kit, same operator.
sightings
25
hosts
19
last hit
6 months ago
Azure/Tencent Cloud Storage Abuse Kit — chunk-vendors
highcloud-storage-abuse-72eaphishingmatches by scriptadded 2026-05-26
7-host operator abusing free cloud storage to host the SPA: 5 Azure Static Web Apps (*.zNN.web.core.windows.net) + Tencent Cloud Object Storage (*.pichk.myqcloud.com). The cloud-vendor domains lend false legitimacy.
sightings
18
hosts
7
last hit
6 months ago
Snowshoe spam-mailer kit — pre-filled 'Unsubscribe' page that confirms your address
highsnowshoe-mailer-kit-2026-09othermatches by YARAadded 2026-09-28
Web kit installed on bulk-mail ('snowshoe') spam-sending servers. Each throwaway domain sits on its own IP at a small hosting provider (Apache on Ubuntu, wildcard certificates) and serves three things: a decoy homepage titled 'Home | <domain>' that reprints a New York Times RSS section so the sender looks like a real website; a click tracker at /redirect.html?od=<token> that sends real recipients on to affiliate offers (online casinos, 'you won' prize pages, fake security warnings) and bounces recognised security scanners to a major brand's homepage; and an /out.php?email=<address> 'Unsubscribe' page pre-filled with the recipient's address, which confirms to the sender that the address is live. The domains are randomly named (e.g. thapiourgo[.]com, quisenagid[.]net, kulas.allidity[.]info, rempel.mereanreng[.]org), often with a surname as subdomain, and are replaced within weeks. Seen since at least December 2024 and still active in September 2026.
sightings
9
hosts
4
last hit
6 months ago
CME/AMEX/NYSE/Schwab Multi-Broker Impersonation — chunk-vendors
criticalmulti-broker-impersonation-195aphishingmatches by scriptadded 2026-05-26
6-host operator running MULTIPLE major financial-brand impersonations from a single template: cmeamex.com, cmeamexs.com, cmenyse.com (CME+AMEX, CME+NYSE), schwabvs.com (Charles Schwab), tradesoksca.com, tradesokscs.com. Single SPA deployed under each broker's name.
sightings
8
hosts
6
last hit
6 months ago
.click TLD Rotation Kit — chunk-vendors
highclick-tld-kit-a260efphishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA deployed across 31 hostnames ALL on the .click TLD with 8-character random hostnames (aicjgkjk.click, cbcsljlc.click, pshhttokse.click, qhzelnxa.click, …). Uniform TLD + hostname pattern is a strong operator signal.
sightings
39
hosts
31
last hit
6 months ago