Threat Hunting

Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.

299 hunts·34 hit in the last 24 hours·59,477 sightings

Add hunt

Last hit, across 299 hunts

SortGroup by family

Severity

Showing 181–210 of 299 hunts · sorted by last hit

Fake-Telegram Phishing Kit — compatTest.js
criticalfake-telegram-dashanphishingmatches by scriptadded 2026-05-27
Browser-compatibility probe of the fake-Telegram kit.
sightings
33
hosts
27
last hit
6 months ago
Fake-Telegram Phishing Kit — webpack chunk 7283
criticalfake-telegram-dashanphishingmatches by scriptadded 2026-05-27
Webpack chunk 7283 of the fake-Telegram kit.
sightings
26
hosts
23
last hit
6 months ago
Multi-Brand pages.dev Phish Kit — naver cohort js.js
criticalmultibrand-pagesdev-phishphishingmatches by scriptadded 2026-05-27
Naver (Korean) cohort js.js — 8 hosts.
sightings
13
hosts
8
last hit
6 months ago
COMEX/Tada Cloud-Hosted Trading Kit — chunk-vendors
criticalfake-trading-platform-d7a2phishingmatches by scriptadded 2026-05-26
6-host operator hosting fake trading platform on Azure Static Web Apps + .top with port: comex309.z1.web.core.windows.net + secondary, tada1912.z23.web.core.windows.net + tada93179, web6699.313675.top:39395. "COMEX" = Commodity Exchange impersonation; "tada" branding signals throwaway cohorts.
sightings
14
hosts
6
last hit
6 months ago
Random-Letter .com Rotation — chunk-vendors
highrandom-letter-com-199cphishingmatches by scriptadded 2026-05-26
11-host operator running 10-letter random .com hostnames (cjnwqvprty.com, dkpvtrmzla.com, fgrtqpxlme.com, …).
sightings
19
hosts
11
last hit
6 months ago
Random-TLD Multi-Domain Rotation Kit — main.v2.js
highhevvugu-multi-domainphishingmatches by scriptadded 2026-05-26
Single shared main.v2.js deployed across 17 throwaway domains on cheap/suspicious TLDs (.icu, .sbs, .cfd, .cyou, .shop, .wiki, .one, .asia, .club). Includes telegran.one — Telegram brand impersonation. All 17 hosts serve the same script, so one fingerprint covers the whole rotation.
sightings
84
hosts
32
last hit
6 months ago
Random-Alphanumeric .vip Kit — chunk-vendors
highrandom-vip-alphanum-0165phishingmatches by scriptadded 2026-05-26
7-host operator running long random alphanumeric .vip hostnames: cxwf0r2o9t9w1o9w7.vip, hiut9h0v4l2d7a7v0.vip, ijne8g2c1f5q0f9l5.vip, kmkf1e3z8z8s5q2k0.vip, vbja9y9n8u0w5s2b6.vip, vbjk2x2t9z3m6g7s2.vip, vcve2mcixbkl3kfd32fg.vip.
sightings
8
hosts
7
last hit
6 months ago
chd-suffix .com Random Rotation — chunk-vendors
highchd-suffix-com-f6c1phishingmatches by scriptadded 2026-05-26
7-host operator: aeychdent.com, caichdfdt.com, daochderu.com, ejgchdcbt.com, fjhchdlep.com, gajchdvbt.com, hajchdkru.com. Uniform `chd` substring at positions 4-6 in random-alpha .com hostnames.
sightings
9
hosts
7
last hit
6 months ago
Random-Letter .com Rotation Sister — js/app
highrandom-letter-com-sister-a218phishingmatches by scriptadded 2026-05-27
Sister cohort of random-letter-com-199c. 18 hosts with 10-letter random .com hostnames (2zrlupki.com, luckrfbyjg.com, …). Different bundler path (/js/app.<hash>.js) than the original 199c kit.
sightings
28
hosts
18
last hit
6 months ago
dhptgo Multi-TLD Same-Prefix — chunk-vendors
highdhptgo-multitld-ea03phishingmatches by scriptadded 2026-05-26
4-host same-prefix multi-TLD operator: dhptgo.cc, dhptgo.sbs, dhptgo.top.
sightings
4
hosts
4
last hit
6 months ago
BitMax Crypto-Exchange Impersonation — chunk-vendors
highbitmax-impersonation-8632phishingmatches by scriptadded 2026-05-26
5-host operator impersonating BitMax (real crypto exchange now rebranded to AscendEX). bitmax123.com cohort.
sightings
16
hosts
5
last hit
6 months ago
htxnadf.top Operator — js/app
highhtxnadf-2503phishingmatches by scriptadded 2026-05-27
5-host operator running random-named .top hostnames anchored on htxnadf.top.
sightings
9
hosts
5
last hit
6 months ago
AMP Futures Brand Impersonation — index.js
criticalamp-futures-phish-a637phishingmatches by scriptadded 2026-05-26
Brand-impersonation phishing kit targeting AMP Futures (US futures broker, ampfutures.com). Deployed across 62 random-letter .xyz hostnames matching pattern [a-z][0-9][a-z][0-9][a-z].xyz (a2q6w.xyz, a4k7n.xyz, b2k9t.xyz, …). All 62 hosts serve the page title "AMP Futures".
sightings
68
hosts
62
last hit
6 months ago
tuops Sister Cohort — chunk-vendors
hightuops-sister-eab1phishingmatches by scriptadded 2026-05-26
3-host random-domain sister cohort surfaced via cosine pivot. tuops.top cohort.
sightings
4
hosts
3
last hit
6 months ago
Pages.dev Vue Investment Scam — mint-34z cohort chunk-vendors
highpagesdev-vue-investment-scamphishingmatches by scriptadded 2026-05-26
mint-34z.pages.dev cohort build of the Pages.dev Vue investment-scam kit.
sightings
1
hosts
1
last hit
7 months ago
Cimamedia/Speedride Sister Cohort — chunk-vendors
highcimamedia-speedride-sister-5f2ephishingmatches by scriptadded 2026-05-26
Sister cohort of the existing `cimamedia-speedride-682f` kit: cimamedia0i.com, cimamedia99.com, cimamediaia.com, speedride0i.com, speedridecc.com, speedridezz.com. Same operator, second build hash.
sightings
6
hosts
6
last hit
7 months ago
MeridianLink Lending-Tech Impersonation — chunk-vendors
criticalmeridianlink-impersonation-7cbcphishingmatches by scriptadded 2026-05-26
3-host operator impersonating MeridianLink (real US lending/banking tech company). meridianlinkgroup.com cohort.
sightings
3
hosts
3
last hit
7 months ago
Huawei Brand Impersonation — chunk-vendors
highhuawei-impersonation-788fphishingmatches by scriptadded 2026-05-26
4-host operator running Huawei brand impersonation: huaw3.cn, huaw3.com plus wzg56.cc, wzg71.cc sister hosts. "huaw" is the operator-chosen prefix mimicking "huawei".
sightings
4
hosts
4
last hit
7 months ago
aazzkf Multi-TLD Same-Prefix Kit — chunk-vendors
highaazzkf-multitld-36dfphishingmatches by scriptadded 2026-05-26
4-host same-prefix multi-TLD operator: aazzkf.cc, aazzkf.com, aazzkf.org, aazz-kf.com. Sister pattern to aaoopg-eejjkf-02d6.
sightings
4
hosts
4
last hit
7 months ago
Cimamedia/Speedride Sister-Brand Rotation — chunk-vendors
highcimamedia-speedride-682fphishingmatches by scriptadded 2026-05-26
15-host operator running two parallel brand prefixes: cimamedia[88|92|9i|aa|io|ip|vi|vip|vvip].com and speedride[88|92|9i|ia|io|vi].com.
sightings
15
hosts
15
last hit
7 months ago
.click TLD Vue Sister Cohort (6287713d) — chunk-vendors
highclick-tld-sister-6287phishingmatches by scriptadded 2026-05-26
Sister cohort of the existing click-tld-kit-a260ef. 2 hosts: manwasite.cc, mwxz10.cc. Cosine-pivoted at sim=1.0000.
sightings
4
hosts
2
last hit
7 months ago
Gambling Vue PWA Kit — VappWorker.js (PWA service worker)
criticalgambling-vue-pwa-1fb0phishingmatches by scriptadded 2026-05-27
PWA service worker (/push/vapp/VappWorker.js) of the gambling kit. The PWA architecture is distinctive — most kits don't register service workers; this one does (for push notifications / offline-mode fake-app feel).
sightings
288
hosts
225
last hit
7 months ago
Gambling Vue PWA Kit — index-v431.js
criticalgambling-vue-pwa-1fb0phishingmatches by scriptadded 2026-05-27
127-host gambling/casino app Vue PWA kit. ONE operator running random brand hostnames across .shop/.world/.store/.site/.website/.com TLDs. Page titles include "Tower Rush", "Chicken Road", "Lucky Casino", "Chicken Road 2", "BEAST GAMES: ICE FISHING", "Ice Fishing", "Revolut Slots" (Revolut bank brand impersonation in a slots scam). Path pattern /assets/<chunk>-v431.js + PWA service workers (/PwaWorker.js, /push/vapp/VappWorker.js).
sightings
537
hosts
209
last hit
7 months ago
Gambling Vue PWA Kit — vue-core-v431.js
criticalgambling-vue-pwa-1fb0phishingmatches by scriptadded 2026-05-27
Vendor bundle of the gambling Vue PWA kit (Vue runtime core, v431 cohort).
sightings
528
hosts
209
last hit
7 months ago
Gambling Vue PWA Kit — MarketPageComponent-v431.js
criticalgambling-vue-pwa-1fb0phishingmatches by scriptadded 2026-05-27
Marketplace page chunk for the gambling kit — renders the fake-casino game catalogue.
sightings
507
hosts
202
last hit
7 months ago
Gambling Vue PWA Kit — App-v442.js (newer cohort)
criticalgambling-vue-pwa-1fb0phishingmatches by scriptadded 2026-05-27
Newer cohort build (v442) of the same gambling Vue PWA kit. Same operator, kit upgraded.
sightings
192
hosts
82
last hit
7 months ago
Random-Domain Vue Scam Kit (sbs/qpon/cyou) — chunk-vendors
highrandom-domain-kit-c73042phishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA deployed across 32 random-letter hostnames on .sbs/.qpon/.cyou/.click/.icu TLDs (iewyrgajdghfvdhdjs.sbs, jkahskdnzl6kajhmza.qpon, …). Includes the .qpon TLD which is rare and a strong scam-infrastructure marker.
sightings
35
hosts
32
last hit
7 months ago
Portuguese/Brazilian Gambling Rotation — chunk-vendors
highpt-brazil-gambling-80bephishingmatches by scriptadded 2026-05-26
8-host operator running Portuguese/Brazilian-language gambling brands: 54rr.win, 91-earring-pg.vip, muito-777.win ("777" + Portuguese for "a lot"), okokflash.mom, voy-brow-pg.vip, we-operapg.mom ("opera-pg"), wgbetkk.win, wg-relogio.win ("relogio" = watch).
sightings
24
hosts
8
last hit
7 months ago
Random-Letter Multi-TLD Kit (shop/sbs/cyou/icu) — 13h
highrandom-letter-multitld-74f3phishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA across 13 random-letter hostnames on .shop/.sbs/.cyou/.icu TLDs.
sightings
20
hosts
13
last hit
7 months ago
COMEX/Ortex Trading Impersonation — chunk-vendors
criticalcomex-ortex-impersonation-61eaphishingmatches by scriptadded 2026-05-26
6-host operator: comex-ex.com, comex-glob.com, comex-next.com, comex-next-desk.com, ortexlabs.com, ortexportal.com. COMEX + Ortex (real institutional trading-research firm) impersonation. Sister of the d7a2 cluster.
sightings
6
hosts
6
last hit
7 months ago