Known malicious kithighphishing
.forum TLD Rotation Sister Cohort (cc0aeb) — js/app
family: forum-tld-sister-cc0a
Sister cohort #2 of the .forum-TLD rotation family. 17 hosts with random 10-char hostnames (hvwvwvjwso.forum, nbilrwodrt.forum, …). Different build hash from f969.
Fingerprint anchors
Provenance
Added by: analyst
Added: 2026-05-27 07:09
17 hosts on .forum TLD. Sister of forum-tld-sister-f969.
Sightings (17)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| nbxtlzhvri.forum | e8ff1559… | https://nbxtlzhvri.forum/js/app.80f7ca91.js | structure | 2026-05-23 17:07 |
| nbilrwodrt.forum | 16ba38a6… | https://nbilrwodrt.forum/js/app.80f7ca91.js | structure | 2026-05-23 16:52 |
| hvwvwvjwso.forum | 87d4bb7d… | https://hvwvwvjwso.forum/js/app.80f7ca91.js | structure | 2026-05-23 16:31 |
| vceenecazd.forum | b6882f5c… | https://vceenecazd.forum/js/app.ad8fc5c0.js | structure | 2026-05-23 16:04 |
| zvxnncqybb.forum | 421922eb… | https://zvxnncqybb.forum/js/app.a0d3d755.js | structure | 2026-05-23 08:00 |
| nbkprkfzpg.forum | e78e75a1… | https://nbkprkfzpg.forum/js/app.a0d3d755.js | structure | 2026-05-23 07:48 |
| ychamllivr.forum | c2314e3c… | https://ychamllivr.forum/js/app.0c347c84.js | byte | 2026-05-23 04:57 |
| yzgdpgjgcb.forum | 5b407662… | https://yzgdpgjgcb.forum/js/app.0c347c84.js | byte | 2026-05-23 04:31 |
| xsfyoqgwvr.forum | 2571b286… | https://xsfyoqgwvr.forum/js/app.0c347c84.js | byte | 2026-05-23 04:20 |
| xdgmsnkibj.forum | ab185fb2… | https://xdgmsnkibj.forum/js/app.0c347c84.js | byte | 2026-05-23 04:10 |
| yqlhugudho.forum | 82454e6f… | https://yqlhugudho.forum/js/app.0c347c84.js | byte | 2026-05-23 04:04 |
| yfphwnbwlh.forum | aa9a870d… | https://yfphwnbwlh.forum/js/app.0c347c84.js | byte | 2026-05-23 03:39 |
| xvbewyrydi.forum | befbbb4a… | https://xvbewyrydi.forum/js/app.0c347c84.js | byte | 2026-05-23 02:51 |
| yyyvavhrmg.forum | 11f6929f… | https://yyyvavhrmg.forum/js/app.a0d3d755.js | structure | 2026-05-23 01:52 |
| xjczmiouyb.forum | 20e4bd33… | https://xjczmiouyb.forum/js/app.0c347c84.js | byte | 2026-05-23 01:31 |
| xjmroitofl.forum | 945977f3… | https://xjmroitofl.forum/js/app.0c347c84.js | byte | 2026-05-23 01:25 |
| zvulycesha.forum | 70400c93… | https://zvulycesha.forum/js/app.0c347c84.js | byte | 2026-05-23 01:24 |