ScanMalware.com
Known malicious kithighphishing

Random-TLD Multi-Domain Rotation Kit — main.v2.js

family: hevvugu-multi-domain

Single shared main.v2.js deployed across 17 throwaway domains on cheap/suspicious TLDs (.icu, .sbs, .cfd, .cyou, .shop, .wiki, .one, .asia, .club). Includes telegran.one — Telegram brand impersonation. The 17 hosts have inconsistent verdicts (Low Risk → Malicious); the roster catches all of them via a single fingerprint.

Fingerprint anchors

content sha2566bf5a0f55daa60a3c178a234fc84bada9bc289d7906f2342910ea9bcb6673643
canonical ASTfd5ed316ed4cc4199c77cc321180d3b9d2d6c08a3b502cf0d1f29870159be91f
TLSHT1FB15634672F231394207F0795A5FCD1972356A0B2A88EC593A4CA2511F8A57CEBF6FCC

Provenance

Added by: analyst
Added: 2026-05-26 14:39
Single anchor — the kit serves the same main.v2.js across all 17 known sister domains.

Sightings (84)

HostScanScriptMatchWhen
hua456t.xyz22ccda8b…https://hua456t.xyz/main.v2.jsstructure2026-05-24 17:46
hua456t.xyz22ccda8b…https://hua456t.xyz/main.v2.jsstructure2026-05-24 17:46
hua456t.xyz22ccda8b…https://hua456t.xyz/main.v2.jsstructure2026-05-24 17:46
claw111a.xyzfca24554…https://claw111a.xyz/main.v2.jsstructure2026-05-24 17:18
bot789c.xyz1bb0a9e8…https://bot789c.xyz/main.v2.jsstructure2026-05-24 17:17
bot789c.xyz1bb0a9e8…https://bot789c.xyz/main.v2.jsstructure2026-05-24 17:17
bot789c.xyz5ea2425a…https://bot789c.xyz/main.v2.jsstructure2026-05-24 17:14
testxyz123.topef98f6a6…https://testxyz123.top/main.v2.jsstructure2026-05-24 17:10
testxyz123.topef98f6a6…https://testxyz123.top/main.v2.jsstructure2026-05-24 17:10
tech000f.xyz8b13fe1b…https://tech000f.xyz/main.v2.jsstructure2026-05-24 16:55
ai123h.xyzf06ed6dc…https://ai123h.xyz/main.v2.jsstructure2026-05-24 16:54
ai123h.xyzf06ed6dc…https://ai123h.xyz/main.v2.jsstructure2026-05-24 16:54
ai123h.xyzf06ed6dc…https://ai123h.xyz/main.v2.jsstructure2026-05-24 16:54
hua456t.xyzaa693d07…https://hua456t.xyz/main.v2.jsstructure2026-05-24 16:48
hua456t.xyzaa693d07…https://hua456t.xyz/main.v2.jsstructure2026-05-24 16:48
testxyz123.top195a93b1…https://testxyz123.top/main.v2.jsstructure2026-05-24 16:40
zeltrixx.top8ea84911…https://zeltrixx.top/main.v2.js?v=2structure2026-05-24 13:27
zeltrixa.top051e944f…https://zeltrixa.top/main.v2.js?v=2structure2026-05-24 13:24
zeltrinz.tope2219d47…https://zeltrinz.top/main.v2.js?v=2structure2026-05-24 13:24
zeltrinz.topa99cc459…https://zeltrinz.top/main.v2.js?v=2structure2026-05-24 13:05
zeltrinz.topa99cc459…https://zeltrinz.top/main.v2.js?v=2structure2026-05-24 13:05
zeltrinz.topa99cc459…https://zeltrinz.top/main.v2.js?v=2structure2026-05-24 13:05
zeltrinz.topa99cc459…https://zeltrinz.top/main.v2.js?v=2structure2026-05-24 13:05
zeltrixx.topc50b5049…https://zeltrixx.top/main.v2.js?v=2structure2026-05-24 13:02
zeltrixx.topc50b5049…https://zeltrixx.top/main.v2.js?v=2structure2026-05-24 13:02
zeltrixx.topc50b5049…https://zeltrixx.top/main.v2.js?v=2structure2026-05-24 13:02
telegran.onefa3ccd07…https://telegran.one/main.v2.jsbyte2026-05-24 12:54
zeltrixa.tope2132556…https://zeltrixa.top/main.v2.js?v=2structure2026-05-24 12:54
zeltrixa.tope2132556…https://zeltrixa.top/main.v2.js?v=2structure2026-05-24 12:54
zeltrixo.top93d3bdd1…https://zeltrixo.top/main.v2.js?v=2structure2026-05-24 12:46
zeltrixo.top93d3bdd1…https://zeltrixo.top/main.v2.js?v=2structure2026-05-24 12:46
hurvovo.cyou0619c150…https://hurvovo.cyou/main.v2.jsbyte2026-05-24 12:43
zelviro.top8d672d59…https://zelviro.top/main.v2.js?v=2structure2026-05-24 12:42
munvigo.cfd31416df6…https://munvigo.cfd/main.v2.jsbyte2026-05-24 12:40
munvigo.cfd31416df6…https://munvigo.cfd/main.v2.jsbyte2026-05-24 12:40
862m23.icu12e6d172…https://862m23.icu/main.v2.jsbyte2026-05-24 12:40
hevvugu.icu1216a1b0…https://hevvugu.icu/main.v2.jsbyte2026-05-24 12:34
hevvugu.icu1216a1b0…https://hevvugu.icu/main.v2.jsbyte2026-05-24 12:34
hevvugu.icu1216a1b0…https://hevvugu.icu/main.v2.jsbyte2026-05-24 12:34
hevvugu.icu1216a1b0…https://hevvugu.icu/main.v2.jsbyte2026-05-24 12:34
hevvugu.icu1216a1b0…https://hevvugu.icu/main.v2.jsbyte2026-05-24 12:34
karvexo.cfda188ca39…https://karvexo.cfd/main.v2.js?v=2structure2026-05-24 12:34
karvexo.cfda188ca39…https://karvexo.cfd/main.v2.js?v=2structure2026-05-24 12:34
karvexo.cfda188ca39…https://karvexo.cfd/main.v2.js?v=2structure2026-05-24 12:34
selnixzfo.shope9e48b50…https://selnixzfo.shop/main.v2.jsbyte2026-05-24 12:31
selnixzfo.shope9e48b50…https://selnixzfo.shop/main.v2.jsbyte2026-05-24 12:31
selnixzfo.shope9e48b50…https://selnixzfo.shop/main.v2.jsbyte2026-05-24 12:31
selnixzfo.shopb0c47292…https://selnixzfo.shop/main.v2.jsbyte2026-05-24 12:29
selnixzfo.shopb0c47292…https://selnixzfo.shop/main.v2.jsbyte2026-05-24 12:29
gnvrog.cfd8dd907da…https://gnvrog.cfd/main.v2.jsbyte2026-05-24 12:29
narviko.top26829e4f…https://narviko.top/main.v2.js?v=2structure2026-05-24 12:27
pernixzga.shop20a5fbc8…https://pernixzga.shop/main.v2.jsbyte2026-05-24 12:24
pernixzga.shop20a5fbc8…https://pernixzga.shop/main.v2.jsbyte2026-05-24 12:24
pernixzga.shop20a5fbc8…https://pernixzga.shop/main.v2.jsbyte2026-05-24 12:24
sevvopa.cfde384b945…https://sevvopa.cfd/main.v2.jsbyte2026-05-24 12:22
sevvopa.cfde384b945…https://sevvopa.cfd/main.v2.jsbyte2026-05-24 12:22
sevvopa.cfde384b945…https://sevvopa.cfd/main.v2.jsbyte2026-05-24 12:22
sevvopa.cfde384b945…https://sevvopa.cfd/main.v2.jsbyte2026-05-24 12:22
sevvopa.cfde384b945…https://sevvopa.cfd/main.v2.jsbyte2026-05-24 12:22
dulvici.sbs815b338d…https://dulvici.sbs/main.v2.jsbyte2026-05-24 12:19
morvixzde.shop93880b9a…https://morvixzde.shop/main.v2.jsbyte2026-05-24 12:19
keriox.sbs9fe2d8da…https://keriox.sbs/main.v2.jsbyte2026-05-24 12:16
keriox.sbs9fe2d8da…https://keriox.sbs/main.v2.jsbyte2026-05-24 12:16
keriox.sbs9fe2d8da…https://keriox.sbs/main.v2.jsbyte2026-05-24 12:16
dulvici.sbs5469a919…https://dulvici.sbs/main.v2.jsbyte2026-05-24 12:13
wusmula.icuabfb3586…https://wusmula.icu/main.v2.jsbyte2026-05-24 12:13
wusmula.icuabfb3586…https://wusmula.icu/main.v2.jsbyte2026-05-24 12:13
wusmula.icuabfb3586…https://wusmula.icu/main.v2.jsbyte2026-05-24 12:13
wusmula.icuabfb3586…https://wusmula.icu/main.v2.jsbyte2026-05-24 12:13
senvaro.topbac2b01d…https://senvaro.top/main.v2.js?v=2structure2026-05-24 12:12
melviro.cfd3c02e9e9…https://melviro.cfd/main.v2.js?v=2structure2026-05-24 12:11
worvicu.icuca24535f…https://worvicu.icu/main.v2.jsbyte2026-05-24 12:11
worvicu.icuca24535f…https://worvicu.icu/main.v2.jsbyte2026-05-24 12:11
norvaxzbi.shopa437ba98…https://norvaxzbi.shop/main.v2.jsbyte2026-05-24 12:11
norvaxzbi.shopa437ba98…https://norvaxzbi.shop/main.v2.jsbyte2026-05-24 12:11
gnvrog.cfdfe375148…https://gnvrog.cfd/main.v2.jsbyte2026-05-24 12:09
gnvrog.cfdfe375148…https://gnvrog.cfd/main.v2.jsbyte2026-05-24 12:09
norvaxzbi.shop946623f5…https://norvaxzbi.shop/main.v2.jsbyte2026-05-24 12:09
pelvaro.cfda56f1e76…https://pelvaro.cfd/main.v2.js?v=2structure2026-05-24 12:06
pelvaro.cfda56f1e76…https://pelvaro.cfd/main.v2.js?v=2structure2026-05-24 12:06
marvona.top34e41554…https://marvona.top/main.v2.js?v=2structure2026-05-24 12:03
hevvugu.icu168ab89a…https://hevvugu.icu/main.v2.jsbyte2026-05-24 12:01
hevvugu.icu168ab89a…https://hevvugu.icu/main.v2.jsbyte2026-05-24 12:01
hevvugu.icu168ab89a…https://hevvugu.icu/main.v2.jsbyte2026-05-24 12:01