Known malicious kithighphishing

[X][N].cn Random-Pattern Kit — chunk-vendors

family: letterhex-cn-25f3

7-host operator on .cn TLD with letter+digit random pattern: j3h1k9.cn, m9u6y0.cn, n4c6v5.cn, p4i6o3.cn, q4x9v6.cn, q7e2r6.cn, q8t4y7.cn.

Fingerprint anchors

Added by: analyst

Added: 2026-05-26 16:48

7 hosts on .cn

Host	Scan	Script	Match	When
p4i6o3.cn	55ef662c…	https://p4i6o3.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-25 00:20
p4i6o3.cn	55ef662c…	https://p4i6o3.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-25 00:20
q8t4y7.cn	cd28a4a1…	https://q8t4y7.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:57
q8t4y7.cn	cd28a4a1…	https://q8t4y7.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:57
q4x9v6.cn	eb59fb3e…	https://q4x9v6.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:49
q4x9v6.cn	eb59fb3e…	https://q4x9v6.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:49
j3h1k9.cn	8370e70e…	https://j3h1k9.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:35
j3h1k9.cn	8370e70e…	https://j3h1k9.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:35
q7e2r6.cn	b67a349f…	https://q7e2r6.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:32
q7e2r6.cn	b67a349f…	https://q7e2r6.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:32
m9u6y0.cn	0cc9f574…	https://m9u6y0.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:21
m9u6y0.cn	0cc9f574…	https://m9u6y0.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:21
n4c6v5.cn	3fd545ba…	https://n4c6v5.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:15
n4c6v5.cn	3fd545ba…	https://n4c6v5.cn/static/js/chunk-vendors.3f56995a.js	byte	2026-05-24 23:15