NEW KALI365 PHAAS KIT BEING ABUSED IN THE WILD
Severity: mediumType: Malware
The Kali365 Phishing-as-a-Service (PhaaS) kit is newly observed being abused in the wild. This malware toolkit facilitates phishing campaigns but lacks detailed technical or exploitation data in the current report. No specific affected software versions or patches are identified. The threat is assessed as medium severity based on its phishing capability and active abuse.
AI Analysis
Technical Summary
Kali365 is a phishing-as-a-service malware kit recently reported as being actively abused. The available information does not include technical details, known exploits, or affected software versions. The report indicates medium confidence in the threat's existence but lacks further elaboration on attack methods or impact.
Potential Impact
The Kali365 PhaaS kit enables threat actors to conduct phishing campaigns, potentially leading to credential theft or unauthorized access. However, no direct evidence of exploitation or specific impact scenarios is provided in the current data.
Mitigation Recommendations
No patches or official fixes are available for this threat. Mitigation should focus on standard phishing defenses such as user awareness training, email filtering, and monitoring for phishing indicators. Since this is a phishing toolkit, no direct software remediation applies.
Indicators of Compromise
- link: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-04-24-New-Kali365-PhaaS-Kit.txt
- text: - New PhaaS kit has emerged called Kali365 - This kit has seen widespread abuse and leverages the OAuth device code registration flow - The kit is being distributed via Telegram and contains a fully featured mailbox scanning and phishing page creation features - AI enabled chatbot features assist with lure generation in the platform - Distinct from EvilTokens and sold at a lower price (~$250USD in BTC per Month)
- text: NEW KALI365 PHAAS KIT BEING ABUSED IN THE WILD
- link: https://x.com/Unit42_Intel/status/2047746463556333838
- link: https://www.linkedin.com/posts/unit42_kali365-activity-7453512098757853186-4d70/
- comment: User agent string of the Kali365 mailbox GUI application
- text: kali365\-live\/1\.0\.0
- comment: Kali365 V1 and V2 - Cloudflare Worker regex
- text: (?i)(?:flow-open|note-access|drive-mail|store-open|mail-link|form-cloud|vault-cloud|page-sync|file-base|net-web|data-form|sync-vault|file-doc|access-file|data-doc|drive-edge|access-base|cloud-link|view-sync|share-portal|sync-store|open-share|app-edge|data-drive|flow-store|link-app|file-share|view-open|net-open|base-mail|file-drive|sync-link|core-portal|portal-cloud|sync-page|view-portal|vault-access|box-note|form-doc|cloud-access|hub-app|doc-open|sync-portal|file-sync|cloud-view|doc-note|hub-flow|page-mail|form-hub|portal-share|core-mail|vault-web|base-flow|secure-link|core-flow).*\.workers\.dev
- comment: Kali365 V3 - Cloudflare Worker regex
- text: (?i)[a-z]{5}-[a-z]{4}-[a-z0-9]{4}\.(?:mary-3fb|c-cmd509g3|c-qtkfck53|c-kzevzz5a|p-1razygxw|p-8kehah0a|p-b8eaz6oe|p-rrw76os2|royalbase3|p-l3bhkqec|p-y10utwre|p-qtlv10l7)\.workers\.dev
- text: Authentication - Login
- http-method: POST
- url: /dash/auth
- text: Authentication - 2FA verification
- http-method: POST
- url: /dash/auth/2fa
- text: User / Profile - Get current user profile
- http-method: GET
- url: /dash/me
- text: User / Profile - Update profile
- http-method: POST
- url: /dash/me/update
- text: User / Profile - Get referral info
- http-method: GET
- url: /dash/me/referral
- text: User / Profile - Setup 2FA
- http-method: POST
- url: /dash/me/2fa/setup
- text: User / Profile - Verify & enable 2FA
- http-method: POST
- url: /dash/me/2fa/verify
- text: User / Profile - Disable 2FA
- http-method: POST
- url: /dash/me/2fa/disable
- text: Branding - Get panel branding
- http-method: GET
- url: /dash/branding
- text: Dashboard / Stats - Get summary stats
- http-method: GET
- url: /dash/stats
- text: Dashboard / Stats - Get overview data
- http-method: GET
- url: /dash/overview
- text: Token Vault - List all captured tokens
- http-method: GET
- url: /dash/tokens
- text: Token Vault - Delete a single token
- http-method: POST
- url: /dash/token/{id}/delete
- text: Token Vault - Bulk delete all revoked tokens
- http-method: POST
- url: /dash/tokens/delete-revoked
- text: Token Vault - Create a share link
- http-method: POST
- url: /dash/token/{id}/share
- text: Token Vault - List active share links
- http-method: GET
- url: /dash/token/{id}/shares
- text: Token Vault - Revoke a share link
- http-method: POST
- url: /dash/token/{id}/unshare/{shareId}
- text: Token Vault - Export raw token data as JSON
- http-method: GET
- url: /dash/token/{id}/raw
- text: Token Vault - Import a token
- http-method: POST
- url: /dash/token/import
- text: Lures - List all lures
- http-method: GET
- url: /dash/lures
- text: Lures - Create a new lure
- http-method: POST
- url: /dash/lures/create
- text: Lures - Delete a lure
- http-method: POST
- url: /dash/lures/delete/{id}
- text: Domains - List available domains
- http-method: GET
- url: /dash/domains
- text: Domains - List user's linked domains
- http-method: GET
- url: /dash/linked-domains
- text: Domains - Link a new domain via DNS
- http-method: POST
- url: /dash/linked-domains/add
- text: Domains - Get server IP
- http-method: GET
- url: /dash/server-info
- text: Domains - Verify DNS for a linked domain
- http-method: POST
- url: /dash/linked-domains/verify/{id}
- text: Domains - Provision SSL for a linked domain
- http-method: POST
- url: /dash/linked-domains/provision-ssl/{id}
- text: Domains - Delete a linked domain
- http-method: POST
- url: /dash/linked-domains/delete/{id}
- text: Cloudflare Worker - Get worker status
- http-method: GET
- url: /dash/my-worker
- text: Cloudflare Worker - Deploy a CF Worker
- http-method: POST
- url: /dash/my-worker/setup
- text: Cloudflare Worker - Rotate worker name
- http-method: POST
- url: /dash/my-worker/rotate
- text: Cloudflare Worker - Delete the CF Worker
- http-method: POST
- url: /dash/my-worker/delete
- text: Cloudflare Worker - Redeploy worker code
- http-method: POST
- url: /dash/my-worker/redeploy
- text: Domain Marketplace - Get credit balance
- http-method: GET
- url: /dash/marketplace/credits
- text: Domain Marketplace - Search domain availability
- http-method: POST
- url: /dash/marketplace/search-domain
- text: Domain Marketplace - Purchase a domain
- http-method: POST
- url: /dash/marketplace/buy-domain
- text: Domain Marketplace - List purchased domains
- http-method: GET
- url: /dash/marketplace/my-domains
- text: Inbox / Email - Open Outlook view for a captured account
- url: /dash/outlook/{tokenId}
- text: B2B Sender - Create a send job
- http-method: POST
- url: /dash/inbox/{tokenId}/send-job
- text: B2B Sender - List all send jobs
- http-method: GET
- url: /dash/send-jobs
- text: B2B Sender - Get job details
- http-method: GET
- url: /dash/send-jobs/{jobId}
- text: B2B Sender - Cancel a running job
- http-method: POST
- url: /dash/send-jobs/{jobId}/cancel
- text: B2B Sender - Delete a completed/cancelled job
- http-method: POST
- url: /dash/send-jobs/{jobId}/delete
- text: B2B Sender - Pause a running job
- http-method: POST
- url: /dash/send-jobs/{jobId}/pause
- text: B2B Sender - Resume a paused job
- http-method: POST
- url: /dash/send-jobs/{jobId}/resume
- text: B2B Sender - Get live send progress
- http-method: GET
- url: /dash/send-jobs/{jobId}/live
- text: B2B Sender - AI-generate email template
- http-method: POST
- url: /dash/ai-template
- text: Email Extractor - Start email extraction
- http-method: POST
- url: /dash/contacts/{tokenId}/harvest/start
- text: Email Extractor - Poll harvest status
- http-method: GET
- url: /dash/contacts/{tokenId}/harvest/status/{jobId}
- text: Email Extractor - Cancel harvest and save partial results
- http-method: POST
- url: /dash/contacts/{tokenId}/harvest/cancel/{jobId}
- text: Email Extractor - Verify email addresses
- http-method: POST
- url: /dash/contacts/verify-emails
- text: Email Extractor - Classify domains by provider
- http-method: POST
- url: /dash/contacts/classify-domains
- text: Admin Control - Scan all tokens for admin roles
- http-method: POST
- url: /dash/mfa/scan
- text: Admin Control - Get cached admin scan results
- http-method: GET
- url: /dash/mfa/cached
- text: Admin Control - List org directory users
- http-method: GET
- url: /dash/mfa/{tokenId}/org-users
- text: Admin Control - Reset an org user's password
- http-method: POST
- url: /dash/mfa/{tokenId}/user/{userId}/reset-password
- text: Admin Control - Enable/disable an org user account
- http-method: POST
- url: /dash/mfa/{tokenId}/user/{userId}/toggle
- text: Keywords - List keyword listeners
- http-method: GET
- url: /dash/keywords
- text: Keywords - Add a keyword
- http-method: POST
- url: /dash/keywords/add
- text: Keywords - Enable/disable a keyword
- http-method: POST
- url: /dash/keywords/{id}/toggle
- text: Keywords - Delete a keyword
- http-method: POST
- url: /dash/keywords/{id}/delete
- text: Keywords - Get keyword match alerts
- http-method: GET
- url: /dash/keywords/alerts
- text: Keywords - Clear all keyword alerts
- http-method: POST
- url: /dash/keywords/alerts/clear
- text: Admin Panel - Admin dashboard stats
- http-method: GET
- url: /admin/overview
- text: Admin Panel - List all platform users
- http-method: GET
- url: /admin/users
- text: Admin Panel - Delete a platform user
- http-method: DELETE
- url: /admin/users/{id}/
- text: Admin Panel - Reset a platform user's password
- http-method: POST
- url: /admin/users/{id}/reset-password
- text: Admin Panel - Create a new platform user
- http-method: POST
- url: /admin/users/create
- text: Agent / Reseller - Agent dashboard
- http-method: GET
- url: /agent/dashboard
- text: Agent / Reseller - List agent's clients
- http-method: GET
- url: /agent/clients
- text: Agent / Reseller - Create a client under the agent
- http-method: POST
- url: /agent/clients/create
- text: Agent / Reseller - Update a client
- http-method: POST
- url: /agent/clients/{id}/update
- text: Agent / Reseller - Extend client subscription
- http-method: POST
- url: /agent/clients/{id}/extend
- text: Agent Deployment - List all deployed agents
- http-method: GET
- url: /admin/agents
- text: Agent Deployment - Deploy a new agent
- http-method: POST
- url: /admin/agents/create
- text: Agent Deployment - Get agent details
- http-method: GET
- url: /admin/agents/{slug}
- text: Agent Deployment - Update agent config
- http-method: POST
- url: /admin/agents/{slug}/update
- text: Agent Deployment - Suspend an agent
- http-method: POST
- url: /admin/agents/{slug}/suspend
- text: Agent Deployment - Resume a suspended agent
- http-method: POST
- url: /admin/agents/{slug}/resume
- text: Agent Deployment - Delete an agent and all their data
- http-method: POST
- url: /admin/agents/{slug}/delete
- domain: template-targetedorganisation-template.sharepoint-msviewer.com
- domain: data-doc-sfym.p-50ds7vs5.workers.dev
- domain: sync-link-z79k.bartlett-pamela.workers.dev
- ip: 157.230.53.233
- ip: 167.99.0.116
- ip: 162.243.166.119
- ip: 102.89.22.100
- ip: 159.203.163.96
- ip: 216.203.20.95
- ip: 199.91.220.111
- domain: www.mediaplanung.biz
- domain: www.stpaulscathedralokc.org
- domain: open-share-njlb.p-l4yg6fjb.workers.dev
- domain: sync-store-ur85.p-lboid22u.workers.dev
- domain: share-portal-r6le.p-deum4gog.workers.dev
- domain: cloud-link-j46j.p-zltii3tp.workers.dev
- domain: access-base-yz6o.p-uhv4e1ee.workers.dev
- domain: drive-edge-lzl0.p-8pd549l5.workers.dev
- domain: file-doc-uhug.p-ao3eomo9.workers.dev
- domain: access-file-z1or.steve-c57.workers.dev
- domain: view-base-5vpr.3mdcy99f8511wpsebllpbkjizyg3run6.workers.dev
- domain: data-form-f5at.p-lvqyivvk.workers.dev
- domain: page-core-sv2l.p-anmh2mbc.workers.dev
- domain: v2.duemineral.uk
- domain: www.abt90.org
- domain: nysexams.com
- domain: loadingdocuments.uk
- domain: vault-cloud-maou.p-afw8621d.workers.dev
- domain: pohlusa.co
- domain: www.democrakidsradio.org
- domain: flow-open-7ff0.p-ygj98iy2.workers.dev
- domain: www.duemineral.uk
- domain: www.walter-software.com
- domain: drive-mail-wmou.pwyv30sj.workers.dev
- domain: www.cecyani.xyz
- domain: api.kali365.xyz
- domain: auth.kali365.xyz
- domain: v2.kali365.xyz
- domain: kali365.xyz
- domain: ls.sharepoint-msviewer.com
- domain: sharepoint-63m.pages.dev
- domain: sharepoint-81c.pages.dev
- domain: portal-share-tj8e.p-50ds7vs5.workers.dev
- domain: core-flow-0np5.pdfonlinedocsdocs-outlook-com-s-account.workers.dev
- domain: vault-web-s3ue.p-y10utwre.workers.dev
- domain: egvmu-ejrp-8rmc.royalbase3.workers.dev
- domain: pgfqi-epwc-d1t6.p-1razygxw.workers.dev
- domain: secure-link-ek3t.c-kzevzz5a.workers.dev
- domain: oynfe-roik-zlpe.c-qtkfck53.workers.dev
- domain: rwlha-qilv-ic1v.p-rrw76os2.workers.dev
- domain: core-mail-etk1.p-b8eaz6oe.workers.dev
- domain: chrji-fhav-oz04.p-qtlv10l7.workers.dev
- domain: acqxx-nikg-5cub.p-8kehah0a.workers.dev
- domain: base-flow-38xb.p-l3bhkqec.workers.dev
- domain: gmkcb-bdxh-03l9.c-cmd509g3.workers.dev
- domain: pwjss-npaw-3soj.mary-3fb.workers.dev
- domain: tryingdocusign.pages.dev
- domain: form-hub-lfct.p-utpgo2kb.workers.dev
- domain: cloud-access-uc53.p-vy4za09n.workers.dev
- domain: page-mail-vm24.p-8xzcvt1x.workers.dev
- domain: net-web-wnqd.p-8r4315uz.workers.dev
- domain: hub-flow-2qs3.p-qn7zcudl.workers.dev
- domain: hub-app-8ee1.p-kegps6il.workers.dev
- domain: doc-note-82oj.p-ll66wpsr.workers.dev
- domain: file-sync-tczr.p-77iqt3w6.workers.dev
- domain: sync-portal-jumn.p-ajmeubmp.workers.dev
- domain: doc-open-z062.p-4510rez0.workers.dev
- domain: cloud-access-03pv.bdeda974c99320a3040456b8.workers.dev
- domain: data-drive-bd71.p-4bpdi3hp.workers.dev
- domain: tiny-water-f307.eggzhan.workers.dev
- domain: cloud-view-hb2b.boom-book.workers.dev
- domain: view-sync-9r5b.p-y9fhvs2p.workers.dev
- domain: www.nikadent.icu
- domain: vault-access-pg0o.misty-pine-60bb.workers.dev
- domain: box-note-1qu3.p-xqs8hnkj.workers.dev
- domain: sync-page-pwra.p-rrw76os2.workers.dev
- domain: portal-cloud-cs2c.p-ewgaj1gg.workers.dev
- domain: view-portal-exuw.b875e3d068d947ba88099fe9.workers.dev
- domain: form-doc-wyiy.p-xqs8hnkj.workers.dev
- domain: core-portal-g1cv.ran04don.workers.dev
- domain: file-drive-g180.p-lmilwl5o.workers.dev
- domain: net-open-55eu.p-r3k6zulh.workers.dev
- domain: view-open-jiif.bryanray1104.workers.dev
- domain: file-share-9p2m.papastrious.workers.dev
- domain: link-app-jhzt.p-ux0nzmb5.workers.dev
- domain: flow-store-gyoz.p-o9vztksz.workers.dev
- domain: app-edge-8bqf.p-j65j3f1q.workers.dev
- domain: net-web-qo53.p-2f5hwpkd.workers.dev
- domain: base-mail-w7v5.p-onnw7z7w.workers.dev
- domain: file-base-ggoa.p-yxcqepyg.workers.dev
- domain: sync-vault-lpwq.p-zhge84gd.workers.dev
- domain: form-cloud-t655.p-oejdzrsz.workers.dev
- domain: core-box-iz5s.reckagrace.workers.dev
- domain: mail-link-zkfq.p-qjt4uz2n.workers.dev
- domain: store-open-rc2p.p-ko5g87h5.workers.dev
- domain: note-access-nj2w.rob-c2d.workers.dev
- domain: page-sync-4pib.p-qtlv10l7.workers.dev
- domain: login.sharepoint-msviewer.com
- domain: www.trulites.com
- domain: auth.loadingdocuments.uk
- domain: api.duemineral.uk
- domain: panel.loadingdocuments.uk
NEW KALI365 PHAAS KIT BEING ABUSED IN THE WILD
0
MediumMalwaremisp-galaxy:mitre-malware="kali365 - s9044"misp-galaxy:mitre-software="kali365 - s9044"type:osintosint:lifetime="perpetual"osint:certainty="50"tlp:whitetlp:clear
Published: 04/24/2026 (04/24/2026, 00:00:00 UTC)
Source: CIRCL OSINT Feed
Description
The Kali365 Phishing-as-a-Service (PhaaS) kit is newly observed being abused in the wild. This malware toolkit facilitates phishing campaigns but lacks detailed technical or exploitation data in the current report. No specific affected software versions or patches are identified. The threat is assessed as medium severity based on its phishing capability and active abuse.
AI-Powered Analysis
Machine-generated threat intelligence
AILast updated: 09/22/2026, 04:56:42 UTC
Technical Analysis
Kali365 is a phishing-as-a-service malware kit recently reported as being actively abused. The available information does not include technical details, known exploits, or affected software versions. The report indicates medium confidence in the threat's existence but lacks further elaboration on attack methods or impact.
Potential Impact
The Kali365 PhaaS kit enables threat actors to conduct phishing campaigns, potentially leading to credential theft or unauthorized access. However, no direct evidence of exploitation or specific impact scenarios is provided in the current data.
Defensive Guidance
No patches or official fixes are available for this threat. Mitigation should focus on standard phishing defenses such as user awareness training, email filtering, and monitoring for phishing indicators. Since this is a phishing toolkit, no direct software remediation applies.
Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro
Technical Details
- Uuid
- 814c12e6-0e88-42fb-a463-601d42b70881
- Original Timestamp
- 1789735773
Indicators of Compromise
Link
| Value | Description | Copy |
|---|---|---|
linkhttps://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-04-24-New-Kali365-PhaaS-Kit.txt | — | |
linkhttps://x.com/Unit42_Intel/status/2047746463556333838 | — | |
linkhttps://www.linkedin.com/posts/unit42_kali365-activity-7453512098757853186-4d70/ | — |
Text
| Value | Description | Copy |
|---|---|---|
text- New PhaaS kit has emerged called Kali365
- This kit has seen widespread abuse and leverages the OAuth device code registration flow
- The kit is being distributed via Telegram and contains a fully featured mailbox scanning and phishing page creation features
- AI enabled chatbot features assist with lure generation in the platform
- Distinct from EvilTokens and sold at a lower price (~$250USD in BTC per Month) | — | |
textNEW KALI365 PHAAS KIT BEING ABUSED IN THE WILD | — | |
textkali365\-live\/1\.0\.0 | — | |
text(?i)(?:flow-open|note-access|drive-mail|store-open|mail-link|form-cloud|vault-cloud|page-sync|file-base|net-web|data-form|sync-vault|file-doc|access-file|data-doc|drive-edge|access-base|cloud-link|view-sync|share-portal|sync-store|open-share|app-edge|data-drive|flow-store|link-app|file-share|view-open|net-open|base-mail|file-drive|sync-link|core-portal|portal-cloud|sync-page|view-portal|vault-access|box-note|form-doc|cloud-access|hub-app|doc-open|sync-portal|file-sync|cloud-view|doc-note|hub-flow|page-mail|form-hub|portal-share|core-mail|vault-web|base-flow|secure-link|core-flow).*\.workers\.dev | — | |
text(?i)[a-z]{5}-[a-z]{4}-[a-z0-9]{4}\.(?:mary-3fb|c-cmd509g3|c-qtkfck53|c-kzevzz5a|p-1razygxw|p-8kehah0a|p-b8eaz6oe|p-rrw76os2|royalbase3|p-l3bhkqec|p-y10utwre|p-qtlv10l7)\.workers\.dev | — | |
textAuthentication - Login | — | |
textAuthentication - 2FA verification | — | |
textUser / Profile - Get current user profile | — | |
textUser / Profile - Update profile | — | |
textUser / Profile - Get referral info | — | |
textUser / Profile - Setup 2FA | — | |
textUser / Profile - Verify & enable 2FA | — | |
textUser / Profile - Disable 2FA | — | |
textBranding - Get panel branding | — | |
textDashboard / Stats - Get summary stats | — | |
textDashboard / Stats - Get overview data | — | |
textToken Vault - List all captured tokens | — | |
textToken Vault - Delete a single token | — | |
textToken Vault - Bulk delete all revoked tokens | — | |
textToken Vault - Create a share link | — | |
textToken Vault - List active share links | — | |
textToken Vault - Revoke a share link | — | |
textToken Vault - Export raw token data as JSON | — | |
textToken Vault - Import a token | — | |
textLures - List all lures | — | |
textLures - Create a new lure | — | |
textLures - Delete a lure | — | |
textDomains - List available domains | — | |
textDomains - List user's linked domains | — | |
textDomains - Link a new domain via DNS | — | |
textDomains - Get server IP | — | |
textDomains - Verify DNS for a linked domain | — | |
textDomains - Provision SSL for a linked domain | — | |
textDomains - Delete a linked domain | — | |
textCloudflare Worker - Get worker status | — | |
textCloudflare Worker - Deploy a CF Worker | — | |
textCloudflare Worker - Rotate worker name | — | |
textCloudflare Worker - Delete the CF Worker | — | |
textCloudflare Worker - Redeploy worker code | — | |
textDomain Marketplace - Get credit balance | — | |
textDomain Marketplace - Search domain availability | — | |
textDomain Marketplace - Purchase a domain | — | |
textDomain Marketplace - List purchased domains | — | |
textInbox / Email - Open Outlook view for a captured account | — | |
textB2B Sender - Create a send job | — | |
textB2B Sender - List all send jobs | — | |
textB2B Sender - Get job details | — | |
textB2B Sender - Cancel a running job | — | |
textB2B Sender - Delete a completed/cancelled job | — | |
textB2B Sender - Pause a running job | — | |
textB2B Sender - Resume a paused job | — | |
textB2B Sender - Get live send progress | — | |
textB2B Sender - AI-generate email template | — | |
textEmail Extractor - Start email extraction | — | |
textEmail Extractor - Poll harvest status | — | |
textEmail Extractor - Cancel harvest and save partial results | — | |
textEmail Extractor - Verify email addresses | — | |
textEmail Extractor - Classify domains by provider | — | |
textAdmin Control - Scan all tokens for admin roles | — | |
textAdmin Control - Get cached admin scan results | — | |
textAdmin Control - List org directory users | — | |
textAdmin Control - Reset an org user's password | — | |
textAdmin Control - Enable/disable an org user account | — | |
textKeywords - List keyword listeners | — | |
textKeywords - Add a keyword | — | |
textKeywords - Enable/disable a keyword | — | |
textKeywords - Delete a keyword | — | |
textKeywords - Get keyword match alerts | — | |
textKeywords - Clear all keyword alerts | — | |
textAdmin Panel - Admin dashboard stats | — | |
textAdmin Panel - List all platform users | — | |
textAdmin Panel - Delete a platform user | — | |
textAdmin Panel - Reset a platform user's password | — | |
textAdmin Panel - Create a new platform user | — | |
textAgent / Reseller - Agent dashboard | — | |
textAgent / Reseller - List agent's clients | — | |
textAgent / Reseller - Create a client under the agent | — | |
textAgent / Reseller - Update a client | — | |
textAgent / Reseller - Extend client subscription | — | |
textAgent Deployment - List all deployed agents | — | |
textAgent Deployment - Deploy a new agent | — | |
textAgent Deployment - Get agent details | — | |
textAgent Deployment - Update agent config | — | |
textAgent Deployment - Suspend an agent | — | |
textAgent Deployment - Resume a suspended agent | — | |
textAgent Deployment - Delete an agent and all their data | — |
Comment
| Value | Description | Copy |
|---|---|---|
commentUser agent string of the Kali365 mailbox GUI application | — | |
commentKali365 V1 and V2 - Cloudflare Worker regex | — | |
commentKali365 V3 - Cloudflare Worker regex | — |
Http method
| Value | Description | Copy |
|---|---|---|
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodGET | — | |
http-methodGET | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodGET | — | |
http-methodDELETE | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodGET | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — | |
http-methodPOST | — |
Url
| Value | Description | Copy |
|---|---|---|
url/dash/auth | — | |
url/dash/auth/2fa | — | |
url/dash/me | — | |
url/dash/me/update | — | |
url/dash/me/referral | — | |
url/dash/me/2fa/setup | — | |
url/dash/me/2fa/verify | — | |
url/dash/me/2fa/disable | — | |
url/dash/branding | — | |
url/dash/stats | — | |
url/dash/overview | — | |
url/dash/tokens | — | |
url/dash/token/{id}/delete | — | |
url/dash/tokens/delete-revoked | — | |
url/dash/token/{id}/share | — | |
url/dash/token/{id}/shares | — | |
url/dash/token/{id}/unshare/{shareId} | — | |
url/dash/token/{id}/raw | — | |
url/dash/token/import | — | |
url/dash/lures | — | |
url/dash/lures/create | — | |
url/dash/lures/delete/{id} | — | |
url/dash/domains | — | |
url/dash/linked-domains | — | |
url/dash/linked-domains/add | — | |
url/dash/server-info | — | |
url/dash/linked-domains/verify/{id} | — | |
url/dash/linked-domains/provision-ssl/{id} | — | |
url/dash/linked-domains/delete/{id} | — | |
url/dash/my-worker | — | |
url/dash/my-worker/setup | — | |
url/dash/my-worker/rotate | — | |
url/dash/my-worker/delete | — | |
url/dash/my-worker/redeploy | — | |
url/dash/marketplace/credits | — | |
url/dash/marketplace/search-domain | — | |
url/dash/marketplace/buy-domain | — | |
url/dash/marketplace/my-domains | — | |
url/dash/outlook/{tokenId} | — | |
url/dash/inbox/{tokenId}/send-job | — | |
url/dash/send-jobs | — | |
url/dash/send-jobs/{jobId} | — | |
url/dash/send-jobs/{jobId}/cancel | — | |
url/dash/send-jobs/{jobId}/delete | — | |
url/dash/send-jobs/{jobId}/pause | — | |
url/dash/send-jobs/{jobId}/resume | — | |
url/dash/send-jobs/{jobId}/live | — | |
url/dash/ai-template | — | |
url/dash/contacts/{tokenId}/harvest/start | — | |
url/dash/contacts/{tokenId}/harvest/status/{jobId} | — | |
url/dash/contacts/{tokenId}/harvest/cancel/{jobId} | — | |
url/dash/contacts/verify-emails | — | |
url/dash/contacts/classify-domains | — | |
url/dash/mfa/scan | — | |
url/dash/mfa/cached | — | |
url/dash/mfa/{tokenId}/org-users | — | |
url/dash/mfa/{tokenId}/user/{userId}/reset-password | — | |
url/dash/mfa/{tokenId}/user/{userId}/toggle | — | |
url/dash/keywords | — | |
url/dash/keywords/add | — | |
url/dash/keywords/{id}/toggle | — | |
url/dash/keywords/{id}/delete | — | |
url/dash/keywords/alerts | — | |
url/dash/keywords/alerts/clear | — | |
url/admin/overview | — | |
url/admin/users | — | |
url/admin/users/{id}/ | — | |
url/admin/users/{id}/reset-password | — | |
url/admin/users/create | — | |
url/agent/dashboard | — | |
url/agent/clients | — | |
url/agent/clients/create | — | |
url/agent/clients/{id}/update | — | |
url/agent/clients/{id}/extend | — | |
url/admin/agents | — | |
url/admin/agents/create | — | |
url/admin/agents/{slug} | — | |
url/admin/agents/{slug}/update | — | |
url/admin/agents/{slug}/suspend | — | |
url/admin/agents/{slug}/resume | — | |
url/admin/agents/{slug}/delete | — |
Domain
| Value | Description | Copy |
|---|---|---|
domaintemplate-targetedorganisation-template.sharepoint-msviewer.com | Custom Phishing Domains | |
domaindata-doc-sfym.p-50ds7vs5.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainsync-link-z79k.bartlett-pamela.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainwww.mediaplanung.biz | PhaaS Operator Panel Domain | |
domainwww.stpaulscathedralokc.org | PhaaS Operator Panel Domain | |
domainopen-share-njlb.p-l4yg6fjb.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainsync-store-ur85.p-lboid22u.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainshare-portal-r6le.p-deum4gog.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaincloud-link-j46j.p-zltii3tp.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainaccess-base-yz6o.p-uhv4e1ee.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaindrive-edge-lzl0.p-8pd549l5.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainfile-doc-uhug.p-ao3eomo9.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainaccess-file-z1or.steve-c57.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainview-base-5vpr.3mdcy99f8511wpsebllpbkjizyg3run6.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaindata-form-f5at.p-lvqyivvk.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainpage-core-sv2l.p-anmh2mbc.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainv2.duemineral.uk | PhaaS Operator Panel Domain | |
domainwww.abt90.org | PhaaS Operator Panel Domain | |
domainnysexams.com | PhaaS Operator Panel Domain | |
domainloadingdocuments.uk | PhaaS Operator Panel Domain | |
domainvault-cloud-maou.p-afw8621d.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainpohlusa.co | PhaaS Operator Panel Domain | |
domainwww.democrakidsradio.org | PhaaS Operator Panel Domain | |
domainflow-open-7ff0.p-ygj98iy2.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainwww.duemineral.uk | PhaaS Operator Panel Domain | |
domainwww.walter-software.com | PhaaS Operator Panel Domain | |
domaindrive-mail-wmou.pwyv30sj.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainwww.cecyani.xyz | PhaaS Operator Panel Domain | |
domainapi.kali365.xyz | PhaaS Operator Panel Domain | |
domainauth.kali365.xyz | PhaaS Operator Panel Domain | |
domainv2.kali365.xyz | PhaaS Operator Panel Domain | |
domainkali365.xyz | PhaaS Operator Panel Domain | |
domainls.sharepoint-msviewer.com | Custom Phishing Domains | |
domainsharepoint-63m.pages.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainsharepoint-81c.pages.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainportal-share-tj8e.p-50ds7vs5.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaincore-flow-0np5.pdfonlinedocsdocs-outlook-com-s-account.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainvault-web-s3ue.p-y10utwre.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainegvmu-ejrp-8rmc.royalbase3.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainpgfqi-epwc-d1t6.p-1razygxw.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainsecure-link-ek3t.c-kzevzz5a.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainoynfe-roik-zlpe.c-qtkfck53.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainrwlha-qilv-ic1v.p-rrw76os2.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaincore-mail-etk1.p-b8eaz6oe.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainchrji-fhav-oz04.p-qtlv10l7.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainacqxx-nikg-5cub.p-8kehah0a.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainbase-flow-38xb.p-l3bhkqec.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaingmkcb-bdxh-03l9.c-cmd509g3.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainpwjss-npaw-3soj.mary-3fb.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaintryingdocusign.pages.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainform-hub-lfct.p-utpgo2kb.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaincloud-access-uc53.p-vy4za09n.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainpage-mail-vm24.p-8xzcvt1x.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainnet-web-wnqd.p-8r4315uz.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainhub-flow-2qs3.p-qn7zcudl.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainhub-app-8ee1.p-kegps6il.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaindoc-note-82oj.p-ll66wpsr.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainfile-sync-tczr.p-77iqt3w6.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainsync-portal-jumn.p-ajmeubmp.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaindoc-open-z062.p-4510rez0.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaincloud-access-03pv.bdeda974c99320a3040456b8.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaindata-drive-bd71.p-4bpdi3hp.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaintiny-water-f307.eggzhan.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaincloud-view-hb2b.boom-book.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainview-sync-9r5b.p-y9fhvs2p.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainwww.nikadent.icu | PhaaS Operator Panel Domain | |
domainvault-access-pg0o.misty-pine-60bb.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainbox-note-1qu3.p-xqs8hnkj.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainsync-page-pwra.p-rrw76os2.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainportal-cloud-cs2c.p-ewgaj1gg.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainview-portal-exuw.b875e3d068d947ba88099fe9.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainform-doc-wyiy.p-xqs8hnkj.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaincore-portal-g1cv.ran04don.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainfile-drive-g180.p-lmilwl5o.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainnet-open-55eu.p-r3k6zulh.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainview-open-jiif.bryanray1104.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainfile-share-9p2m.papastrious.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainlink-app-jhzt.p-ux0nzmb5.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainflow-store-gyoz.p-o9vztksz.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainapp-edge-8bqf.p-j65j3f1q.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainnet-web-qo53.p-2f5hwpkd.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainbase-mail-w7v5.p-onnw7z7w.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainfile-base-ggoa.p-yxcqepyg.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainsync-vault-lpwq.p-zhge84gd.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainform-cloud-t655.p-oejdzrsz.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domaincore-box-iz5s.reckagrace.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainmail-link-zkfq.p-qjt4uz2n.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainstore-open-rc2p.p-ko5g87h5.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainnote-access-nj2w.rob-c2d.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainpage-sync-4pib.p-qtlv10l7.workers.dev | Known Phishing Pages Hosted on Cloudflare Worker Domains | |
domainlogin.sharepoint-msviewer.com | Custom Phishing Domains | |
domainwww.trulites.com | PhaaS Operator Panel Domain | |
domainauth.loadingdocuments.uk | PhaaS Operator Panel Domain | |
domainapi.duemineral.uk | PhaaS Operator Panel Domain | |
domainpanel.loadingdocuments.uk | PhaaS Operator Panel Domain |
Ip
| Value | Description | Copy |
|---|---|---|
ip157.230.53.233 | Fronted Portal IPs (subset) | |
ip167.99.0.116 | Fronted Portal IPs (subset) | |
ip162.243.166.119 | Fronted Portal IPs (subset) | |
ip102.89.22.100 | Fronted Portal IPs (subset) | |
ip159.203.163.96 | Fronted Portal IPs (subset) | |
ip216.203.20.95 | Main Panel IPs (BP hosted infrastructure) | |
ip199.91.220.111 | Main Panel IPs (BP hosted infrastructure) |
Threat ID: 6ab20a87f7a7c5410670ce7f
Added to database: 09/22/2026, 04:56:39 UTC
Last enriched: 09/22/2026, 04:56:42 UTC
Last updated: 09/22/2026, 17:03:30 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Sort by
Loading community insights…
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
PRO
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Please log in to the Console to use AI analysis features.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Breach by OffSeqOFFSEQFRIENDS — 25% OFF
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
OffSeq TrainingCredly Certified
Lead Pen Test Professional
Technical5-day eLearningPECB Accredited