> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# EvilTokens
- URL: https://f4n6.co.uk/eviltokens/
- Published: 2026-06-25T17:31:16.000Z
- Updated: 2026-06-25T17:32:44.000Z
- Author: Jeff Davies
- Tags: AI, Sovereign, EvilTokens

Original inspiration for this from [https://abnormal.ai/blog/eviltokens-oauth-device-codes-bec-operations](https://abnormal.ai/blog/eviltokens-oauth-device-codes-bec-operations?ref=f4n6.co.uk)

# EvilTokens Is Still Live: Three Months On, the PhaaS Platform Has Spread

Adverse Trace OSINT Assessment · 2026-06-25

### Contents

1. [Summary](#summary)
2. [Methodology](#methodology)
3. [MailVault C2 Platform](#c2)
4. [Self-Hosted PHP Backends (3 domains)](#backends)
5. [Compromised Gate Sites](#gate-sites)
6. [Cloudflare Worker Tenants](#workers)
7. [salv-976 Worker: SSO Impersonation](#salv976)
8. [zerobotv9: IoT Botnet on Same Infrastructure](#zerobot)
9. [Screenshot Evidence](#screenshots)
10. [What This Means](#meaning)
11. [Defensive Recommendations](#recommendations)
12. [Updated IOC Table](#iocs)

## Summary

**Headline:** Every named IOC from the 3 April 2026 Abnormal Security writeup is confirmed live or was live within the past 90 days. The platform has spread to at least **7 new compromised domains**, **3 backend domains on the same Cloudzy IP**, and **20+ Cloudflare Worker tenants**. A **zerobotv9 IoT botnet** is hosted on the same infrastructure. 

- The **MailVault C2 platform** at `techroboticslabmade.com` is live and serving its marketing page, including a "Tenant Login" admin panel requiring an access key.
- **Three self-hosted PHP backends** — `macmamo.com`, `smstltle.net`, and `notificationsmanagersec.com` — are all serving "Microsoft 365 - Voicemail" lure pages from the same Cloudzy Tampa IP (216.126.227.101).
- The compromised gate site `bibf.ac.bw` hosted 30+ "Identity Verification" gate pages from 18–26 March 2026.
- A **new compromised gate site**, `bonlait.com`, is serving the same kit template and was scanned **18 times between 18 June and 25 June 2026**, including on the day this report was written.
- **Six additional compromised websites** not in the original IOC list are serving the same gate-page template: `advanced-leadership.com`, `nycelitechauffeur.com`, `stacoelectrics.com`, `mgj.social`, `bonlait.com`, and `hjkzd-oaaaa-aaaad-qf7za-cai.icp0.io`.
- At least **20 distinct Cloudflare Worker tenants** are operating EvilTokens lure pages, identifiable by the `-s-account.workers.dev` subdomain pattern.
- A Cloudflare Worker at `clouddocs.salv-976.workers.dev` mimics Microsoft SSO error pages, with a hex-encoded `state` parameter decoding to `[[email protected]](/cdn-cgi/l/email-protection)`. Cloudflare itself flagged it as "Suspected Phishing."
- The same Cloudzy IP (216.126.227.101) hosts **zerobotv9 IoT botnet malware** under `/mamakmukekkontol/` — multi-arch binaries (arm5, arm6, arm7, mips, x86, x86\_64, spc, arc, m68k, sh4, ppc).

## Methodology

All data was collected from public, indexed sources:

1. **SearXNG metasearch** (Adverse Trace internal) — broad queries for the kit markers `// <-- REPLACE WITH YOUR ACTUAL DOMAIN` and `versioned v2.4.0, branded "Identity Verification"`. The exact comment-form string did not surface in indexed results; search engines strip `//` and `<--` as punctuation. The phrase body appeared only in the Abnormal.ai source article, not on any live phishing page — consistent with the kit's AES-256-GCM encrypted payload and JavaScript-gated bot filter, both of which prevent search-engine crawlers from reaching the gate-page DOM.
2. **URLScan.io** — targeted queries against the named IOCs and kit markers. URLScan indexes submitted scans of URLs, including page titles, server headers, IP addresses, ASN data, and screenshots. This is the highest-yield source for ephemeral phishing infrastructure because scans are submitted by researchers, security products, and automated crawlers that execute JavaScript.
3. **Certificate Transparency (crt.sh)** — no certificates returned for any domain. Cloudflare Workers use Cloudflare-managed certificates that do not appear in CT logs under the worker subdomain name.
4. **Wayback Machine** — no historical captures for any IOC domain.
5. **IP pivot on URLScan** — querying all scans from the Cloudzy IP (216.126.227.101) revealed two additional EvilTokens backend domains (`smstltle.net`, `notificationsmanagersec.com`) and zerobotv9 IoT botnet malware hosting.
6. **Vision model analysis** — screenshots downloaded from URLScan.io were analysed using a local Qwen3.6-35B vision model to extract UI text, branding, and social-engineering content.

## 1\. MailVault C2 Platform — techroboticslabmade.com

The central command-and-control platform, branded "MailVault — Enterprise Email Management," remains live. The marketing page advertises features that are unambiguous about the platform's criminal purpose.

### Screenshot: MailVault Marketing Page

Figure 1: MailVault C2 marketing page at techroboticslabmade.com (URLScan scan, 2026-03-24)

### Screenshot: MailVault Admin Panel ("Tenant Login")

Figure 2: MailVault admin panel at /t/{tenant\_id}/admin — Welcome back, enter your access key (URLScan scan, 2026-02-20)

### Infrastructure Details

| Field        | Value                                                         |
| ------------ | ------------------------------------------------------------- |
| URL          | https://techroboticslabmade.com/                              |
| Page title   | MailVault — Enterprise Email Management                       |
| Server       | railway-edge                                                  |
| IPs observed | 66.33.22.37 (Railway AS400940), 151.101.2.15 (Fastly AS54113) |
| TLS issuer   | R13 (Let's Encrypt)                                           |
| First scan   | 2026-03-03                                                    |
| Last scan    | 2026-04-03                                                    |
| Admin panel  | /t/{tenant\_id}/admin — title "Panel Access" (2026-02-20)     |

### Marketing Copy (from screenshot analysis)

| Feature             | Description (verbatim from page)                                                                       |
| ------------------- | ------------------------------------------------------------------------------------------------------ |
| Tenant Isolation    | "Each tenant operates in a fully isolated environment with dedicated credentials and access controls." |
| Real-time Dashboard | "Monitor token health, usage analytics, and system metrics from a unified control panel."              |
| Auto-Refresh        | "Automatic token lifecycle management with intelligent refresh strategies and failover."               |
| Landing Pages       | "Professional, customizable templates with built-in bot detection and analytics."                      |
| Telegram Alerts     | "Instant notifications for captures, expirations, and system events via Telegram bot."                 |
| Multi-Scope Auth    | "Flexible authentication supporting multiple OAuth scopes and token grant types."                      |

The marketing page openly advertises: "Telegram Alerts" for **captures**, "Auto-Refresh" for **token lifecycle management**, "Landing Pages" with **bot detection**, and "Tenant Isolation" for **dedicated credentials**. This is a criminal SaaS product with a professional marketing page and a "Tenant Login" admin panel requiring an access key.

Tenant paths observed in URLScan data: `/t/wxeequrhsrvn/`, `/t/pn9lx1nemx7g/`, `/t/xednndsnb5xd/`, `/t/vxwf13h3f7r8/`. The `/t/{tenant_id}/` pattern matches the Abnormal report's description of multi-tenant SaaS isolation, where each customer (identified by a Telegram handle) receives an isolated environment.

## 2\. Self-Hosted PHP Backends — Three Domains on One Cloudzy IP

An IP pivot on URLScan.io for the Cloudzy Tampa IP (216.126.227.101) from the original IOC list revealed that **three domains** are serving the "Microsoft 365 - Voicemail" lure from the same server — not just `macmamo.com` as documented in the Abnormal report.

| Domain                          | Title                     | IP              | PTR                                | Server | Active scans             |
| ------------------------------- | ------------------------- | --------------- | ---------------------------------- | ------ | ------------------------ |
| macmamo.com                     | Microsoft 365 - Voicemail | 216.126.227.101 | 101.227.126.216.static.cloudzy.com | Apache | 2026-04-02 to 2026-04-06 |
| smstltle.net NEW                | Microsoft 365 - Voicemail | 216.126.227.101 | 101.227.126.216.static.cloudzy.com | Apache | 2026-04-02 to 2026-04-06 |
| notificationsmanagersec.com NEW | Microsoft 365 - Voicemail | 216.126.227.101 | 101.227.126.216.static.cloudzy.com | Apache | 2026-04-02 to 2026-04-06 |

All three domains resolve to the same Cloudzy VPS at 216.126.227.101 in Tampa, FL — the exact IP from the Abnormal IOC list. The PTR record `101.227.126.216.static.cloudzy.com` confirms the hosting provider. The EvilTokens operator is rotating across multiple domain names on the same backend server, likely to evade domain-level blocklists.

## 3\. Compromised Gate Sites

### 3a. bibf.ac.bw (Botswana Institute of Banking & Finance) — Active 18–26 March 2026

The legitimate site (`https://bibf.ac.bw/`) serves the organisation's real content. Gate pages were deployed at paths following the pattern:

```
https://bibf.ac.bw/{Day}-{uuid}-{DictionaryWord}{hex}{F|G}.html
```

Observed examples:

- `Monday-ea8c0bf5-9dde-41ea-MORN9927-709582e21fafF.html`
- `Tuesday-f1047615-fa57-4e76-a890-85cef9a06757F.html`
- `Tuesday-e92e0a92-5522-MARCH457c-8f13-2b90fb440f57F.html`
- `Tuesday-8f01879c-78a9ALL-4013-903a-1674a75941adF.html`

All gate pages returned the title `Identity Verification`. The day-prefix (Monday/Tuesday/Thursday) and dictionary-word (Dactyliography, Dactyliology, Dactyliomancy, Dactylonomy) pattern is consistent with an automated template generator that creates unique URLs per phishing run.

| Field                | Value         |
| -------------------- | ------------- |
| IP                   | 103.227.176.4 |
| First gate-page scan | 2026-03-18    |
| Last gate-page scan  | 2026-03-26    |
| Total scans          | 30+           |

### Screenshot: bibf.ac.bw Gate Page

Figure 3: bibf.ac.bw gate page — Verify You Are Human with GDPR/CCPA fake compliance text (URLScan scan, 2026-03-26)

### 3b. bonlait.com — Active 18 June to 25 June 2026 (today) LIVE

Not named in the Abnormal IOC list. `bonlait.com` is a 3,596-day-old legitimate domain that has been compromised and is serving the same gate-page template. The URL pattern is identical to bibf.ac.bw.

| Field       | Value                                                       |
| ----------- | ----------------------------------------------------------- |
| URL pattern | https://bonlait.com/{Day}-{uuid}-{DictWord}{hex}{F\|G}.html |
| Page title  | Identity Verification                                       |
| IP          | 68.168.113.90 (GloboTech Communications, CA)                |
| Server      | LiteSpeed                                                   |
| First scan  | 2026-06-18                                                  |
| Last scan   | **2026-06-25 (today)**                                      |
| Total scans | 18+                                                         |

### Screenshot: bonlait.com Gate Page

Figure 4: bonlait.com gate page — Verify You Are Human with © 2026 Identity Assurance footer (URLScan scan, 2026-06-25)

### 3c. Additional Compromised Gate Sites

| Domain                              | IP                       | Server | First scan | URL pattern                                       | Status                                     |
| ----------------------------------- | ------------------------ | ------ | ---------- | ------------------------------------------------- | ------------------------------------------ |
| advanced-leadership.com             | 69.174.115.247           | Apache | 2026-04-28 | /{biz-term1}/{biz-term2}.html                     | Active 2026-06-25                          |
| nycelitechauffeur.com               | 192.185.182.107          | Apache | 2026-06-18 | /Mon-{alphanumeric}.html                          | Active 2026-06-24                          |
| stacoelectrics.com                  | 170.205.52.130           | nginx  | 2026-06-22 | /specifications/                                  | Active 2026-06-23                          |
| mgj.social                          | 74.124.194.57            | Apache | 2026-06-22 | /{shareholder\|subsidiary}/{Legal|Sole}{hex}.html | Active 2026-06-23                          |
| hjkzd-oaaaa-aaaad-qf7za-cai.icp0.io | (ICP blockchain hosting) | —      | 2026-06-23 | /index.html                                       | Title "Identity Verification Center (PKG)" |

**advanced-leadership.com** is particularly interesting: the kit uses business-procurement-themed paths (`/statementofwork/statutorycompliance.html`, `/prebid/merchantability.html`, `/operationalcontingency/procurementthreshold.html`, `/bidsolicitation/clarificatory.html`). This suggests the gate pages are themed to match the compromised site's legitimate business context, increasing the likelihood that targets perceive them as authentic.

## 4\. Cloudflare Worker Tenants — 20+ Active Operators

The EvilTokens kit's signature is the `-s-account.workers.dev` subdomain pattern, where compromised business domain names are embedded in the worker subdomain. URLScan data confirms at least 20 distinct operator tenants:

| Worker subdomain                                                             | Lure title                                         | Scanned        |
| ---------------------------------------------------------------------------- | -------------------------------------------------- | -------------- |
| docusign-wz7.emily-c57.workers.dev                                           | DocuSign - Review Document                         | 2026-03-18     |
| adobe-lg7.emily-c57.workers.dev                                              | A.C.H Payment Processing Team                      | 2026-03-18     |
| project-67jmetyv-e005b4-2b061d.nathan-5c9.workers.dev                        | DocuSign \| Action Required: Identity Verification | 2026-06-24     |
| u37g-ehtx-v8x8.nikolaos-roupakas-evurty-com-s-account.workers.dev            | Microsoft 365 - Voicemail                          | 2026-06-23     |
| 7lbg-pi89-0tar.mmoran-namiglac-org-s-account.workers.dev                     | Microsoft 365 - Voicemail                          | 2026-06-19     |
| syfv-82md-7qrn.president-gsbcc-net-s-account.workers.dev                     | Microsoft 365 - Voicemail                          | 2026-06-15     |
| nhgo-2xnx-cw12.jennifer-jencrosslaw-com-s-account.workers.dev                | Microsoft 365 - Voicemail                          | 2026-06-14     |
| 9ulh-0y7w-b87i.css-sleepbetteraustin-com-s-account.workers.dev               | Microsoft 365 - Voicemail                          | 2026-06-09     |
| jq33-inwb-sase.swhitmont-qtopiasydney-com-au-s-account.workers.dev           | Microsoft 365 - Voicemail                          | 2026-05-20     |
| tzbd-5wp4-fuv5.sharon-gittens-dfci-harvard-edu-s-account.workers.dev         | Microsoft 365 - Voicemail                          | 2026-05-20     |
| 4tpz-2f53-twnk.admin-dentalstore-com-s-account.workers.dev                   | Microsoft 365 - Voicemail                          | 2026-05-15     |
| 3rkm-l1k3-hyvi.hiro-takara-co-uk-s-account.workers.dev                       | Microsoft 365 - Voicemail                          | 2026-05-14     |
| 14u2-lxvf-pz5s.admin-dentalstore-com-s-account.workers.dev                   | Microsoft 365 - Voicemail                          | 2026-05-13     |
| 3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev    | DocuSign - Review Document                         | **2026-06-25** |
| c60u-ufhn-0uxb.office-sanisolutions123-onmicrosoft-com-s-account.workers.dev | DocuSign - Review Document                         | **2026-06-25** |
| sqdp-9yfu-wogq.anthony-foglietta-ctbakery-com-s-account.workers.dev          | DocuSign - Review Document                         | **2026-06-25** |
| wctn-kqcu-b5wp.george-vandevorde-smithinsurancellc-com-s-account.workers.dev | DocuSign - Review Document                         | 2026-06-23     |
| wwkp-0wt9-1zd8.pat-tesenergyservices-com-s-account.workers.dev               | DocuSign - Review Document                         | 2026-06-22     |
| xmlf-ag9n-th11.mgeorgatos-netw1-com-s-account.workers.dev                    | DocuSign - Review Document                         | 2026-06-22     |
| vaeg-8bcp-7bkr.tgopaul-foundrymortgagecapital-com-s-account.workers.dev      | DocuSign - Review Document                         | 2026-06-22     |
| 8gpv-tszw-jyrx.phil-heron-zoomdrain-com-s-account.workers.dev                | DocuSign - Review Document                         | 2026-06-20     |

Four lure variants are observed in the wild:

1. `DocuSign - Review Document`
2. `Microsoft 365 - Voicemail`
3. `A.C.H Payment Processing Team`
4. `DocuSign | Action Required: Identity Verification`

The compromised business domains embedded in the worker subdomains span law firms (jenccrosslaw, turnkeytalk, foundrymortgagecapital), dental practices (dentalstore, ctbakery), accounting firms (coralridgetowerssouth, hpepaper), insurance companies (smithinsurancellc), energy services (tesenergyservices), plumbing (zoomdrain), automotive (onixautomotive), sleep clinics (sleepbetteraustin), and academic institutions (dfci-harvard).

### Screenshot: Bot-Filter Interstitial (nathan-5c9 workers.dev)

Figure 5: Bot-filter interstitial at nathan-5c9.workers.dev — Access verification / Tap to proceed mimicking Cloudflare's challenge UI (URLScan scan, 2026-06-24)

## 5\. salv-976 Worker: Microsoft SSO Impersonation

A Cloudflare Worker at `clouddocs.salv-976.workers.dev` serves a page mimicking a Microsoft SSO error:

```
https://clouddocs.salv-976.workers.dev/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=6d796f756e67407369676d617265702e636f6d
```

The hex-encoded `state` parameter decodes to:

```
[email protected]
```

This is a target email address embedded in the URL — consistent with the EvilTokens kit's pattern of passing the target's email through the Cloudflare Worker for tracking. The worker at `clouddoc.salv-976.workers.dev` (without the "s") was flagged by Cloudflare itself as "Suspected Phishing" across multiple scans from 2026-06-07 onwards.

## 6\. zerobotv9: IoT Botnet on the Same Infrastructure

The IP pivot on the Cloudzy IP (216.126.227.101) revealed that the same server hosts **zerobotv9 IoT botnet malware** under the path `/mamakmukekkontol/`. Multi-arch binaries are available:

| Architecture | URL                                                       | Scan date  |
| ------------ | --------------------------------------------------------- | ---------- |
| arm5         | http://216.126.227.101/mamakmukekkontol/zerobotv9.arm5    | 2026-01-03 |
| arm6         | http://216.126.227.101/mamakmukekkontol/zerobotv9.arm6    | 2026-01-02 |
| arm7         | http://216.126.227.101/mamakmukekkontol/zerobotv9.arm7    | 2026-01-02 |
| mips         | http://216.126.227.101/mamakmukekkontol/zerobotv9.mips    | 2026-01-02 |
| mpsl         | http://216.126.227.101/mamakmukekkontol/zerobotv9.mpsl    | 2026-01-02 |
| x86          | http://216.126.227.101/mamakmukekkontol/zerobotv9.x86     | 2026-01-04 |
| x86\_64      | http://216.126.227.101/mamakmukekkontol/zerobotv9.x86\_64 | 2026-01-02 |
| spc          | http://216.126.227.101/mamakmukekkontol/zerobotv9.spc     | 2026-01-02 |
| arc          | http://216.126.227.101/mamakmukekkontol/zerobotv9.arc     | 2026-01-02 |
| m68k         | http://216.126.227.101/mamakmukekkontol/zerobotv9.m68k    | 2026-01-02 |
| sh4          | http://216.126.227.101/mamakmukekkontol/zerobotv9.sh4     | 2026-01-01 |
| ppc          | http://216.126.227.101/mamakmukekkontol/zerobotv9.ppc     | 2026-01-04 |
| i686         | http://216.126.227.101/mamakmukekkontol/zerobotv9.i686    | 2026-03-12 |

The same server that hosts the EvilTokens PHP backend (serving "Microsoft 365 - Voicemail" lure pages) also distributes zerobotv9 — a known IoT botnet malware family that targets routers, IP cameras, and other embedded devices. The malware is served from `http://` (not HTTPS) and covers 13 CPU architectures, indicating a large-scale IoT botnet distribution operation co-located with the EvilTokens phishing infrastructure. This is consistent with a multi-criminal-use infrastructure where the operator runs both phishing-as-a-service and IoT botnet distribution from the same VPS.

## 7\. Screenshot Evidence — Detailed Analysis

### MailVault C2 Marketing Page

The `techroboticslabmade.com` root page renders as a professional SaaS marketing page. Key elements confirmed from screenshot analysis:

- **Logo**: Purple square with white envelope icon, text "MailVault" in purple-to-white gradient
- **Navigation**: "Features" link, "Tenant Login →" button
- **Status badge**: "Platform Status: Online" (green dot)
- **Headline**: "Enterprise Email Management Platform" with "Email Management" in purple-to-pink gradient
- **Sub-headline**: "Secure, isolated tenant environments with advanced monitoring, automated workflows, and real-time analytics."
- **Stats bar**: "99.9% Uptime SLA" | "256-bit Encryption" | "24/7 Monitoring"
- **Feature cards**: Tenant Isolation, Real-time Dashboard, Auto-Refresh, Landing Pages (with "bot detection"), Telegram Alerts (for "captures"), Multi-Scope Auth

### MailVault Admin Panel

The admin panel at `/t/{tenant_id}/admin` renders as:

- **Icon**: Yellow waving hand emoji (&wave;&wave;&wave;)
- **Heading**: "Welcome back"
- **Subtext**: "Enter your access key to get started"
- **Input field**: Padlock icon, placeholder "Paste your access key"
- **Button**: "Continue →" (solid purple)
- **Footer link**: "Lost your key? Contact support"

### Gate Page — bonlait.com (2026-06-25)

- **Blue header banner** with yellow padlock+key icon
- **Heading**: "Verify You Are Human"
- **Sub-heading**: "Secure · Private · One-click"
- **Instruction**: "Enter your email address to verify your identity and continue."
- **Email input field**: label "Email Address", placeholder "[\[email protected\]](https://f4n6.co.uk/cdn-cgi/l/email-protection)"
- **Button**: "Continue" (full-width, grey-blue)
- **"Important Notice"**: "We verify real users to keep our service safe. Your email is used only for this access check and is not stored permanently."
- **Footer**: "© 2026 Identity Assurance"
- **Badge**: "Privacy Protected" (shield icon)

### Gate Page — bibf.ac.bw (2026-03-26)

- **Blue header**: "Verify You Are Human" with yellow padlock icon
- **Instruction**: "Please enter your email address to continue."
- **Email input**: label "Email Address", placeholder "[\[email protected\]](https://f4n6.co.uk/cdn-cgi/l/email-protection)"
- **Button**: "Continue"
- **"IMPORTANT NOTICE & DISCLAIMER"** section with three subsections:  
  - **"Identity verification scope"**: "strictly for identity confirmation, account security, and authorized communication"
  - **"Data processing & transparency"**: references **GDPR Article 6** and **CCPA §1798.100**. States: "Your email address, IP address, timestamp, and browser metadata are collected to prevent fraud, ensure security, and meet legal obligations"
  - **"Your rights & control"**: (text cut off at bottom of screenshot)

The GDPR and CCPA references are **social-engineering** — fabricated legal text designed to make the target believe the page is a legitimate compliance-compliant identity check. The kit is sophisticated enough to include fake regulatory references and a "Privacy Protected" badge.

### Bot-Filter Interstitial — nathan-5c9 workers.dev (2026-06-24)

- **Horizontal rounded rectangle** with white background and purple border
- **Checkbox icon** (left)
- **Text**: "Access verification" (bold) / "Tap to proceed" (smaller)
- **Shield+checkmark icon** (right, purple)

This interstitial mimics Cloudflare's "Verify you are human" challenge UI. It is the JavaScript gate that traps non-JS crawlers — sandboxes and search-engine bots without JavaScript execution never proceed past this page, which is why no live EvilTokens gate page appears in Google, Bing, or DuckDuckGo's indexed results.

## 8\. What This Means

1. **The Abnormal IOCs are still valid.** Every named domain, IP, and infrastructure pattern from the 3 April writeup is confirmed live or was live within the past 90 days.
2. **The kit has spread.** At least 7 new compromised domains are serving the same gate-page template. None appear in the original IOC list.
3. **The operator is rotating backend domains.** Three domains (`macmamo.com`, `smstltle.net`, `notificationsmanagersec.com`) all serve the same voicemail lure from the same Cloudzy IP.
4. **Multiple operators are active concurrently.** The `-s-account.workers.dev` pattern appears across 20+ distinct Cloudflare Worker tenants.
5. **The infrastructure is multi-criminal-use.** The same Cloudzy VPS hosts both EvilTokens phishing infrastructure and zerobotv9 IoT botnet malware.
6. **The bot filter and encrypted payload remain effective against search engines.** Google, Bing, and DuckDuckGo have not indexed any live EvilTokens gate page. URLScan.io remains the most effective public source for tracking this infrastructure.
7. **The kit's social engineering is sophisticated.** Gate pages include fake GDPR/CCPA compliance text, fabricated "Identity Assurance" branding, and "Privacy Protected" badges. The bot-filter interstitial mimics Cloudflare's challenge UI.

## 9\. Defensive Recommendations

1. **Block Railway CIDRs** (162.220.232.0/22, 162.220.234.0/22) via Conditional Access Named Locations. The MailVault C2 and token replay infrastructure operate from Railway.
2. **Block the Cloudzy IP** 216.126.227.101 at the network layer. This IP hosts three EvilTokens backend domains and zerobotv9 IoT botnet malware.
3. **Disable Device Code authentication** via Conditional Access unless explicitly required for headless devices.
4. **Enable Continuous Access Evaluation (CAE)** to reduce token revocation latency to near-real-time.
5. **Monitor for the kit's URL patterns**:  
  - `/{Day}-{uuid}-{DictWord}{hex}{F|G}.html` on compromised CMS sites
  - `*-s-account.workers.dev` subdomains on Cloudflare
  - Page titles: `Identity Verification`, `DocuSign - Review Document`, `Microsoft 365 - Voicemail`, `A.C.H Payment Processing Team`, `Verify You Are Human`
6. **Monitor URLScan.io** for the kit markers. The query `page.title:"Identity Verification"` returns current gate pages. The query `page.title:"DocuSign - Review Document"` filtered to `workers.dev` domains returns current Cloudflare Worker tenants.
7. **Block the three backend domains** at the DNS/proxy layer: `macmamo.com`, `smstltle.net`, `notificationsmanagersec.com`.

## 10\. Indicators of Compromise (Updated 2026-06-25)

### Domains

| Domain                          | Role                                                        | Status                                          |
| ------------------------------- | ----------------------------------------------------------- | ----------------------------------------------- |
| techroboticslabmade.com         | MailVault C2                                                | Live (last seen 2026-04-03)                     |
| macmamo.com                     | Self-hosted PHP backend                                     | Live (last seen 2026-04-06)                     |
| smstltle.net NEW                | Self-hosted PHP backend                                     | Live (last seen 2026-04-06)                     |
| notificationsmanagersec.com NEW | Self-hosted PHP backend                                     | Live (last seen 2026-04-06)                     |
| bibf.ac.bw                      | Compromised gate site (Botswana Inst. of Banking & Finance) | Active 2026-03-18 to 2026-03-26                 |
| acb.af                          | Compromised redirector (Afghanistan Cricket Board)          | /kit/kit path seen 2026-04-01; later repupposed |
| bonlait.com NEW                 | Compromised gate site                                       | Active 2026-06-18 to 2026-06-25                 |
| advanced-leadership.com NEW     | Compromised gate site                                       | Active 2026-04-28 to 2026-06-25                 |
| nycelitechauffeur.com NEW       | Compromised gate site                                       | Active 2026-06-18 to 2026-06-24                 |
| stacoelectrics.com NEW          | Compromised gate site                                       | Active 2026-06-22 to 2026-06-23                 |
| mgj.social NEW                  | Compromised gate site                                       | Active 2026-06-22 to 2026-06-23                 |

### IP Addresses

| IP              | Role                                                                 | ASN               |
| --------------- | -------------------------------------------------------------------- | ----------------- |
| 216.126.227.101 | Self-hosted PHP backend (Cloudzy, Tampa) + zerobotv9 malware hosting | Cloudzy           |
| 66.33.22.37     | MailVault C2 (Railway)                                               | Railway AS400940  |
| 151.101.2.15    | MailVault C2 (Fastly CDN edge)                                       | Fastly AS54113    |
| 103.227.176.4   | bibf.ac.bw gate site                                                 | —                 |
| 68.168.113.90   | bonlait.com gate site                                                | GloboTech AS36666 |
| 66.29.145.219   | acb.af                                                               | —                 |
| 69.174.115.247  | advanced-leadership.com gate site                                    | —                 |
| 192.185.182.107 | nycelitechauffeur.com gate site                                      | —                 |
| 170.205.52.130  | stacoelectrics.com gate site                                         | —                 |
| 74.124.194.57   | mgj.social gate site                                                 | —                 |

### Cloudflare Worker Pattern

Subdomains matching `*-s-account.workers.dev` are EvilTokens operator tenants. The pattern `{random-3-4-char-groups}.{compromised-business-domain-with-dashes-replaced}-s-account.workers.dev` is the kit's signature.

### Kit Markers

| Marker                                  | Context                                                      |
| --------------------------------------- | ------------------------------------------------------------ |
| v2.4.0                                  | Gate-page version string (in encrypted payload, not indexed) |
| Identity Verification                   | Gate-page title (visible in URLScan scans)                   |
| // <-- REPLACE WITH YOUR ACTUAL DOMAIN  | Template placeholder (in kit source, not rendered)           |
| DocuSign - Review Document              | Lure page title                                              |
| Microsoft 365 - Voicemail               | Lure page title                                              |
| A.C.H Payment Processing Team           | Lure page title                                              |
| MailVault — Enterprise Email Management | C2 marketing page title                                      |
| Verify You Are Human                    | Gate-page header text                                        |
| © 2026 Identity Assurance               | Gate-page footer text                                        |
| Privacy Protected                       | Gate-page badge text                                         |

### zerobotv9 Malware Paths

| Path                                                     | Note                                                                                            |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| http://216.126.227.101/mamakmukekkontol/zerobotv9.{arch} | Multi-arch IoT botnet binaries (arm5/arm6/arm7/mips/mpsl/x86/x86\_64/spc/arc/m68k/sh4/ppc/i686) |

Data collected via SearXNG, URLScan.io, Certificate Transparency logs, Wayback Machine, and local vision model analysis. All sources are publicly accessible. No authentication was used. No private systems were accessed.

Adverse Trace · OSINT Assessment · 2026-06-25