kkkwork.org/online/devices
domain C2Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-07T14:55:21
Registration
- Registrar
- -
- Registered
- -
- Expires
- -
DNS
- Resolves to
- -
- Nameservers
- -
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| SMS-Eye (provisional) | b44270b7f7d5… | C2 | 2025-06-13 |
About SMS-Eye (provisional)
**SMS-Eye** (provisional) is an Android OTP/SMS stealer: it requests SMS read/receive access and silently forwards incoming messages (one-time passcodes, banking and 2FA texts) to its operator at kkkwork.org. Minimal UI, built to monetize intercepted verification codes. Provisional label pending correlation to a named family.
Signing certificate
- Subject CN
- BotSigner
- Issuer CN
- BotSigner
- Valid
- 2025-03-19 → 2052-08-04
- Fingerprint
- 6e1c70020afda44cd0e6ff17ea0e069dea5d521a2bb6604a2ae7bda69c72d7c1
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.