Authentication from EvilToken Infrastructure (Railway.com)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•1•0•4

Detects successful user authentications originating from known malicious IP addresses associated with EvilToken infrastructure hosted on Railway.com. This indicates potential compromise via phishing or other credential theft methods.