EvilTokens Phishing Kit - Cloudflare Workers viewdoc typosquat subdomain detected

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•5

This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.