EvilTokens PhaaS infrastructure DNS lookup - smartviewdevices.com (exact/subdomain match, high-confidence IOC, low FP risk)

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•1

Detects network traffic (DNS, TLS SNI, and HTTP Host headers) attempting to communicate with infrastructure associated with the EvilTokens Phishing-as-a-Service (PhaaS) platform. This activity is indicative of credential harvesting or adversary-in-the-middle (AiTM) attacks.