AnonyMousKIT-family PhaaS backend domain contacted

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•3

This rule detects network connections (TLS SNI and HTTP requests) to domains associated with the AnonyMousKIT PhaaS (Phishing-as-a-Service) platform. It flags connections to known phishing backend domains and monitors for access to suspicious management dashboard paths commonly utilized by this threat actor for managing phishing orders and communications.