hxxps://www[.]jsonkeeper[.]com/b/KUWNE

Posts referencing this indicator

• Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects

  Socket

  Threat actor-controlled configuration endpoint used to fetch the phishing redirect URL

  2026-05-13