ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain privatetoken.app.

Database Entry


IOC ID:1850762
IOC: privatetoken.app
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : True
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-07-15 06:17:49 UTC
Last seen:never
UUID:9d41d033-7fde-11f1-97fa-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:kali365 m365 oauth-device-code-phishing octopi365 phishing-as-a-service
Reference: https://ransom-isac.org/blog/kali365-phaas-oauth-device-code-phishing/

Avatar
DENNISAROSS
Panel/auth backend (panel.privatetoken.app) for Kali365/Octopi365 PhaaS platform (OAuth device-code + AiTM M365 token theft, per FBI PSA 2026-05-21 and Ransom-ISAC purchased-panel-access writeup). Registered ~2026-05-21, moved to Cloudflare NS within days. Currently returning Cloudflare's own "Suspected Phishing" block page at the edge. Domain not previously listed in OTX/URLhaus/ThreatFox as of 2026-07-14.