Kali365 / EvilTokens - Known Panel Domain Connections

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•7

Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.