EvilTokens Gate Check API Request to /api/device/gate/ Endpoint

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•9

Detects HTTP GET requests to the /api/device/gate/ path, a specific behavior associated with EvilTokens phishing kits. Attackers use this gate check endpoint to identify and potentially burn active phishing sessions for security researchers or automated scanners.