IronToll Phishing Card/PII Data POST to Lookalike Domain

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•1

Detects sensitive data exfiltration attempts (PII, credit card, OTP) via HTTP POST requests to suspicious lookalike domains, followed by a WebSocket connection to known IronToll C2 infrastructure.