IronToll Phishing Kit Cloaking - Desktop UA Blocked with 404 on Known Lure Path

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•1

Detects country-coded lure path requests (/eg, /ma) followed by a cloaking differential response (desktop UA blocked with 404, mobile UA served content). Fixed a regex bug where the original pattern matched any path merely starting with 'eg' or 'ma' (e.g. /egg.jpg, /mail, /manifest.json) instead of the exact path segment.