2026-11-13 06:18:32
A week ago, I attended PUSH UX in Munich, Europe's largest conference on product design and user experience, featuring speakers from Anthropic, Wise, Google, IKEA, n8n, and other prominent organizations. On my way home, I kept thinking about one recurring theme: product design teams are approaching AI from fundamentally different perspectives.
Some are cautiously experimenting with AI while trying to fit it into established processes. Others have already integrated it into their daily workflows, connecting research, prototyping, design, and code with fewer handoffs. The difference goes beyond tool adoption. It reflects how teams understand their work, organize collaboration, and measure product value.
Paulo Oliveira from IKEA highlighted a fundamental problem with the way organizations approach AI:
"Most efforts start with tools, copilots, and automation, and mistake faster cycles for value. The result is a pile of pilots nobody adopted, and a lot of people wondering what happened to the work they were good at. The alternative: to build something that fits, lasts, and makes an organization better at what it already does well. That starts by refusing the AI first, AI everything instinct."
I think this captures one of the central challenges in product design today.
Adding AI to an existing workflow can make individual tasks faster without improving the product or the way a team operates. Organizations can accumulate tools and experiments while leaving the underlying processes unchanged.
Meaningful adoption starts with understanding where teams lose time, which handoffs create friction, and where AI can improve how products are researched, designed, built, and validated.
For years, product design and software development operated as distinct stages. Designers worked in Figma, documented interactions, prepared specifications, and handed their work to engineers for implementation. This division made sense when building and testing functional interfaces required substantial engineering resources. AI-assisted development is changing that relationship.
After years of designing fintech and blockchain-based products, I kept encountering the same limitation: I could design an experience without having full control over how it was implemented.
About a year ago, I started building websites and applications from scratch with AI tools. As I described in my previous HackerNoon article, Claude Code Finally Made Me an Engineer After 10 Years in Figma, my workflow shifted from almost entirely Figma to roughly 90% Claude Code.
Working closer to production code lets me build, test, and iterate on interfaces directly, with fewer handoffs between design and engineering.
For product teams, this opens up several possibilities:
This doesn't mean every designer needs to become a full-time software engineer. Deep specialization remains essential, particularly in complex products. However, designers can work closer to implementation and contribute beyond the traditional boundaries of their roles.
Another exciting development is how AI is changing prototyping. Think about how difficult it used to be to create an interactive prototype for a specific device, such as an Apple Watch or an in-car infotainment system. Even without writing production code, designers can now use AI to build interactive prototypes tailored to specific hardware and explore how their ideas work in real-world contexts.
As AI makes prototyping, coding, and exploring alternatives easier, the focus of design work is shifting toward decision-making and product quality. Understanding whether it solves the right problem, meets user needs, and works reliably requires experience and critical judgment.
This is where faster workflows can create lasting value. Teams have more opportunities to test assumptions, explore alternatives, and identify problems before committing significant resources to a solution. However, individual productivity gains aren't enough. Organizations need to connect design, engineering, and product teams around shared workflows, clear quality standards, and meaningful evaluation of AI-generated output.
I'm particularly interested in how this can shape an AI-first product culture. The goal is to encourage experimentation while maintaining the technical rigor, security, and reliability that deep tech products demand.
Many designers argue that AI-generated product experiences lack quality. Are they right? Sometimes. Can the results improve? Absolutely.
AI-assisted research and discovery can produce shallow or generic results, especially when designers rely on AI without applying their own expertise and critical judgment. The quality of the outcome depends on how thoughtfully people guide, evaluate, and refine the process. Julia Bastian from Alasco explored this challenge in a session on AI discovery slop, examining how to recognize and address low-quality AI-generated research and insights.
The PUSH UX conference reinforced how differently the design community is responding to AI. Some teams are still finding their footing, while others are already changing how they work. My own experience has made me more comfortable working across design, product strategy, and engineering, but every team will need to find its own approach.
The important shift is to reconsider established workflows, explore where new capabilities can make a difference, and take greater ownership of business outcomes.
👍 Liked this article? Follow me on
💬 Designers and product builders: share how AI coding tools are changing your workflows and the way you collaborate with engineering.
2026-11-13 05:00:39
Telegram is a cloud-based mobile and desktop messaging app known for its focus on speed and security. It matters as a platform for secure communication, community building, and distributing information, offering features like channels and bots.
<strong><em>(you may skip it if you already know what to do with your bot)</em></strong>
Telegram deleted messages recovery guide: Learn how to retrieve group chat messages and media using Telegram API, admin logs, and open-source tools.
In this article, you will walk through the creation of a simple Bash shell script to send messages to Telegram messenger using the Curl command. Then you will use this script to send a notification on every ssh login into your server.
Denis Vasin, Co-Founder & Lead Dev of Storm Trade, shares insights on the platform's Telegram integration, $STORM token launch, and vision
Learn how to send messages from python script to Telegram chat.
Telegram and WhatsApp are two popular instant messaging apps known to app users all over the globe. Read a honest comparison of both apps from an app user.
Controlling the queue to our office gaming room by Arduino-based Telegram. The Arduino with servo motor was installed to lock and unlock the door
Introduction
The Telegram chatbot will find answers to questions by extracting information from the history of chat messages.
Unlimited cloud storage for storing photos, videos, and files using the Telegram App. The best alternative to Google Drive and Google Photos.
Telegram is not the gold-standard for secure messaging that it paints itself to be. Here are 7 reasons why.
Building telegram bot using Rust.
Did you know that Telegram stickers can give you away? In this article, I will teach you how to deanonymize anonymous channel authors using a module for Maltego
You’ve got your smart home fully set up. You regularly like to show off with your friends how cool it is to turn on light bulbs, play videos and movies with a hint to your voice assistant, make coffee and adjust the thermostat with a tap on an app. Congratulations!
I was tasked with creating a telegram bot using ruby a while back. I had no idea where to start and just like any other programmer out there I turned to the internet for clues. I did not find a good article and hence experienced a lot of problems creating the bot. I have decided to write an article to explain how to create a telegram bot from scratch.
Automate thankless tasks like splitting grocery bills using a Telegram Bot and AWS.
Telegram bots have a variety of functions; they range from setting notifications to website monitoring. Find out more about how these bots are being used here.
This tutorial will guide you through the process of creating a simple Telegram bot using JavaScript, Node.js and GrammY.
In this article, I want to explain how the Hamster Kombat game business works—how much the community members earn and possible project earnings.
2019 has marked itself not only with the end of the crypto winter but also with time when established technology companies entered the blockchain field. Telegram is going to release its own blockchain with the goal of processing millions of transactions per second. Facebook plans to introduce Libra coin to facilitate payments for 1.7 billion unbanked but connected people.
Last week my friend asked for help with coding a Telegram bot for the VIP 😏 customers of his herbs shop.
Grow your Telegram crypto community with 10 effective methods, from feedback to marketing strategies.
Summary of https://contest.com/blockchain from BUTTON Wallet Team
I am a big fan of Telegram because of its great bot-ecosystem. I have been planning to make a bot for a while and have been looking for some nice workflow tools that can help me accomplish handling the back-end workflow of the bots visually. Recently, I started working with n8n, a fair-code licensed tool that helps you automate tasks, sync data between various sources and react to events all via a visual workflow editor.
I created a simple Telegram bot that could retrieve Bitcoin's Price to convince my friends that Telegram is far superior to Whatsapp.
Scala 3 is finally here, but have you seen many real-world applications written in it? In this article, I will show you an example of such an application!
🚀 Introducing Plasma ChatGPT & Image AI Assistant: Revolutionize your efficiency with 160+ professional roles at your fingertips! 🌟 Unleash your potential.
I have several Telegram channels, in Russian and English. I earn about $5,000 a month from them.
Why strong communities are important for blockchain projects
How about running your Postman collections of API requests and automatically getting a meaningful report right in Telegram? Let's do it in one small script! 🔥
Grindery co-founder Tim Delhaes discusses how account abstraction and integration of web3 stack to privacy-focused message apps can increase web3 adoption.
In part 2 of 3, we explore simple altering for Telegram bots when the system starts to fail.
AlphaTON partners with SingularityNET to deploy hydroelectric-powered GPUs for Telegram's Cocoon AI network in Sweden.
Getting started with Telegram TDLib in React Native: Exploring authorization, user profile retrieval, and the first steps into native code.
Get rid of useless telegram channels that shill crypto scams and ads. Here you'll find the list of 7 best telegram channels for crypto and web3.
Telegram Marketing is a method of attracting and retaining new consumers through the creation of Telegram communities
2020 is shaping up to be the year of dApps! New communities are forming around cryptocurrency and they are asking for just one thing: decentralization. All the services and platforms you are accessing online right now can be decentralized in one way or another.
You can get confused in a wide variety of different messengers. Some apps offer versatility, others a user-friendly interface and others guarantee the privacy and security of users.
Today, with the crypto market experiencing a rebound, the social media preference is now in favor of Telegram, boasting almost a billion users
The number, frequency, and scale of scams involving impersonations are growing like fungi. It’s probably the sign of our times and it’s worrisome.
Crypto is a relatively insulated emerging technology, making the path to mass adoption uniquely challenging. While blockchain projects promise to disrupt ...
Telegram Premium was released in June this year. It brings added customization features, increased limits, and an ad-free experience.
Telegram Mini Apps for business are a cross-platform alternative to apps and websites, boosting user acquisition while minimizing deployment lag.
The Portal One+ Telegram bot assistant, built on the OpenClaw runtime, aims to be fundamentally different to other AI assistants within Telegram
71% of Millennials and 79% of Generation Z in the U.S. admit to feeling lonely. 60% of Tinder users say the same. NFT vows, social connections in the metaverse,
Pavel Durov, the founder of Telegram, wants to introduce Web 3.0 technologies into the instant messaging app in a contested move.
In our previous review, we made a detailed overview of Telegram Open Network and the specific features in the operation of key nodes (validators) of TON Blockchain. In this article, we will elaborate on one of the key aspects affecting the security and correct operation of the TON blockchain – a protocol allowing to achieve consensus between the network validators that are thoroughly described in the recently released document Catchain Consensus: An Outline authored by Nikolay Durov.
On June 11, Techcrunch.com and the Liquid cryptocurrency exchange website published news that the sale of the alleged Telegram tokens will start on July 10. The newsworthy event has caught buzz within the cryptocurrency community, and based on it we have decided to explore the channels and the news flash sequence, namely which sites are most effective and what tools can be used to make the newsworthy event even more noticeable.
I Had an Idea
As a freelancer working for different countries, I needed to optimize my currency exchange. So, I built a simple forex app with AWS Lamda and Telegram bots.
After a couple of days of using the service described in previous articles, I felt the need to also get graphs directly in Telegram.
Some time ago I searched for an easy way to establish a communication channel between a mobile device and a Node.js webserver. My goal was to exchange messages over this channel and receive information about the weather, public transportation and more.
For example I send the message /train and receive a response with realtime details about train departure times of preconfigured routes. So the Node.js server receives the incoming message, processes it and sends a response back to the client.
Why Telegram games need to do better with marketing.
Everything started when my mate was going on a vacation to Spain. Every single day, he checked the airlines’ websites to find the cheapest ticket and manually monitored prices of a certain flight. All these attempts were tedious, humdrum, and time-consuming for him.
In this article, we will learn how to create a chatbot in the Telegram messenger app from scratch. No special knowledge is required, but Python knowledge helps.
Learn how to build a voting smart contract using Tact on the TON blockchain — from writing code to deploying and testing in the TON Web IDE.
Being in close proximity to the consumer is the cherished dream of every brand and it's key to a successful marketing strategy. What could be closer than a messenger? We communicate with friends and relatives, we look at it hundreds of times a day. Messenger has become a crucial part of everyday life.
Wallet in Telegram users will be able to deposit, withdraw and trade MON directly within the app. The listing will be accompanied by a dedicated native MON stak
The problem of sustaining momentum within Telegram mini-games, from engaging with users to integrating blockchain solutions that will guarantee long-term succe
Is Telegram messenger secure enough for private messages and group chats? Can Telegram protect the privacy of users? We did research on this.
GRAM - a new token on the TON blockchain, was launched on January 30th. Since its launch, the price of GRAM has skyrocketed 28,000 times.
Telegram games are fast becoming scams. Personal experience with a Telegram game's founder.
Monetag, a monetization platform, announces a new traffic monetization opportunity for Telegram Mini Apps owners - monetizing their app audience.
Bitcoin is not a social media site and cannot be one. Social media is full of noise and hype.
Encryption is a human right - the right to privacy and to personal expression.
Learn to build a Node.js Telegram bot with Telegraf that tracks BNB Chain wallet activity in real-time using WebSockets like GetBlock.
Explore how I built a language-learning Telegram bot with NestJS, a powerful Node.js framework. Follow along as I detail the development process and share insig
Learn how to create an automated workflow with n8n that gets international poems, translates them into one language, and sends a poem in Telegram every day.
Telegram CEO Pavel Durov's arrest sparks a heated debate on privacy vs. security.
This article demonstrates how to create a simple chatbot in Telegram and configuring it using Quickwork Journey Builder.
Why Pavel Durov was arrested in France? A description of legal conflict between Telegram and EU authorities.
Discover the revolutionary features of my new Telegram bot in this exclusive HackerNoon article. Learn how our app integrates cutting-edge technology
Learn everything you need to know about Telegram via these 52 free HackerNoon stories.
People have been switching from WhatsApp to other messaging apps; for a good reason. Here are five new apps taking the place of WhatsApp now in the tech space.
In this article, we’re going to show you how to create tooling that alerts you via Telegram if your node is jailed.
Two months ago a bill that would allow the extradition of Hong Kong’s criminal suspects to China led to a revolt that is still going on. The 5th of August, some 64 days after the main protests started, saw Hong Kong’s first general strike in over 50 years.
Note: these directions come without much conversation, let the hacking begin!
Chat-based cryptocurrency wallets integrate with p2p chat and online community apps and platforms to simplify crypto transactions.
Positioned as a purpose-built Layer 1 blockchain instead of a Layer 2, TAC promises Telegram’s billion-strong user base one-tap access to Ethereum-grade DeFi.
TON alternatives and why Telegram Open Network failed as a project. What can we expect from other projects
Elliptic joins forces with TON Foundation, fortifying the Telegram-based Web3 ecosystem against illicit activities, fostering crypto security.
Consumer adoption in web3 and how chains are positioning themselves for mass adoption.
WeChat and Kakao have merged gaming with messaging, while Telegram is shaping the GameFi future. Learn about a new era of in-messenger gaming.
Users can now deposit USDC or USDT from Ether, Solana, TRON, BSC, Polygon, Arbitrum, and Base directly in Wallet in Telegram. The integration manages cross-chai
Crafting Telegram bot-driven NFTs, and delving into Web3 and blockchain tech for creative enthusiasts.
Interview with Oleksandr Savieliev, CEO and Founder of TripleA, a Telegram mini-app and cross-market news aggregator that combines feeds for 90+ sources
The Company has entered into a definitive agreement for the purchase of an aggregate of 15,000,000 of its ordinary shares (or pre-funded warrants in lieu thereo
Telegram strives to maintain an active and healthy community of volunteers. However, the big question is, why create these spaces for participation?
Notcoin and UXLINK are the two breakout projects built on the social messaging app Telegram.
WePlay hosted an AMA (Ask Me Anything) session on the CryptoSquad Telegram channel. Here's what went down.
8/28/2024: Top 5 stories on the HackerNoon homepage!
https://hackernoon.com/what-crypto-can-learn-from-russias-war-on-telegram-febb841ea880
The Gun.io Telegram bot streamlines the job searching process for software developers by integrating their job searching tools with their Telegram workflow.
8/16/2024: Top 5 stories on the HackerNoon homepage!
Wenix integrates competitive skill-based gameplay with an earning mechanism connected to the WeFi ecosystem, combining entertainment with decentralized finance.
Visit the /Learn Repo to find the most read blog posts about any technology.
2026-11-13 01:52:14
PaddleOCR (92.6K stars) beats MinerU (83.5K) and Tesseract (77.5K) as the most-starred open source OCR project on GitHub. Below are all 138 OCR and document-parsing repos with 1,000+ stars in the Text Mining directory, ranked.
Every RAG pipeline eventually hits the same wall: the PDF. Before a language model can answer anything about your contracts, papers or invoices, something has to turn pixels and layout into clean text. The tools for that job are splitting into two camps. In HackerNoon's comparison of OCR and vision LLMs, template-based OCR breaks when layouts shift, while vision LLMs read documents more flexibly but cost more at volume. The author's verdict: "It could mostly be a hybrid approach."
Meanwhile, the vision models are shrinking. Xiaomi-OCR-0 handles text, tables and formulas with 0.8B parameters, and TeleOCR does structured document parsing with 1.2B. This list is the "show me everything" version of that landscape.
The Text Mining directory tracks the 3,141 most-starred open source text mining projects on GitHub (100+ stars, no forks or archived repos). Its OCR & Documents filter tags 321 of them, which together hold about 1.24M stars. We kept repos with 1,000+ stars (161) and removed 23 that are tagged OCR but aren't really OCR or document tools: generic AI course repos, an inference framework, a clipboard syncer, and captcha solvers, which we chose not to promote. That leaves 138. Star counts are from the directory's November 11, 2026 snapshot.
A few patterns stand out in the full category:
The long tail (100 to 999 stars) is where you find niche tools like single-language engines, receipt parsers and research code. Browse all 321 on the OCR & Documents filter, or narrow by language, license and last-updated date.
2026-11-13 00:50:13
all-MiniLM-L6-v2, a 23M-parameter sentence-transformers model, was downloaded 177M times on Hugging Face in the last 30 days. That's 38% of all downloads across the 213 open-weight embedding models tracked by the TextModels directory, and more than the next four models combined. Below are all 338 embedding models in the directory: open weights ranked by downloads, then hosted APIs, Ollama builds and the historical models that started it all.
Most "best embedding model" lists rank by benchmark score, like PremAI's ranking by MTEB score, cost and self-hosting. Benchmarks tell you what's best on paper. Downloads tell you what developers actually ship, and the two lists look very different.
The sentence-transformers family's lead has a history. As HackerNoon's overview of embeddings for RAG puts it, "Simply said, the BERT model isn't the best for similarity search." SBERT fixed that by embedding each sentence separately so vectors can be computed once and compared fast, and its descendants still dominate the download charts.
Everything comes from the TextModels directory's Embedding filter (338 models) as of November 11, 2026. Hugging Face entries are ranked by 30-day downloads pulled from the Hugging Face API. "Verified" means the TextModels directory fetched and confirmed that model's metrics per model. Hosted API models have no public download counts, so they're grouped by provider, alphabetically. Some hosted entries, like OpenAI's 001-series search models, are long retired. They stay in the list because people still search for them when migrating old pipelines.
These are models you call over an API instead of downloading. The list covers current models and retired ones still found in old codebases.
OpenAI (19)
219. code-search-babbage-code-001
220. code-search-babbage-text-001
222. text-search-ada-query-001
223. text-search-babbage-doc-001
224. text-search-babbage-query-001
225. text-search-curie-doc-001
226. text-search-curie-query-001
227. text-search-davinci-doc-001
228. text-search-davinci-query-001
230. text-similarity-babbage-001
231. text-similarity-curie-001
232. text-similarity-davinci-001
Cohere (8)
233. embed-v4.0
234. embed-english-v3.0
237. embed-multilingual-light-v3.0
238. embed-english-v2.0
Google Vertex AI (8)
241. gemini-embedding-001
242. gemini-embedding-002
243. text-embedding-004
244. text-multilingual-embedding-002
245. textembedding-gecko@003
246. textembedding-gecko@002
247. textembedding-gecko@001
248. textembedding-gecko-multilingual@001
NVIDIA NIM (7)
249. nv-embed-v2
250. nv-embed-v1
251. llama-3.2-nv-embedqa-1b-v2
252. llama-3.2-nv-embedqa-1b-v1
254. nv-embedqa-e5-v5
255. nv-embedcode-7b-v1
IBM watsonx / Granite (6)
256. granite-embedding-english-r2
257. granite-embedding-multilingual-r2
258. granite-embedding-30m-english
259. granite-embedding-125m-english
260. granite-embedding-107m-multilingual
261. granite-embedding-278m-multilingual
Amazon Bedrock (4)
262. amazon.titan-embed-text-v2:0
263. amazon.titan-embed-text-v2:1
264. amazon.titan-embed-text-v1
265. amazon.titan-embed-g1-text-02
Mistral AI (3)
266. mistral-embed
267. codestral-embed-2506
268. codestral-embed-2505
Ollama doesn't publish download counts, so these are sorted from smallest to largest. Pick the smallest one that clears your quality bar.
269. all-minilm 22m
270. snowflake-arctic-embed 22m
271. granite-embedding 30m (IBM)
272. all-minilm 33m
273. snowflake-arctic-embed 33m
274. snowflake-arctic-embed 110m
276. snowflake-arctic-embed 137m
277. granite-embedding 278m (IBM)
278. paraphrase-multilingual 278m
279. embeddinggemma 300m (Google)
280. bge-large 335m
282. snowflake-arctic-embed 335m
283. bge-m3 567m
284. snowflake-arctic-embed2 568m
285. qwen3-embedding 0.6b (Alibaba / Qwen)
286. qwen3-embedding 4b (Alibaba / Qwen)
287. qwen3-embedding 8b (Alibaba / Qwen)
288. nomic-embed-text-v2-moe latest (size not listed)
Before sentence-transformers there were word vectors, and before RAG there was semantic search. These are the ancestors of everything above.
289. word2vec Skip-gram Google News (Google)
290. word2vec CBOW Google News (Google)
291. GloVe 840B 300d (Stanford NLP)
292. GloVe 42B 300d (Stanford NLP)
293. GloVe 6B 300d (Stanford NLP)
294. GloVe 6B 200d (Stanford NLP)
295. GloVe 6B 100d (Stanford NLP)
296. GloVe 6B 50d (Stanford NLP)
297. GloVe Twitter 27B 200d (Stanford NLP)
298. GloVe Twitter 27B 100d (Stanford NLP)
299. GloVe Twitter 27B 50d (Stanford NLP)
300. GloVe Twitter 27B 25d (Stanford NLP)
301. fastText Common Crawl 300d 2M (Meta AI)
302. fastText Wiki News 300d 1M (Meta AI)
303. ELMo Original 5.5B (Allen Institute for AI)
304. InferSent v1 (Meta AI)
305. Universal Sentence Encoder DAN (Google)
306. Universal Sentence Encoder Transformer (Google)
307. LASER2 (Meta AI)
308. bert-base-uncased (Google)
309. bert-base-cased (Google)
310. bert-large-uncased (Google)
311. bert-large-cased (Google)
312. albert-base-v1 (Google)
313. albert-base-v2 (Google)
314. albert-large-v1 (Google)
315. albert-large-v2 (Google)
316. albert-xlarge-v1 (Google)
317. albert-xlarge-v2 (Google)
318. albert-xxlarge-v1 (Google)
319. albert-xxlarge-v2 (Google)
320. Sentence-BERT Base NLI Mean Tokens (UKP Lab)
321. Sentence-RoBERTa Large NLI STS-B (UKP Lab)
322. SimCSE BERT Base Supervised (Princeton)
323. SimCSE BERT Base Unsupervised (Princeton)
324. SimCSE RoBERTa Large Supervised (Princeton)
325. SimCSE RoBERTa Base Unsupervised (Princeton)
326. SapBERT (Cambridge)
327. RetroMAE Base (Microsoft)
328. GTR Base (Google)
329. GTR Large (Google)
330. GTR XL (Google)
331. GTR XXL (Google)
332. SGPT 125M (Muennighoff)
333. SGPT 1.3B (Muennighoff)
334. SGPT 2.7B (Muennighoff)
335. SGPT 5.8B (Muennighoff)
336. INSTRUCTOR Base (HKU NLP)
337. INSTRUCTOR XL (HKU NLP)
338. SONAR Text Encoder (Meta AI)
If you need a default today, the download data points to all-MiniLM-L6-v2 or bge-small-en-v1.5 for English, bge-m3 or multilingual-e5 for multilingual, and Qwen3-Embedding for top quality if you have the GPU. Then test on your own data. The model is only half the stack; HackerNoon's guide to choosing a vector database for a production RAG chatbot covers the other half.
To compare all 3,009 text models, including rerankers, classifiers and the LLMs these embeddings feed, browse the TextModels directory.
2026-11-13 00:46:04
In a 2025 UC San Diego study, people picked GPT-4.5 as the human 73% of the time, more often than they picked the actual humans. ELIZA, a 1960s chatbot, scored 23%, slightly ahead of GPT-4o without a persona at 21%. Here are 20 tests from the Turing Test directory where you can check whether you still tell human from machine across chat, text, faces, art, voice and video.
The Turing test used to be a thought experiment. Now it's a party game, a research method and a product category. Cameron Jones and Benjamin Bergen's three-party Turing test had 284 participants chat with a human and an AI at the same time and then pick the human. GPT-4.5 with a persona prompt won 73% of the time, and LLaMa-3.1-405B won 56%.
The public versions tell the same story. AI21 Labs' "Human or Not?" game ran more than 10 million conversations, and players guessed right only 68% of the time. They were worse at spotting the bots (60%) than at spotting the humans (73%). And it isn't just chat: in a blind listening study covered on HackerNoon, listeners trying to pick out AI-composed piano music were "essentially guessing," at close to 50% accuracy.
So test yourself. A note on what's included: not everything here is a quiz. Some are games, some are detectors that try to make the call for you, and some are the generators that make the fakes. To understand the Turing test in 2026, you need all three.
1. Human or Not? by AI21 Labs. You get a two-minute chat with a stranger, then guess whether it was a person or a bot. It became the largest Turing test ever run, with more than 1.5 million participants. The research paper breaks down the tricks players used to unmask bots.
2. Loebner Prize. This was the original Turing test competition, held from 1991 according to its Wikipedia history. It's no longer running; its last winner was Mitsuku in 2019. It belongs on any list because it shows how long "fooling the judges" was the goal, and how easy it looks now.
3. Bot or Not (Botometer) by Indiana University's OSoMe. It scores whether a social media account is a bot. It's a Turing test turned into a classifier. The live version shut down after X ended free researcher access, and the Botometer X archive only covers accounts created before June 2023.
4. GLTR (Giant Language model Test Room) from the MIT-IBM Watson AI Lab and Harvard NLP. Paste text and it colors each word by how predictable it was to a language model. It was built in 2019 to spot AI-written text, and it's still the best way to see why AI text "feels" smooth.
5. GPTZero. This is the AI-writing detector that teachers made famous. Run your own writing through it to see how often humans get flagged. HackerNoon's guide on how to detect text generated by AI explains what these tools measure.
6. Poem or AI? You read a poem and decide who wrote it. The research on this is humbling: in Porter and Machery's Scientific Reports study, 1,634 readers couldn't reliably tell ChatGPT poems from famous poets', and they rated the AI poems higher.
7. NYT AI Article Quiz by The New York Times. Short passages, one question: human or AI?
8. WritersBrew AI Detector. A writing tool with a built-in check on whether a passage reads as machine-written.
9. Winograd Schema Challenge. This is the benchmark proposed as a better Turing test. Who does "it" refer to in "The trophy doesn't fit in the suitcase because it's too big"? It's easy for people. For years it was hard for machines.
10. Which Face Is Real? by Jevin West and Carl Bergstrom at the University of Washington. You see two faces and click the real one. It logged about 4 million plays in two weeks after its 2019 launch, and players were right about 70% of the time against StyleGAN fakes.
11. This Person Does Not Exist. This is the generator, not the quiz. Every refresh shows a face of someone who was never born. Look at the ears, teeth and backgrounds to learn the tells.
12. Sensity AI. A commercial deepfake detection platform for faces, video and identity fraud. It's what the professionals use when the stakes are higher than a game.
13. AI or Not. Upload an image and get a verdict on whether it's AI-generated. Try it on your own photos first.
14. Artbreeder. A collaborative image generator where you "breed" images by mixing them. Spend ten minutes making fakes and you'll get better at spotting them.
15. MIT GAN Dissect from MIT CSAIL. A research tool that shows which neurons inside a GAN draw trees, doors or clouds, and lets you switch them off. It doesn't test you. It shows you what's inside the machine you're testing.
16. Real or Fake Voice. Listen to clips and decide which are human speech and which are AI voice clones. This one matters most in practice, because voice cloning is the deepfake behind phone scams.
17. AIVA AI Music. An AI music composer. Play its tracks for friends without telling them and see who notices.
18. Deepfake Detection Challenge. The Kaggle competition, organized by Facebook with industry and academic partners, to build automatic deepfake detectors. Its dataset is still a standard for training them.
19. Detective (Deepware). Paste a video link and it scans for face manipulation.
20. FakeApp / Faceswap. The deepfake software that started it all. It's on this list because detectors are trained against it.
The pattern holds across formats. People do only somewhat better than a coin flip at spotting AI, and they get worse as models improve. Faces were about 70% in 2019, chat was 68% in 2023, and by 2025 people were choosing GPT-4.5 over real humans. The Turing test has stopped being a bar for machines to clear. It's turning into a skill humans have to practice.
Browse and filter every test by type (Audio, Classic, Game, Modern LLM, Social, Visual), difficulty and access in the Turing Test directory.
2026-11-13 00:37:38
SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at risk of unauthorized access.
The ANY.RUN team identified 618 sandbox analyses related to SkyW4lker between June and October 21, 2026, with 46% of submissions coming from the United States. Activity increased from 20 analyses in June to 200 in September, highlighting the growing exposure of organizations relying on Microsoft 365.
|
Threat Type |
Phishing Kit |
|---|---|
|
Objective |
Microsoft 365 / OAuth credentials |
|
Capabilities |
JavaScript obfuscation (obfuscator.io), Device-Code phishing, Geolocation detection, IP-address detection, CAPTCHA verification |
|
Delivery |
Email attachments (.pdf, .docx, .xls/xlsx and others), redirection links and lure pages (including Google Maps, Google Images, Miro, Zoom and others) |
|
Motivation |
Possible financial |
|
Operator / brand |
SkyW4lker (SkyW4lker x365 Sentinel) |
|
Known links |
URL patterns: /session_public.php?action= /endpoints/confirm_visit.php /js/url_helper.js /js/endpoint.js /js/client_geo.js |
|
Activity window |
2026-06 – now |
The United States accounts for 47% of SkyW4lker-related sandbox submissions, more than twice the share of any other country. With the campaign exploiting legitimate Microsoft authentication processes and routine business communications, these findings raise concerns for US enterprises about how effectively existing security controls can identify suspicious activity before it leads to account compromise.
SkyW4lker highlights several security risks that organizations need to account for when protecting business-critical systems and employee identities:
Stop account compromise before it disrupts your business.
Detect threats earlier and reduce response costs.
You can examine the full SkyW4lker attack chain in this ANY.RUN Sandbox analysis.
View analysis session and gather IOCs
The attack unfolds in three main stages:
The attacker sends the victim a phishing email with a password-protected attachment. Typical subjects involve commercial offers, contracts, invoices, or confidential documents. The attachment is a PDF, DOCX, or XLSX file, and the password is provided in the email body.
The document contains a link to a CAPTCHA page. Some variants include an additional lure page hosted on a legitimate service such as Miro, Google Sites, or Zoom, which redirects the victim to the next step.
Finally, the victim is directed to a phishing page that instructs them to enter a device code on Microsoft’s legitimate authentication page, potentially granting the attacker access to their Microsoft 365 account.
The phishing page relies on obfuscated JavaScript functions and separate script files. Using ANY.RUN’s In-Browser Data Inspection, analysts can examine the page’s DOM and HTTP activity to understand how these scripts operate.
The scripts keep the page in regular contact with the PHP backend and determine the location of the victim from their IP address. Within the page DOM, the main script loads additional modules, sets click handlers on buttons and builds GET requests to the PHP endpoint /session_public.php with the action parameter (start or poll).
With action=start, the script sends the geolocation and IP address of the victim and receives a session ID. After that, it sends a request with action=poll every few seconds to check whether the victim has authenticated.
The other modules of the phishing page are listed below:
|
Module |
Purpose |
|---|---|
|
client_geo.js |
Determines the location of the victim from the response of one of three services: ip-api[.]com, ipapi[.]co or ipwho[.]is. The location can also be obtained through the PHP endpoint php/endpoints/client_geo.php. |
|
url_helper.js |
Base script with helper wrappers for URL handling, such as building GET parameters and appending slashes. |
|
endpoint.js |
Tracks the state of the victim. It logs the e-mail address, password, browser, MFA status, country and other auxiliary fields used during authentication and sends them to the PHP backend at php/endpoints/accounts.php. |
A single phishing URL can be the starting point for uncovering an entire campaign. In the SkyW4lker investigation, identifying the malicious page was only the beginning. Analysts needed to trace related activity, identify additional infrastructure, and determine how far the campaign extended. Traditionally, connecting these findings requires repeated IOC lookups, manual correlation, and searching through previous investigations.
ANY.RUN’s major new upgrade, Related Threat Context, makes this process significantly faster and easier. By bringing connections to previous sandbox investigations and threat intelligence directly into the Interactive Sandbox, it helps analysts discover related threats, reuse existing findings, and expand investigations with fewer manual steps.
With more than 700,000 security professionals and 16,000 organizations worldwide using ANY.RUN, analysts can draw on a vast pool of real-world investigation data to uncover connections that might otherwise take considerably longer to find.
During our SkyW4lker investigation, the new Related analyses section surfaced previous sandbox sessions sharing the same URL patterns. This gave analysts an immediate starting point for tracing related activity instead of manually searching for connections across individual investigations.
Using the distinctive PHP endpoint /session_public.php, we moved into ANY.RUN Threat Intelligence Lookup in a single click, discovered additional phishing activity, and expanded the campaign cluster.
The investigation demonstrates the practical value of Related Threat Context: less time spent searching for connections, faster discovery of related infrastructure, and more evidence available to guide the next investigation step.
The same approach can be applied to other suspicious URLs and indicators, allowing SOC teams to build on previous investigations and uncover related threat infrastructure faster.
Tier 1 analysts spend less time on repetitive IOC research, gaining more evidence to support accurate triage and escalation decisions. Tier 2 analysts receive richer investigation context, helping them focus on cases that genuinely require deeper analysis.
By connecting individual alerts to existing threat intelligence, Related Threat Context helps SOC teams shorten investigation cycles, reduce unnecessary manual work, and make better-informed response decisions.
Give your SOC the context they need for faster triage.
Cut repetitive investigations. Increase Tier 1 productivity.
Each phishing page has its own backend, so the administration panel is likely to be hosted on the same domain. Further analysis of the Threat Intelligence Lookup results and data from other sources revealed an administration panel at /admin/index.php.
The CSS styles (command-center.css) suggest the following capabilities of the kit:
Further investigation revealed another important finding: SkyW4lker shares several technical components with Gabagool, a credential phishing kit.
A search in ANY.RUN Threat Intelligence for the unique module paths of SkyW4lker url:”/js/client_geo.js” or url:”/js/url_helper.js” or url:”/js/endpoint.js”) also returns sandbox sessions tagged gabagool. Gabagool was first observed on 23 April 2026, two months before SkyW4lker, and has used the endpoint.js and url_helper.js modules since late April and early May. The two kits share several other features:
|
Feature |
SkyW4lker |
Gabagool |
|---|---|---|
|
First seen |
23 June 2026 |
23 April 2026 |
|
Analyses in six months |
618 |
458 |
|
Shared JavaScript modules |
client_geo.js, url_helper.js, endpoint.js (since July 2026) |
client_geo.js, url_helper.js, endpoint.js (since late April 2026) |
|
Visit endpoint |
/assets/php/endpoints/confirm_visit.php |
/assets/php/endpoints/confirm_visit.php |
|
Self-hosted CAPTCHA |
/assets/private_captcha/public/widget.js?v=4 |
/assets/private_captcha/public/widget.js?v=4 |
|
Landing token |
zt[A-Za-z0-9]{32}op; it[A-Za-z0-9]{32}us from 10 August |
zt[A-Za-z0-9]{32}op; it[A-Za-z0-9]{32}us from 5 August |
|
Same directory on shared hosts |
5200m[.]com/kvme2/ (16 Oct), torvion[.]life/ofulium/ (5 Oct), ghethim[.]com/hyllen/ (28 Sep – 2 Oct) |
5200m[.]com/kvme2/ (15 Oct), torvion[.]life/ofulium/ (6 Oct), ghethim[.]com/hyllen/ (8 Oct) |
|
Hosting |
mostly DigitalOcean |
mostly DigitalOcean; shared IP 172.86.85[.]51 (priorispace[.]biz) |
|
Main endpoint |
session_public.php (device-code phishing) |
accounts.php (login and password harvesting) |
Moreover, some sandbox sessions tagged gabagool load the kit from directories named skywalker:
goldcreekconcrete[.]com/example/skywalker/ (sandbox session) and goldcreekconcrete[.]com/skywalker/example/ (sandbox session). On goldcreekconcrete[.]org, which also hosted Gabagool (sandbox session), the directory /skyw4lker/skydirectory/ with the same modules appeared on 29 September (sandbox session).
We therefore assess with high confidence that Gabagool and SkyW4lker are built by the same developer. Gabagool harvests logins and passwords through accounts.php, whereas SkyW4lker abuses the device-code flow through session_public.php, so we regard them as two attack modes of one platform. The identical directories on shared hosts may also point to a common operator; however, the available data does not allow us to distinguish one operator from several customers of the same platform.
The SkyW4lker investigation reveals several technical indicators and attack patterns that security teams can use to identify related phishing activity. For organizations, these findings also highlight opportunities to strengthen identity security and reduce the impact of potential account compromise.
Hunt for SkyW4lker’s technical fingerprints. Look for requests to /session_public.php?action=start and repeated /session_public.php?action=poll calls. Check the JavaScript modules and URL patterns identified in this research to uncover related infrastructure.
Connect phishing activity with suspicious sign-ins. Monitor Microsoft Entra ID logs for unexpected device-code authentication, particularly following suspicious emails or document-sharing requests. Correlating authentication events with phishing indicators can help identify potential account compromise.
Expand investigations beyond individual IOCs. ANY.RUN’s newly introduced Related Threat Context puts connected sandbox analyses at analysts’ fingertips, with a one-click pivot to threat intelligence context for deeper threat hunting. In the SkyW4lker investigation, this helped expand the campaign cluster, while further analysis revealed shared infrastructure and code similarities with Gabagool.
Investigate potential follow-on activity. When account compromise is suspected, review subsequent Microsoft 365 activity to identify affected resources, unauthorized access, and possible attempts to target other users.
Give Tier 1 the evidence to make faster decisions.
Keep more cases at Tier 1 with 30% fewer escalations.
SkyW4lker demonstrates why organizations need to look beyond traditional phishing prevention and MFA when evaluating identity security. Three priorities deserve attention:
Close authentication policy gaps. Review where device-code authentication is genuinely required. Restrict or block unnecessary use through Microsoft Entra Conditional Access to reduce opportunities for attackers to abuse legitimate authentication flows.
Strengthen detection across email and identity systems. Ensure the SOC can connect suspicious attachments, phishing infrastructure, and unusual authentication events. Better visibility across these stages helps teams identify potential compromises before attackers expand their access.
Reduce investigation time and escalation costs. Equip Tier 1 analysts with historical threat context and clear escalation criteria. Establish procedures for containing compromised accounts and reviewing unauthorized activity, helping Tier 2 teams focus on incidents requiring deeper investigation.
SkyW4lker continues to evolve, with new endpoints, changing URL patterns, and growing activity across sandbox analyses. Its connection to Gabagool suggests that the same developer is supporting both device-code and credential phishing, giving attackers different ways to compromise business accounts through shared infrastructure.
For organizations, the findings highlight a broader security challenge: attackers are increasingly exploiting legitimate authentication processes and trusted business services, making malicious activity harder to distinguish from normal operations.
As phishing kits evolve, security teams need more than traditional email filtering and MFA. Stronger identity controls, visibility into suspicious authentication activity, and access to connected threat context can help SOCs identify attacks earlier, investigate them faster, and reduce the potential impact on business operations.
ANY.RUN provides cybersecurity solutions that help SOC and MSSP teams detect and investigate threats, make faster decisions, and reduce the time and resources spent on incident response.
The company’s solutions include Interactive Sandbox for analyzing suspicious files, URLs, and phishing attack chains, and ANY.RUN Threat Intelligence with Threat Intelligence Lookup, Threat Intelligence Feeds, and Threat Intelligence Reports. Together, these solutions help security teams uncover related threat activity, track evolving attack infrastructure, and strengthen detection with intelligence from real-world investigations.
Today, ANY.RUN is trusted by more than 16,000 organizations and 700,000 security professionals worldwide. The company is SOC 2 Type II certified, with security controls designed to protect customer data.
|
Tactic |
Technique |
Procedure |
|---|---|---|
|
Reconnaissance |
T1589.002 Gather Victim Identity Information: Email Addresses |
The SkyW4lker operator collected recipient e-mail addresses to personalise phishing links using the landing-URL suffix ? or ?? after /it[A-Za-z0-9]{32}us. |
|
Reconnaissance |
T1590.005 Gather Victim Network Information: IP Addresses |
The SkyW4lker phishing kit recorded the visitor's IP address, ISP, organisation and location to profile victims using client_geo.js and the request /assets/php/endpoints/session_public.php?action=start&ip=…&isp=…&org=…&org_type=. |
|
Resource Development |
T1583.001 Acquire Infrastructure: Domains |
The SkyW4lker operator registered look-alike domains of real companies to host phishing pages using typo-squatted names under Microsoft-themed subdomain chains, e.g. sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com and pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com. |
|
Resource Development |
T1583.001 Acquire Infrastructure: Domains |
The SkyW4lker operator obtained free dynamic-DNS subdomains to host phishing pages using flow505.mooo[.]com, bigbrain.chickenkiller[.]com and off365acess.jumpingcrab[.]com. |
|
Resource Development |
T1583.003 Acquire Infrastructure: Virtual Private Server |
The SkyW4lker operator rented virtual private servers to run the PHP backend using DigitalOcean hosting (50 of 92 backend IP addresses), e.g. 162.243.64[.]121 and 67.205.154[.]32. |
|
Resource Development |
T1608.005 Stage Capabilities: Link Target |
The SkyW4lker operator staged intermediate pages to forward victims to the kit using public cloud buckets and site builders, e.g. pub-177b3aa5a54d4f9087a649de5ec766d5.r2[.]dev/docsonedrive2026.html, carcabaoperadologistca.fr-par-1.linodeobjects[.]com/document_excel.html and bethom-contracting-llc.mintlify[.]site. |
|
Initial Access |
T1566.001 Phishing: Spearphishing Attachment |
The SkyW4lker operator sent password-protected attachments to deliver the phishing link using PDF, XLS, DOCX and EML lures named -protected.pdf or DOC <10 random characters>.pdf, e.g. SHA256 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268. |
|
Initial Access |
T1566.002 Phishing: Spearphishing Link |
The SkyW4lker operator sent links hosted on legitimate services to pass e-mail reputation checks using Google Sites, Axure Cloud and Smartsheet pages and the maps.google[.]ie/url?q= redirect, e.g. sites.google[.]com/heatherrasekhomes.com/talbert-manufacturing-inc-0049/home. |
|
Execution |
T1204.001 User Execution: Malicious Link |
The SkyW4lker phishing kit relied on the victim opening the landing link to start a phishing session using the path //it[A-Za-z0-9]{32}us. |
|
Defense Evasion |
T1656 Impersonation |
The SkyW4lker operator imitated routine business correspondence to make the lures credible using subjects such as New Submission From , Approved Statement and Fedwire Funds Service Processed-()-. |
|
Defense Evasion |
T1497 Virtualization/Sandbox Evasion |
The SkyW4lker phishing kit placed a CAPTCHA in front of the phishing page to hide it from automated scanners using Cloudflare Turnstile and the self-hosted /assets/private_captcha/public/widget.js?v=4 with /assets/php/endpoints/private_captcha_challenge.php. |
|
Defense Evasion |
T1027 Obfuscated Files or Information |
The SkyW4lker phishing kit obfuscated its JavaScript to hinder analysis using obfuscator.io-style code (520 of 618 analyses carry the obfuscated-js tag). |
|
Credential Access |
T1528 Steal Application Access Token |
The SkyW4lker phishing kit abused the Microsoft OAuth 2.0 device-code flow to obtain the victim's access tokens using login.microsoft[.]com/device and login.microsoftonline[.]com/common/oauth2/deviceauth while polling /assets/php/endpoints/session_public.php?action=poll&session_id=. |
|
Collection |
T1056.003 Input Capture: Web Portal Capture |
The SkyW4lker phishing kit logged the victim's e-mail, password, browser, MFA status and country to collect credentials using endpoint.js and the backend php/endpoints/accounts.php. |
All indicators were observed in ANY.RUN analyses between 23 June and 21 October 2026.
URL patterns:
|
Pattern |
Purpose |
Seen |
|---|---|---|
|
//it[A-Za-z0-9]{32}us |
Landing page token; may end with ? or ?? |
2026-08-10 – 2026-10-19 |
|
//zt[A-Za-z0-9]{32}op |
Earlier landing page token |
2026-06-25 – 2026-09-28 |
|
/assets/php/endpoints/session_public.php?action=start&ip=&ip_address=&country=&country_code=&IP[ip]=&IP[country]=&city=…®ion=…&timezone=…&isp=…&org=…[&org_type=IPv4] |
Session registration with visitor geolocation |
2026-06-23 – 2026-10-21 |
|
/assets/php/endpoints/session_public.php?action=poll&session_id= |
Polling of device-code authentication status |
2026-06-23 – 2026-10-21 |
|
/assets/js/client_geo.js |
Visitor geolocation module |
2026-07-07 – 2026-10-19 |
|
/assets/js/endpoint.js |
Session state and credential logging module |
2026-07-22 – 2026-10-20 |
|
/assets/js/url_helper.js |
URL helper module |
2026-07 – 2026-10 |
|
/assets/php/endpoints/confirm_visit.php |
Visit confirmation endpoint |
2026-08-31 – 2026-10-15 |
|
/assets/private_captcha/public/widget.js?v=4, /assets/private_captcha/public/widget.css, /assets/php/endpoints/private_captcha_challenge.php |
Self-hosted CAPTCHA gate |
2026-07-07 – 2026-09-28 |
|
/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}.js |
Brand-specific document script |
2026-07-20 – 2026-10-20 |
|
(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth).*(outlook|onedrive|copilot|office365).*. |
Microsoft-themed hostname chain on look-alike domains |
2026-06 – 2026-10 |
Domains hosting the phishing kit (173):
0350pvas.acs-wcst[.]com
0ff365access.mooo[.]com
0utlook0ffice365admin.twilightparadox[.]com
1355bcra.ck29material[.]com
1717emxr.acs-wcst[.]com
5200m[.]com
5375jngu.prefform[.]us
6662nyde.acs-wcst[.]com
6695lkmo.prefform[.]us
7301eqny.acs-wcst[.]com
7criccasinobonus[.]cc
aachem-za[.]co
accordhealth[.]cc
acrobat-adobe-com-4464uswc.egllo[.]com
advancedsteelbuilding[.]com
alasilla[.]com
albertamo[.]com
alfabricationinc[.]com
apexpartsdepot[.]com
apinows[.]com
atlantictriad.ignorelist[.]com
atlassgroupinc[.]com
auth-loadingdocuments[.]online
auth.login.office365.cloud.onedrive.outlook.atlarchitacts[.]com
authorize.copilot.outlook.common.microsoft0365.atlarchitacts[.]com
awemode.outlookoffice365.microsoftcopilots.docshare.linnwest[.]us
azgymfloor[.]com
bandg-electrics[.]com
bennett002.mooo[.]com
bezpartien[.]online
bigbrain.chickenkiller[.]com
bloomfleldcapital[.]com
bramum[.]online
buckslu[.]org
bxcelcounselling[.]org
caine-wenier[.]com
calebchemicals[.]com
calmechc[.]net
canacedesotogroup[.]com
celestialtremor[.]org
celliottelliott-wellman[.]org
celvarioncorn[.]org
centipedtourspa[.]com
claronevents[.]com
cleggs.my03[.]com
clingard[.]pro
clubdenut[.]club
copilot.login.office365outlook.cloud.onedrive.atlarchitacts[.]com
copilots.outlook.cloud.microsoft.andersonelevators[.]com
copilots.outlook.cloud.microsoft.syrosconstructlon[.]com
coreansdmain[.]com
csr-rooflng[.]com
ctr-wooding[.]com
darap-it[.]co
detroitgardenswork[.]com
devtachsales[.]com
dguidrycardinazprofessional[.]com
docshare.auth.copilot.outlook.onedrive.common.earthlink-net[.]com
docshare.auth.copilot.outlook.onedrive.common.evergreenerg[.]com
docshare.auth.copilot.outlook.onedrive.common.northemheating[.]com
docshare.auth.copilot.outlook.onedrive.common0.evergreenerg[.]com
docshare.auth.copilot.outlookonedrive.common.northemheating[.]com
docshare.auth2026.onedrive.outlooksdocument.csr-rooflng[.]com
docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng[.]com
document.akiflx[.]com
dpincoli[.]com
dutchfarrms[.]com
eccentric-authentication[.]com
ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc[.]com
efaxdoc.auth.login.outlook.office365.tescoccontrols[.]com
efaxdoc.auth.outlook2026common.copilos26.bettylnc[.]com
efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr[.]com
efaxdoc.auth.outlook2026common.copilos26.kone-inc[.]com
efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc[.]com
efaxdoc.documents2026.docs.shared.lakeviewscustom[.]com
eurosforgroup[.]com
flow505.mooo[.]com
flow55.chickenkiller[.]com
fosterswifts[.]com
frontdesk[.]click
gcotoncovingtoncontracting[.]com
ghethim[.]com
glafondbottamconstruction[.]com
globlasumi[.]com
gregor.justdied[.]com
grincool[.]xyz
haevy-llc[.]com
hcnyecom[.]com
hivezoom[.]com
ideahom[.]world
incommecialre[.]com
innvisoin[.]net
insigthinvestments[.]com
investomind[.]biz
jacobpwpinc[.]org
jjnysnobiogtx[.]org
kilishy.qhigh[.]com
kuer[.]online
lampadasdeslgn[.]com
lawyer.cuztools[.]com
lifetimeroofsystem[.]net
linking.mefound[.]com
linogomes-pt[.]cc
lionheartsecurityservice[.]com
liyuda[.]com
login.microsoft365.outlook.copilotsoffice365.lntactpr[.]com
login.office365outlooks.microsoft.cloud-outlook.naregruop[.]com
m365cloud.login.outlook.office365.azgymfloor[.]com
maqaigiapelhani[.]cam
metlarnelaw[.]com
metrorocl.co[.]uk
mgproparties[.]com
minda-mo[.]com
mouphyweb[.]com
naregruop[.]com
nicewayrealestate[.]cc
noxband[.]com
off365acess.jumpingcrab[.]com
off365mail[.]club
office0365login.2waky[.]com
outlookdrive.microsoftonline.common.oauth2.client.buycerm[.]com
outlookoffice365.microsoftcopilots.vigilantlnc[.]com
paulecosconnect[.]com
payapp.auth.outlook2026common.copilos26.bettylnc[.]com
pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr[.]com
pdlhaelth[.]com
pdocshared.documents2026.docs.shared.ecmholdlnggroup[.]com
pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com
photosofus[.]com
plusoptlx[.]com
priorispace[.]biz
psionicsandhorses[.]net
rapid-scale[.]net
reauth.copilot.auth.outlook.mcloud365.buycerm[.]com
reauth.copilot.auth.outlook.mcloud365.myhalnc[.]com
reauth.copilot.common.outlook.mcloud365.atlarchitacts[.]com
reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras[.]com
rektham[.]online
rubinsrudman[.]com
rustlnsurance[.]com
sdocshares.auth.outlook.copilos26.general.csr-rooflng[.]com
sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com
sdocshares.authoutlooks.common.copilots2026.hathormson[.]com
seatacsmarine[.]com
sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer[.]com
shared.paymentsclouds.statementsapproved.jetbusinesscapltal[.]com
slybee[.]com
snk-s[.]org
solutions00fileptroduct[.]com
sorensenmaysflower[.]blog
statement.docdriveoauth.authorized.copilot.syrosconstructlon[.]com
statement.outlookoffice365.microsoftcopilots.calmechc[.]net
statements.outlook.office365microsoft.payment.run.stoneclty[.]com
stellarntis-fs[.]com
studeseliamechan[.]link
sunraycontractlng[.]com
sunstateaquips[.]com
swiftii.chickenkiller[.]com
tentkit[.]com
thepaybank[.]com
thewiginton[.]com
topcoatmetalsfinishing[.]com
toplinebuy[.]com
torvion[.]life
unitadrentals[.]com
unitedwirescompany[.]com
us-agricultures[.]com
vasquezmyth[.]com
westlakeproduces[.]com
whitfillsnursery[.]com
wsochares.authpayments.common.paid2026.bullochdirtwroks[.]com
wwriwashingtonenergy[.]com
zrs-wooding[.]com
