Spam404

@Namecheap Any update for this one? Domain remains actively used to target @TheSandboxGame users with malware.

@Spam404 Hello! We are going to check it asap. Thanks!

Fake beta webpage impersonating @TheSandboxGame, dropping malware via @Dropbox Domain: sandboxbeta[.]cloud Registrar: @Namecheap Host: @eserver_eu (2.56.91.19) Spammed via email, likely sourced from recently disclosed @OpenSea data breach. @urlscanio: urlscan.io/result/c0ce8b4…

Fake NFT webpage impersonating @BoredApeYC, dropping malware via @Dropbox. Domain: apesnoop[.]com Registrar: @Namecheap Hosting: @DDoSGUARD (217.114.42.175) Spamvertised via ETH ERC-20 token airdrops: etherscan.io/token/0x695d4e… @urlscanio: urlscan.io/result/2078de4…

Fake NFT mint webpage impersonating @OthersideMeta/@BoredApeYC in attempt to steal cryptocurrency. Domain: bayc-otherside[.]art Registrar: @Namecheap Hosting: @Namecheap (198.54.116.96) @urlscanio: urlscan.io/result/24b79d4… First seen: Jun 28th, 2022

Fake NFT mint webpage impersonating @rollbitcom in attempt to steal cryptocurrency. Domain: rollbit[.]mintnow[.]net Registrar: @Namecheap Hosting: @Cloudflare (104.21.85.9) @urlscanio: urlscan.io/result/bfd212f… CC: @CryptoPhishing @CryptoScamDB

Fake NFT mint webpage impersonating @metacard in attempt to steal cryptocurrency. Domain: minting-metacard[.]io Registrar: @Namecheap Hosting: @Namecheap (162.213.255.42) @urlscanio: urlscan.io/result/5e608e2… First seen: Feb 12th, 2022 CC: @CryptoPhishing @CryptoScamDB

@Namecheap @opensea @urlscanio @discord Here's a new one: mint-sea[.]digital @urlscanio: urlscan.io/result/922fa0b…

@Spam404 @opensea @urlscanio @discord Hello! We are going to check it asap. Thanks!

Fake NFT minting webpages impersonating @opensea in attempt to steal cryptocurrency. Domain 1: mint-sea[.]art Domain 2: opensa[.]casa Registrar & Host: @Namecheap @urlscanio scans: urlscan.io/result/d548952… urlscan.io/result/495cb35… Spread via @Discord. Kit first seen 12 days ago.

@Namecheap @HAPEBEASTGANG @ContaboCom @urlscanio @CryptoPhishing @CryptoScamDB Very fast, thank you!

@Spam404 @HAPEBEASTGANG @ContaboCom @urlscanio @CryptoPhishing @CryptoScamDB We have suspended the abusive service, thank you!

Fake NFT minting webpage impersonating @HAPEBEASTGANG in attempt to steal cryptocurrency. Domain: hapebeast[.]io Registrar: @Namecheap Hosting: @ContaboCom (167.86.72.233) @urlscanio: urlscan.io/result/28290f4… First seen 29 days ago. CC: @CryptoPhishing @CryptoScamDB

@malwrhunterteam Got this one, thanks!

"youtubepremium.apk": 7204038839b0b2b8b1f54cd9044a389492af2b1e079433316b61ad24601188e9 From: http://stealer[.]ga/youtubepremium.apk @Spam404

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT Offline shortly, thanks for the tag!

www.dragonisthebest[.]tk @Spam404 cc @VK_Intel @bryceabdo @JAMESWT_MHT

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT Nuked it, thanks!

service.microsoft-us[.]ml @Spam404 cc @VK_Intel @bryceabdo @JAMESWT_MHT

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT Thanks for the tag! This domain should stop resolving very shortly.

b48195755156cdc60048fb90662895b6bd66f17f6d38fe3500f31c065ab83662 www.ichunqiuqax[.]tk @Spam404 cc @VK_Intel @bryceabdo @JAMESWT_MHT

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT Nuked this one, thanks for the tag!

45bdccfb6524b3377cc30a2e6f035f17e6dcfb9b3b38dff3c49d1f1d03edec1e bad.yoxxx[.]tk @Spam404 cc @VK_Intel @bryceabdo @JAMESWT_MHT

@STT60861270 @whitehoodie4 @SocEngineerHu @malwrhunterteam @Namecheap @PhishKitTracker Both nuked, thanks for the tag!

K&H Bank #phishing URL: https:]//teorcm.]ga/mangerhu/kh/login/index(1).html Redirect: https:]//fasicat.]ml/sms-kad/kh/login/hu/index.html @whitehoodie4 @SocEngineerHu @malwrhunterteam @Spam404 @Namecheap @PhishKitTracker

@unmaskparasites @RealClever Nice find! Sent the S3 bucket to AWS, who are usually very responsive to abuse. The .ga domain should stop resolving very shortly.

[12/12] If you use RealClever .com/Clever Girls Collective Badge/Pixel V2 code on your site, make sure it doesn’t include s3.amazonaws[.]com/cgc-badge-v2/ scripts - or remove the code altogether until the issue is resolved by @RealClever

[1/12] Thread: Using @UrlScanio and @publicww to investigate @RealClever Badge/Pixel redirect hack affecting hundreds of websites. Thanks @liamsmith86 for the lead.

@illegalFawn @freenomofficial @mauriez @malwrhunterteam @JAMESWT_MHT Nuked it, thanks for the tag!

@freenomofficial, #phishing targeting K&H bank needs to be revoked, thanks /dechfu.gq @mauriez @Spam404 @malwrhunterteam @JAMESWT_MHT

@InfoSec_Paul_M @illegalFawn @sysgoblin @n0p1shing @JCyberSec_ @nullcookies Thanks Paul! Looks like a FP with paypal./com

Thats 140 #phishing URL's detected in last 24 hours being delivered via SMS targeting UK infosecpaulm.com/uk-latest-phis… #infosec @illegalFawn @Spam404 @sysgoblin @n0p1shing @JCyberSec_ @nullcookies

@InfoSec_Paul_M @illegalFawn @sysgoblin @n0p1shing @JCyberSec_ @nullcookies Nice list as always! Noticed a false positive: service./gov./uk

Thats 162 #phishing URL's detected in last 24 hours being delivered via SMS targeting UK infosecpaulm.com/uk-latest-phis… #infosec @illegalFawn @Spam404 @sysgoblin @n0p1shing @JCyberSec_ @nullcookies