internet researcher
Joined June 2021
- Tweets1.4K
- Following152
- Followers1.5K
- Likes5K
Fake @CBP website
dropping apk 🤖
/cbp-i94.com/apply
tria.ge/250129-gf845avqhq
virustotal.com/gui/file/67d1…
Malware on facebook 🤖
@MarvelStudios + adult lures
/hanapmo.com
files here 👇
/tb2.trustebook.com/upload/static/Emi_Harada_Videos.zip
both @Namecheap 👋
tria.ge/250124-x1ghlsvqcn
happy new years everyone 👋
@coinbase phishing panels 🎣
/66.78.40.145
/185.196.9.120
/94.103.125.100
/154.216.19.179
/45.61.159.101
/185.193.125.226:3000
/154.216.19.179:3000
/144.126.237.89
/185.193.125.220:3000
/185.193.125.121:3000
/a.activitycnl.com
cc @CoinbaseSupport
phishing @coinbase users 🎣
cc @CoinbaseSupport
scam number 1-833-277-9875
/coinbasse-support.info
@GoDaddy cc @GoDaddyHelp 👀
+ @Vultr
Phising hurricane victims with fake @DHSgov assistance website 👎
Phishing PII after create account + apply.
👇fuck these people
/disasterassistances.org
@Namecheap 👋
Seemingly fake @StateDept website 🤔
Not sure of use case. Clone of US State Department website.
/usdss.org
reg @Namecheap
host @qloudhosts
Malware powershell modal 🤖
Hurricane Milton assistance lure 👎
/dailysphere.org
@Namecheap 👋
/74.81.37.234/kb2.txt
tria.ge/241107-rhtsbswmbk
drops
/74.81.37.234/kbsn1.zip
Malware @CharlesSchwab modal with powershell copypasta method 🍝
/schwabla.com
/172.86.75.215/1.e
tria.ge/241107-agbfxs1dmg
c2 /todaytinhyt.shop
malware modals 🤖
/chipwriters.com/chrome.html
tria.ge/241106-3ms75s1cpr
/albabeauty.life/invite.html
tria.ge/241106-3mdgpaspdn
drops 👇
/cloudme.com/v1/ws2/:slight-stood/:web/web.txt
tria.ge/241106-3sr72a1dpk
virustotal.com/gui/file/eb2d…
files @ /185.245.107.207
fake captchas + powershell 🤖
/dropbeastbot.xyz/dashboard
tria.ge/241106-t6qfxswmcm
/hawai5stars.com/Additional-check.html
tria.ge/241106-t86kxswmfl
/sos-de-muc-1.exo.io/everything-here/cloudflare-v1-getup-11-1.html
tria.ge/241106-tyslbatgnq
branded lure as well
https ://xtranetaccess.com/
http ://185.147.124.40/Capcha.html
@malwrhunterteam @JAMESWT_MHT @dubstard @YourAnonRiots @andsyn1 @UK_Daniel_Card @BeeHiveCyberSec @Malcoreio @douglasmun #malware
Phishing discord tokens with fake @Calendly 🎣
/meet-calendly.com
^Tucows
/join-calendly.com
^@Namecheap 👋
active tech support @ConnectWise RAT site
code 75916
/qscare.online @namesilo
iframed
/prex08.8996.is
virustotal.com/gui/file/0477…
phishing @RBC users 🎣
/secure-rbcroyal.com
/rbccanada-security-onlineaccess.com
/rbc-canada-onlinealert-verify.com
/rbcverifypolicy-cad.com
/rbc-canada-verify-secure-online.com
/canada-rbconline-alert-secure.com
/rbc-secure-department.com
