Skip to content

Unknown Phishing Kit Cluster

Jump to bottom
Scott Petty edited this page Jan 5, 2025 · 8 revisions

The Lure - August 7, 2023

Screenshot 2024-12-27 231038 image

This was the second lure I received to my student email address using the same target URI in two days.

Recording

https://urlscan.io/result/9b92f3f8-4e17-45ae-9de2-447a7a767c7b/#transactions Screenshot 2024-12-27 233859

I decided to pivot on the image host. https://urlscan.io/search/#imagizer.imageshack.com (look for base64 URIs).

Earliest indicator related to activity group

jinaka[.]com January 25, 2021 https://urlscan.io/result/9513f840-5b4b-47db-9db6-31de3db12f85/

godsrods[.]com         May 7, 2021              https://urlscan.io/result/128a044b-fb24-42be-b830-f9f56d2b37d3/
logostickerei[.]ch
imk9[.]com
foxcrete[.]com
ipfwstudenthousing[.]com
rivervalleyrvatlakeconroe[.]com
rprconventioncentre[.]com
yashinstagrocers[.]ca
worldsafaritravel[.]com
skylinecrete[.]com
amoonstonejewel[.]com
thecondomproject[.]org
fashiongearhk[.]com
budsbud[.]com
radiocakrabandung[.]com
uitcase[.]com
karencheng[.]com[.]au
maximrecovery[.]co[.]uk
microcorporate[.]com
vintagecafeandbar[.]com
clikali[.]re
zemcon[.]com[.]pk
intranet[.]semae[.]rs[.]gov[.]br
divinemoving[.]site
wrightcomputing[.]com
www[.]beautyart[.]tn
isgrioja[.]com
iteeseyehospital[.]com
le194[.]fr
jilbab[.]ir
fanikishadvertising[.]com
gas[.]inf[.]br
onlytarikul[.]info
intellactgn[.]com
premierforestry[.]net
unistartg[.]com
ufabetsc[.]com
www[.]fin45[.]net
kissmyball[.]com
hcnconnect[.]in
kreondsc[.]com
kek-technik[.]com
ndm-gmbh[.]ch
cefnogi[.]com
cryptocurrencyhq[.]org
bestbusinessvideos[.]net
antlertrader[.]com
divinesupportedliving[.]co[.]uk
dsjuliette[.]com
stihec[.]si
decouvrir-lemonde[.]com
casibel[.]fr
elclubdelamama[.]com
optimii[.]be
epistemeinstituto[.]com
ilqaa[.]com
redgeraniumrestaurant[.]com
rapaire[.]org
rubberflooringindonesia[.]com
cabinet-via[.]com
jomosoftware[.]tech
lemunuzzaman[.]com
alex-wohl[.]fr

started using Nuxt.js for phishing kit front-end

fodyem[.]com
equilibre-asso[.]org
blacknativebeauty[.]com
lavieillechouette[.]fr
greenmarine[.]fr
menuiserieanile[.]fr
gtgamestudios[.]com
jgms[.]fr
benjaminbocquet[.]fr
romain-rissoan[.]fr
gi-web[.]fr
novapro[.]com[.]tr
nipunhospital[.]com
demuseasia[.]com
concretelove[.]se

domain used for school email phishing attempt

danielcacereslopez[.]com June 2, 2023

domains used since

minibagslovers[.]com   September 21, 2023
sulbran[.]com
mediacs[.]biz
guantesroboticos[.]com
repaircenterja[.]com
bymasa[.]shop
sushi32[.]ru
festivalfomaric-dla[.]com
atlasimi[.]mx
alformation54[.]fr
zoriivo[.]com
vosspsychology[.]com[.]au
tiendamerik[.]net
sheffergallery[.]com
firrifm[.]com
sattayb[.]com
mklogistics[.]com[.]pk
flighttouch[.]com
mymetathesis[.]org
tempoorestaurant[.]com
vehicleutilityladder[.]com
cedarwoodhomes[.]com[.]au
onedailydealnow[.]com

Phishing-Database commits

lovemachina[.]com https://github.com/Phishing-Database/phishing/pull/343 March 15, 2024
ajstelecom[.]com[.]mx https://github.com/Phishing-Database/phishing/pull/353 https://github.com/Phishing-Database/phishing/pull/362 March 19, 2024
nico[.]sa https://github.com/Phishing-Database/phishing/pull/366
theaerie[.]ca https://github.com/Phishing-Database/phishing/pull/367
applesforfred[.]com https://github.com/Phishing-Database/phishing/pull/369
iwan2travel[.]com https://github.com/Phishing-Database/phishing/pull/370
littleswanaircon[.]com[.]sg https://github.com/Phishing-Database/phishing/pull/372
westernautomobileassembly[.]com https://github.com/Phishing-Database/phishing/pull/376
azezieldraconous[.]com https://github.com/Phishing-Database/phishing/pull/381
foreverfarley[.]com https://github.com/Phishing-Database/phishing/pull/387
safecartusa[.]com https://github.com/Phishing-Database/phishing/pull/391
jestertunes[.]com https://github.com/Phishing-Database/phishing/pull/393
technowide[.]com[.]tr https://github.com/Phishing-Database/phishing/pull/396
carnesboinobre[.]com[.]br https://github.com/Phishing-Database/phishing/pull/398
englishplusmore[.]com https://github.com/Phishing-Database/phishing/pull/404
bkengineersindia[.]com https://github.com/Phishing-Database/phishing/pull/405
pescacancun[.]com https://github.com/Phishing-Database/phishing/pull/406
wisbechguide[.]uk https://github.com/Phishing-Database/phishing/pull/408
cantabriaeventos.com https://github.com/Phishing-Database/phishing/pull/410
brunotasso[.]com[.]br https://github.com/Phishing-Database/phishing/pull/413
bersowir[.]org https://github.com/Phishing-Database/phishing/pull/413
cbcaps[.]shop https://github.com/Phishing-Database/phishing/pull/417
race2zerogolf.za.com https://github.com/Phishing-Database/phishing/pull/418
ijconnects[.]com https://github.com/Phishing-Database/phishing/pull/421
ergoterapiacaribu[.]ch https://github.com/Phishing-Database/phishing/pull/426
abcmueblesbogota[.]com https://github.com/Phishing-Database/phishing/pull/432
reluzformaturas[.]com[.]br https://github.com/Phishing-Database/phishing/pull/435
intrinsicisle[.]za[.]com https://github.com/Phishing-Database/phishing/pull/452
havenhills[.]za[.]com https://github.com/Phishing-Database/phishing/pull/459
lebomashilo[.]co[.]za https://github.com/Phishing-Database/phishing/pull/462
benyex[.]cl https://github.com/Phishing-Database/phishing/pull/468
albapietra[.]com[.]br https://github.com/Phishing-Database/phishing/pull/479
craigbrimm.com https://github.com/Phishing-Database/phishing/pull/480
draschool[.]org https://github.com/Phishing-Database/phishing/pull/488
blueevolution[.]it https://github.com/Phishing-Database/phishing/pull/489
diezestrellas[.]com https://github.com/Phishing-Database/phishing/pull/490
kidsacademyprayagraj[.]com https://github.com/Phishing-Database/phishing/pull/491

de-prioritized actively following group - October 2024

astraladvertising[.]com https://urlscan.io/search/#page.domain%3Aastraladvertising.com
peepaltreeadvertising[.]com https://urlscan.io/search/#page.domain%3Apeepaltreeadvertising.com
dhananjayshinde[.]com https://urlscan.io/search/#page.domain%3Adhananjayshinde.com
moyindia[.]com https://urlscan.io/result/d52bbc4e-ed74-4a2a-b2d7-9b086d3b83f2/
pvcelnuestroguatemala.com https://urlscan.io/search/#page.domain%3Apvcelnuestroguatemala.com
bulletballgames.com https://urlscan.io/result/089e8261-4095-496d-a6f7-e9d0cc2fd528/
vnsupvc[.]com https://urlscan.io/search/#page.domain:%22vnsupvc.com%22
zowvo[.]com https://urlscan.io/search/#page.domain%3Azowvo.com
kpd34[.]ru https://urlscan.io/search/#page.domain%3Akpd34.ru
mahakaltools[.]in https://urlscan.io/search/#page.domain%3Amahakaltools.in
camping[.]pantanal[.]ch https://urlscan.io/result/b9554f3e-cc3e-47fb-a0ea-4dc6470b0651/
alcollegeofeducation[.]org https://urlscan.io/search/#page.domain%3Aalcollegeofeducation.org

demo[.]musangking[.]com[.]my https://github.com/Phishing-Database/phishing/pull/549 December 16, 2024
bohlepropiedades[.]com https://github.com/Phishing-Database/phishing/pull/631 January 5, 2025

Virus Total collection

Links to individual images hosted at imagizer.imageshack.com 

https://imagizer.imageshack.com/img922/1126/OmihEE.jpg
https://imagizer.imageshack.com/img922/1354/iwJDVH.png
https://imagizer.imageshack.com/img922/1745/cjSNB5.png
https://imagizer.imageshack.com/img922/2287/MbtVMR.jpg
https://imagizer.imageshack.com/img922/2799/B4w23i.jpg
https://imagizer.imageshack.com/img922/283/m34Ubm.jpg
https://imagizer.imageshack.com/img922/3056/ec4OBo.jpg
https://imagizer.imageshack.com/img922/3104/JiFPwB.png
https://imagizer.imageshack.com/img922/3252/dAVd4a.jpg
https://imagizer.imageshack.com/img922/3772/cr6ysH.jpg
https://imagizer.imageshack.com/img922/3963/xDa6JE.png
https://imagizer.imageshack.com/img922/4034/jiVCl3.jpg
https://imagizer.imageshack.com/img922/4667/fgHSab.jpg
https://imagizer.imageshack.com/img922/4731/HdlFga.png
https://imagizer.imageshack.com/img922/5205/0j4oGZ.jpg
https://imagizer.imageshack.com/img922/5559/V3EdcQ.jpg
https://imagizer.imageshack.com/img922/5900/FwwhUa.jpg
https://imagizer.imageshack.com/img922/6047/MmQ5e9.jpg
https://imagizer.imageshack.com/img922/6278/pqQhim.jpg
https://imagizer.imageshack.com/img922/6773/jlY5m0.jpg
https://imagizer.imageshack.com/img922/685/v8iyHF.jpg
https://imagizer.imageshack.com/img922/7248/jrWBNW.jpg
https://imagizer.imageshack.com/img922/7366/du7C9q.jpg
https://imagizer.imageshack.com/img922/7486/iFWCSB.jpg
https://imagizer.imageshack.com/img922/7654/Ja43bb.jpg
https://imagizer.imageshack.com/img922/7884/BOLrqy.jpg
https://imagizer.imageshack.com/img922/7929/f0LDA5.png
https://imagizer.imageshack.com/img922/7999/RjFx0C.jpg
https://imagizer.imageshack.com/img922/8527/KjHJyS.jpg
https://imagizer.imageshack.com/img922/8752/WQciwz.jpg
https://imagizer.imageshack.com/img922/8809/6y6elS.jpg
https://imagizer.imageshack.com/img922/9324/Knu3at.jpg
https://imagizer.imageshack.com/img922/971/qya5Y8.jpg
https://imagizer.imageshack.com/img923/1004/UDDCqf.jpg
https://imagizer.imageshack.com/img923/1079/E8m4Uw.jpg
https://imagizer.imageshack.com/img923/1438/NZqsBf.jpg
https://imagizer.imageshack.com/img923/1478/fP2blm.jpg
https://imagizer.imageshack.com/img923/1530/UvGB5U.jpg
https://imagizer.imageshack.com/img923/1716/2pG1kN.jpg
https://imagizer.imageshack.com/img923/1848/pQqAEO.jpg
https://imagizer.imageshack.com/img923/1939/z3mTGD.jpg
https://imagizer.imageshack.com/img923/2236/cVJ0sH.jpg
https://imagizer.imageshack.com/img923/2915/pgc7YW.png
https://imagizer.imageshack.com/img923/2945/vUnmWm.jpg
https://imagizer.imageshack.com/img923/3094/GKgu0o.jpg
https://imagizer.imageshack.com/img923/3213/qRwsii.jpg
https://imagizer.imageshack.com/img923/3248/vJnH4h.png
https://imagizer.imageshack.com/img923/4296/6q3NZf.jpg
https://imagizer.imageshack.com/img923/4425/2Fs0Kf.jpg
https://imagizer.imageshack.com/img923/5279/7NSWne.png
https://imagizer.imageshack.com/img923/5365/l6gNiI.jpg
https://imagizer.imageshack.com/img923/539/gThaDj.jpg
https://imagizer.imageshack.com/img923/5705/KfmO4n.jpg
https://imagizer.imageshack.com/img923/5918/VFU4L8.jpg
https://imagizer.imageshack.com/img923/6058/kASbkb.png
https://imagizer.imageshack.com/img923/6108/soeRsw.png
https://imagizer.imageshack.com/img923/6114/x2NKYF.jpg
https://imagizer.imageshack.com/img923/6154/Xn5l7u.png
https://imagizer.imageshack.com/img923/6356/g7pSnC.jpg
https://imagizer.imageshack.com/img923/6610/BSpAI2.png
https://imagizer.imageshack.com/img923/7108/mSqY6x.jpg
https://imagizer.imageshack.com/img923/7217/jAlqNc.png
https://imagizer.imageshack.com/img923/7226/h8BE6d.jpg
https://imagizer.imageshack.com/img923/7683/YCCpx5.jpg
https://imagizer.imageshack.com/img923/7893/msKUw4.png
https://imagizer.imageshack.com/img923/7893/wIfAXq.png
https://imagizer.imageshack.com/img923/8506/xPpege.jpg
https://imagizer.imageshack.com/img923/8761/nL9Nqi.jpg
https://imagizer.imageshack.com/img923/8794/PSMnMV.jpg
https://imagizer.imageshack.com/img923/9066/IwRyNT.jpg
https://imagizer.imageshack.com/img923/9409/OsZA7V.jpg
https://imagizer.imageshack.com/img923/9850/9L4z7O.jpg
https://imagizer.imageshack.com/img923/9978/eOGm4y.jpg
https://imagizer.imageshack.com/img924/1618/SbaXxG.jpg
https://imagizer.imageshack.com/img924/2303/u7bUPA.jpg
https://imagizer.imageshack.com/img924/2940/afQ2DG.png
https://imagizer.imageshack.com/img924/3073/kkNr06.jpg
https://imagizer.imageshack.com/img924/329/sJ0rBu.jpg
https://imagizer.imageshack.com/img924/351/8apCOd.jpg
https://imagizer.imageshack.com/img924/3580/aMNDMk.jpg
https://imagizer.imageshack.com/img924/3827/JAMPjq.jpg
https://imagizer.imageshack.com/img924/3885/yUNQR9.jpg
https://imagizer.imageshack.com/img924/3995/7Q8YWU.jpg
https://imagizer.imageshack.com/img924/4010/TlKNP3.jpg
https://imagizer.imageshack.com/img924/4253/yTE8ti.png
https://imagizer.imageshack.com/img924/4297/yRMuPL.jpg
https://imagizer.imageshack.com/img924/4480/FdYJAw.jpg
https://imagizer.imageshack.com/img924/4779/AMQf8Y.jpg
https://imagizer.imageshack.com/img924/5488/IwSOrB.jpg
https://imagizer.imageshack.com/img924/5667/TNhiJl.jpg
https://imagizer.imageshack.com/img924/6216/IVLiXw.jpg
https://imagizer.imageshack.com/img924/671/LbfWee.jpg
https://imagizer.imageshack.com/img924/6899/9rc2M3.jpg
https://imagizer.imageshack.com/img924/7172/s0ZFCK.jpg
https://imagizer.imageshack.com/img924/72/Aq3iF8.jpg
https://imagizer.imageshack.com/img924/7411/NYWOEw.jpg
https://imagizer.imageshack.com/img924/7429/LXjZpc.jpg
https://imagizer.imageshack.com/img924/751/4peXYt.jpg
https://imagizer.imageshack.com/img924/79/tKGNLz.jpg
https://imagizer.imageshack.com/img924/7959/HkkdnN.jpg
https://imagizer.imageshack.com/img924/8858/Srmmqm.jpg
https://imagizer.imageshack.com/img924/9149/D5ZO6S.jpg
https://imagizer.imageshack.com/img924/9199/HtbjRS.jpg
https://imagizer.imageshack.com/img924/962/USiEPP.jpg
https://imagizer.imageshack.com/img924/9705/kYQ7rj.jpg
https://imagizer.imageshack.com/img923/3462/jn2ZxO.jpg
https://imagizer.imageshack.com/img923/7638/AKR4gf.jpg
https://imagizer.imageshack.com/img922/227/bwY78E.jpg
https://imagizer.imageshack.com/img922/8605/eII6oA.jpg
https://imagizer.imageshack.com/img922/3770/b8W8Li.jpg
https://imagizer.imageshack.com/img924/7025/eylqun.jpg
https://imagizer.imageshack.com/img924/647/jAv2my.jpg
https://imagizer.imageshack.com/img922/6047/MmQ5e9.jpg
https://imagizer.imageshack.com/img923/2284/7QVYRQ.jpg
https://imagizer.imageshack.com/img923/1240/fJLxOm.jpg
https://imagizer.imageshack.com/img923/8752/2V8o68.jpg
https://imagizer.imageshack.com/img922/9182/LVjCgb.jpg
https://imagizer.imageshack.com/img923/5258/yJC6Ne.jpg
https://imagizer.imageshack.com/img922/6101/B80s00.jpg
https://imagizer.imageshack.com/img922/4754/hF3SiV.jpg
https://imagizer.imageshack.com/img924/9461/73t8aq.png
https://imagizer.imageshack.com/img924/3420/H0A7rG.jpg
https://imagizer.imageshack.com/img924/1897/uq2ZFg.jpg
https://imagizer.imageshack.com/img922/5135/eWm4ie.jpg
https://imagizer.imageshack.com/img923/4982/TYb06w.jpg
https://imagizer.imageshack.com/img924/754/nrvoSA.jpg
https://imagizer.imageshack.com/img923/1294/9BEamF.jpg
https://imagizer.imageshack.com/img922/5426/TiNGVQ.jpg
https://imagizer.imageshack.com/img922/3999/qEZSZ5.png
https://imagizer.imageshack.com/img923/9075/J6fwjc.jpg
https://imagizer.imageshack.com/img922/6886/aYjOnH.jpg
https://imagizer.imageshack.com/img922/8223/QMSnu1.jpg
https://imagizer.imageshack.com/img924/6782/SvUYWM.jpg
https://imagizer.imageshack.com/img924/5586/gTr5BB.jpg
https://imagizer.imageshack.com/img922/2017/Q3Gp5t.png
https://imagizer.imageshack.com/img924/6216/IVLiXw.jpg
https://imagizer.imageshack.com/img924/6216/IVLiXw.jpg
https://imagizer.imageshack.com/img923/9959/zjBVtF.jpg
https://imagizer.imageshack.com/img922/1883/r84i3H.jpg
https://imagizer.imageshack.com/img923/4744/YTaBtK.jpg
https://imagizer.imageshack.com/img922/4734/rxRtMH.png
https://imagizer.imageshack.com/img923/4679/1tivIi.png
https://imagizer.imageshack.com/img922/8400/Ddwl5I.jpg
https://imagizer.imageshack.com/img923/3060/hUpW7B.jpg
https://imagizer.imageshack.com/img922/2810/QghWSi.jpg
https://imagizer.imageshack.com/img923/4215/zPJdNs.jpg
https://imagizer.imageshack.com/img922/9600/r86MBY.jpg
https://imagizer.imageshack.com/img922/6101/B80s00.jpg
https://imagizer.imageshack.com/img923/7195/wpo8kg.jpg
https://imagizer.imageshack.com/img923/7638/AKR4gf.jpg
https://imagizer.imageshack.com/img922/7815/VmIJvf.png
https://imagizer.imageshack.com/img923/6606/YlDuHs.png
https://imagizer.imageshack.com/img923/6310/lttY4S.jpg
Clone this wiki locally