Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update add-domain *.nabs.top #270

Closed
wants to merge 1 commit into from

Conversation

WebworkrNet
Copy link
Contributor

@WebworkrNet WebworkrNet commented Sep 16, 2023

Domain/URL/IP(s) where you have found the Phishing:

email spam

Impersonated domain

Amazon.com

Related external source

https://www.virustotal.com/gui/domain/nabs.top

Describe the issue

account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top

For security reasons, I didn't call any of the links.

Subject:
[Local part of email address], Herzlichen Glückwunsch zur Auswahl als glücklicher Kunde, Sie haben die Möglichkeit, iPhone 14 oder Samsung Galaxy 7 zu einem super niedrigen Preis zu gewinnen

Body

Sie können diese E-Mail nicht lesen? [Im Browser ansehen ](https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/SubscribeClick?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou).Interesse verlieren? [Abbestellen](https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou)



[iPhone 14 PRO Lass uns raten!](https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/SubscribeClick?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou)


[Heute ist IHR Glückstag!](https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/SubscribeClick?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou)
[Hol dir](https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/SubscribeClick?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou)

[[iPhone 14 PRO]](data:image/webp;base64,UklGRqoOAABXRUJQVlA4WAoAAAAQAAAAcwEAOwEAQUxQSIsAAAANcFPbttRc5lkIhnBDhxgwEBmp4iTp/lRnfhUnIiZAzy3CcsQsk526altLL/yP//E//sf/+B//43/8j//xP/7H//gf/+N//I//8T/+x//4H//jf/x/rjJlzlaq+BFaNaZSabq/X9T14jJLieOs+HYpu+1KlqKHsvB2SlkhW81C0AdMwViS8D/+P6sJAFZQOCD4DQAAsGkAnQEqdAE8AT7dbLBQqLuqKqXVugtwG4lnbtz/vfd25P6HDD4F2/2qO8Oku2n/vnXa71dPD2O/vPuak5tcvPFDneJFQZMSKgyYkVBkxIqDJiRx2VFl3wqLLviqc7I/grGYh2YGHjMDDxmBgtD/eK3ZILShNmZnvPWIdm/6AK/axgE4T25GiXywgLeFq/DzZo4silGoNsqsB7tVwLdjs2rYHyIOS76qNaPHXCr3g/jLewE9xxQVjPC17ltrsmaRFKrm2rbptwaWCyc4NHm/Jv9qGaSSXpWQZhRAEw/p+CdOwBB5vvTFAKaD9MSzOUrKVENiurZPoWsm+O3AXEhe5ouo+d887nPmhJrtT7ZS9dTofoDP1n3twuNHcSUP/PB1SxUFY1mnxvwhgnandy/GWXVmiAI5Jk3291s+nLgSdSG0crCR+xpzOmBm5x2XrEtzfNXxov0Jkgp6DePct+NcjAPV/OZwi9iO58CppCG0tq9/kICzbbz7hgGt8SKg2sEJqE5OzX5FXmDXnXIVrxp3riXJX8FysyIIXZ//1iCv4hshcoXZ9oOuodTG+n0eVN81yLrV3XEAtAveX3fqJTmnTZmReUxfjxi9QIwIeN3Uur9y3GTg0ksPqpK7pWInXfNZEkZlxWFIGdTwz869/yiN0Rm61jnKSDfzj8UASoNtmS3DLiIuF5+WRGlmBX66wEItUDFCY2tkaBhcVHElp3B4tmpUOwkst/E9zbpPJLBoV3/8RjNaggFBAvoGZTelirH4Jno3c8hmN2n8xF5z4v/wEYJFeoLz1anNq4NnkyuW9F/JpETpj8JklGIw3gj7JCuLL/uLo+iy1dHqtrd2SNaP6gZqksMQFL2pJnkMFLoZYuTum0XenXAHPb+k3J7VFfVoFIXZ+C8nsHMkCkyxS+TinJQQ2VkzAagyYqd9Ttd6RrYkeV3kuAMbBgJxgD4Lr/vccznv57uJsdNU0OErzSUNpI57XqdSfLb8oaj7YjLEBWnbLqJeJFiO4WTK5IHe1IIWYj52GdVbR16i+HOIT9jBZTWCn/5UGTEXrGf/le9RC7U6BVHaLG52mXtzxLqCPJgbPjuztrk0YTwpI+iy74VHAYWZMSKhjYsu+FRZd8Kiy74VFl3wdAAA/vxXGvFwXhnnkTOzVRbw3KhBZCqATztagAIuXqKErff+MFMpSI8zpis4ZnLIZmzimrnADqIP551bM+QGvSyWVcRC5WWa4WkIjWixtjfUlUh1qus1PNY+4neZEFYdm9jH1YHm4YOkLiZP7AAGI4jtbIkUauE9E2Cu/nx7bt40rYymYu3R3etEMOsLu6ruoSMGBvESWleAJhfsC3mo1SvixemaO4l3TnvzoHh0O19AHzZcPNJy8Dk9jz2wKtcpW3Yesqr9cxc1oofm+N7jqiNphdB+g+/02Tl3wyD0U8UAcnhBAupwVV1YBt7NUE1JdGNSi3ybGjgRKFBLJvDoipEQ7Teeeq0YCzqddM5/L7zydm/StnChsE+3rKsVSEf/7Bvx9UJtK88LHPPIRha/wqOJzMEVSsE/T5jiPjaA1Ybpg8v284XgJOOAy+mbLMFkuPoPVvrTXruEGelFQvYTDWYUchIbG9pqZkl1x5TteR+PEzqwQtwlO/sxvPvTmP39L0CGGr05OPwY4qiW5viaWjyod+fUStaOqioBNsh+1QOzQUorvPJ+0p5ZGRnL5eQ3IXJIBQr61tlVajAzQojyTQHIKaKUSovNjm8OZlpNVlF9Bh0vwqRPyz6Clj14yu68os+MDk8KzVrS/qY3KqZtsbfSP904schEJl4bkupxFuYGxUEAQnvkMuB97yIIn/ENtqJnvow7mbqrM6dgHtWU8/j8fL1SLMyxJmDij/4w5aKToIMqfDONkBkatPHWRlDh3+RgP67Mbou+hITzBNrsH8P6C6hz+tC0Ow5EN6FhOE70edUzWGVcf1pvQw6pxrg6AXR6/iMFa2th4DXgsOr6zDPjxbvNYM1YyzBxCyycXInyd5NUKea3HGzMYxwqTmtKqvrXYZTrYHj3aK4qIFJUdPJRGKb9j2EMw/IFYiCA53RR7kM8CBn92rEz1ZCpcfdIXKB4iScsGgkQTV7QzvE35LKHB9f0CTY3SkIuACpBho3NQmH1dDlkBO23V1K2LhH/54+rocHemUq6RoUm5AScWuwcDhcBbuOhRFXLw0TgCf806SCwBoFZ9i1mq6PcwwAPDirsdLv22Ubjx6U0pdi0IsA/A3G3B64/1UW5wKfJVu+MXJ7LTwMVNHauVzJ4ltqi8+5mNhKOGBOILh0cllXP3uWgYvBfVnirRLX/cE5wawdi/eSjb4awqKXFNPP0gbvFtsPTDelIw+YETUAWRc+K6rBKYnzXVyGWBa42goh2G75do0IAsRG0r3+Ro2SYWsW3BWappBsLMLfn9luJC7SvrWFugtCW8dd3mK9TQ3ItGJ9bmgKqx1vyWpDq7LS/msS5N6qH4VvNj6rs3q9eRgbX+0l4JCeNBvq6RAIsp9C1yqh9a8SdSAwiYk/aVxiYsE4LOPFhwzVUYKDp3XfD2YVE0/AxrduBtt3R8m3TMm7UOJ+mUxoqze+bQJqcaPPN0YBhMnOtoY4T5QNTAVx6VzI5ZNCJXNMbhZ/QOHaEoU6VhdKT36Y0bDvV9aTNU2a4kkt+t42/yWdv3eBynrQ1PHtDZes4Gaw4uzRwmz6ISmiJL61prg5L6pcPRj6h71VGAhKkV58S4FDsX2eUYgGFhu60UzZrHf2X3QE2Tm+1O3/PwNyDQ0etP7HdMUXM8Ef03f9/OX17u58EeLF8uAs7dey08RKEE//R+pGuGk+w0jLn10TtxSnk1oxLUjMLCprJ3qG5QADkIPILziYbWzmpxYYZvNPu6b7AWDQAFVK7oeuwyRouZqDJpT8WnavI7GIZAhNkBxf4VhRQUuAafaCdbw37ymQ0lhXbAs80kPFLd8qpXlUpf9ulxAfx6a9/ru6v7cOaQAziQHlYxicguuqry61wF/c/eqPVBYq2rgAPqvXSgplGjWgqOPLak/7G7r+jN4Z4ouNtzCGkMup/xmDe3LXCyw5ITvZXeqKXFvhRScNM+IJBBigcHhX/BU8Pt2tydMGz/gbYC0JcBohVcMP1h8GIRURYYOix+Cn6hmxajysTUe8TYqcIdIJejwCbpsxqjcaPZWKRIpHeELTl/CwPzkAORzwEPmV/TjHJA6UOAbSDbzNLIX0QfzfZIHdguROfMFdDTvpMIGvxvMLlQPrP8ojVSZ9l8Jz+8mtMGWoxkxST6H0TkkfRpAcxz8o3rQcKuUzEtEPhW+8H4Qfi21/chWzR11tLhX8yrfUYL9ZS6yoie6kephgB9CJ5NN5LSjPIi4CBCT4taBK0ADSdX+/G3KfDwuxPPpNvBaTCCQW5umDq77NfH4jZnZocgn2GK7nJ7/LDi4iwoeAeeL+togYHjv4wnn/l0qpdKLo5n+a1BHWnVOj2Jy2lzyoIph9XPzZ81HFKvXA1TZ/UARqbAfX06DafiU2blpe0b4BFxyPV1/iYB8N+sl2vukcZvEx+3gWDZdWCs1vaatAtXurjoRZs4FFTtgieGLJINafBgtXwF1Qr0ByBJEgAUKH4WbBQxM6ojS0CvIScxMeYqHdu15nFifkbjviI/m6vwa8vIeyv+ZRxZCRwXIesR/OOXVCJ26GkpgFEG1vHN15xARczs3ioC+5hCQWiZxuGXFoZN7c0O9L6+7qCMCmTpq0KcNGiM8NcGkKM4oxNOTNoicy1UtaG11DUvIlItGbJy/TBjaverzfncnzcWyyNb6ztyRR3W9zhJ6c+u0FCA3WBrqW2oIeyop/BR0pMb3LU73HW7QHR06+SQp9xrls7tJHutpG2mzUe0caOqpy813oprAbDgAhk+ygDv1b1SNSlNijuipPG17D73XsTCIheAO35AB3IaT5e1/BWXPYkQ/NlxEfbIeJwqIgV6vZvjg9rNRO3+pwoKniXcZz/zW0GYkvDoGGzFft20rfm5iEYg9mLBRXoj7obqqpRjEvGPngStUoHiPsL/zpMAKI80W26ESjksn3VNjg+ymKnEa/LZShrTNK2BCzuVZGR/ffiqK0GgjY70InwFgcqME1JaHIrygy2yiQ1Zh0A1+d4yK40yPVw4zV1WqUcUfMKexZqBxQNMQPLlwnvaBR37EYhKB/XvgjYfjsNBpC5FONjQsdUj1AGPNtoQHyzvNQ1BKv0Qgy1rzFGKbBxda0hZFblu8+1lvRgxgJOCW4KagBwzqxIXfwDb6mTtQWGa1+JyNIZXKWGrVcInZ+BgzijL6PhLlQtSopUEDVNDa4ZCYndrgkrFfA98bSK0JQjnWp94rHbxbHr5wCpNRZMloal88fZBxk5ga6rPJHC5XT+7DtQ6GkOrg6FeEhO2GwhwEAoxkr4y4nIIW93Le38c5JU6Uc8oQ+MHKs/N+y3Dfzopz/35tT+bYjZsMoRCcRt03lo+rtiLhdXXQX8qXC33M9RnfNcfsAfyWJWab1kgiqAQsx4EbFOhq+gSt3QWhOSZLlV41Q0pm+HEZyidfIB86pn7/JrTmJGQaQMetK0qa+kQE5W/sx110cn7o0jBg4jontHI4ptEZtwkBghIzgFnKssYNIIAZpAMpTg6Vo3HeNkcEcaUs0ydnbqedAbg/ErSjexI4AMRe5S51Avn45iRkccf1wAnqqrGnKQZWdnJOpntmt60UheQLLvgzE8wdJ7K3kAAopGIkXjIm/vOIAAAAAAAAAAAAAA)
[14 PRO](https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/SubscribeClick?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou)

ehmen Sie einfach an der anonymen Umfrage teil, um Ihr Geschenk zu erhalten.


Aber beeilen Sie sich! Heuten steht Ihnen nur eine begrenzte Anzahl an Prämien zur Verfügung!


    
[Weitermachen!](https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/SubscribeClick?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou)


Unser Versprechen:

- 100% kostenlos
- Garantierter Datenschutz
- Verifiziertes Gewinnspiel
- Kundenzufriedenheit hat für uns oberste Priorität
- Vollständige Sicherheit mit 100 % sicherer Bestellabwicklung

*24-Stunden-Service nach Zahlungsbestätigung
*Siehe Nutzungsbedingungen


Copyright © 2023 [Amazon.com] Alle Rechte vorbehalten.



To protect my privacy, I removed my email address from the parameters of the URLs and replaced it with spam@example.org.

Screenshot

Click to expand

Screenshot_20230916_103815_Chrome

@WebworkrNet WebworkrNet changed the title Update add-domain *.naps.top Update add-domain *.nabs.top Sep 16, 2023
@@ -1093,3 +1093,5 @@ meldung-vols.online
beritapb.com
sgp1.digitaloceanspaces.com
cpanel01wh.bkk1.cloud.z.com
naps.top
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Chose one of them....

If you will blacklist by wildcard (domain + sub-doamins), please use https://github.com/mitchellkrogza/phishing/blob/main/add-wildcard-domain

spirillen added a commit to mypdns/matrix that referenced this pull request Oct 15, 2023
- 1gewinner.de
- cleverpush.com
- emldmonly.com
- gfstrck.com
- googleapis.com
- naps.top
- sbbq3otrk.com
- tinyurl.com
- trckde01.de

Rel: mitchellkrogza/phishing#270
@spirillen
Copy link
Collaborator

This url redirect through a bunch of domains including: (Please add all to the wildcard list in you MR

gfstrck.com
1gewinner.de
cleverpush.com
googleapis.com
trckde01.de
sbbq3otrk.com
emldmonly.com
tinyurl.com
Logger output
+102 ##.sponsorText de1121.1gewinner.de get dom https://de1121.1gewinner.de/campaign_1121.html?coyoteAffiliTokenId=63599325&
+102 de1121.1gewinner.de 1 get image https://de1121.1gewinner.de/favicon.ico
+99 de1121.1gewinner.de 3 get xhr https://meine.pixelweiche.de/tg/script.js?idPartner=&subId=&subIdentifier=&postbackToken=&zielseite=adressdata1
+97 de1121.1gewinner.de 1 get image https://de1121.1gewinner.de/media/adresseManager/microSiteImg/1121/iphonedesktop.png
+97 ||cleverpush.com^$3p -- de1121.1gewinner.de 3 get script https://static.cleverpush.com/channel/loader/cyF8KJYSfZzhHi8Py.js
+97 de1121.1gewinner.de 3 get script https://meine.pixelweiche.de/script.js
+96 de1121.1gewinner.de 1 get image https://de1121.1gewinner.de/media/adresseManager/microSiteImg/1121/iphonemobile.png
+96 ||cleverpush.com^$3p -- de1121.1gewinner.de 3 get script https://static.cleverpush.com/channel/loader/cyF8KJYSfZzhHi8Py.js
+96 ||googleapis.com^ -- de1121.1gewinner.de 3 get script https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
+96 *$document,permissions=browsing-topics=(),from=~localhost -- de1121.1gewinner.de 1 get doc https://de1121.1gewinner.de/campaign_1121.html?coyoteAffiliTokenId=63599325&
+96 *$document,permissions=idle-detection=(),from=~localhost -- de1121.1gewinner.de 1 get doc https://de1121.1gewinner.de/campaign_1121.html?coyoteAffiliTokenId=63599325&
+96 *$document,permissions=join-ad-interest-group=(),from=~localhost -- de1121.1gewinner.de 1 get doc https://de1121.1gewinner.de/campaign_1121.html?coyoteAffiliTokenId=63599325&
+96 *$document,permissions=run-ad-auction=(),from=~localhost -- de1121.1gewinner.de 1 get doc https://de1121.1gewinner.de/campaign_1121.html?coyoteAffiliTokenId=63599325&
+96 *$document,permissions=attribution-reporting=(),from=~localhost -- de1121.1gewinner.de 1 get doc https://de1121.1gewinner.de/campaign_1121.html?coyoteAffiliTokenId=63599325&
+96 no-remote-fonts: * true -- de1121.1gewinner.de 1 get doc https://de1121.1gewinner.de/campaign_1121.html?coyoteAffiliTokenId=63599325&
+94 de1121.1gewinner.de 1 get doc https://de1121.1gewinner.de/campaign_1121.html?coyoteAffiliTokenId=63599325&
+94 *$document,permissions=browsing-topics=(),from=~localhost -- trckde01.de 1 get doc https://trckde01.de/de01,iphone,15,pro,max_787.html?idPartner=69&idCampaignAd=0&subId=1007_21242&subIdentifier=daa3014d4b8c4524b34bf9adff37b940_
+94 *$document,permissions=idle-detection=(),from=~localhost -- trckde01.de 1 get doc https://trckde01.de/de01,iphone,15,pro,max_787.html?idPartner=69&idCampaignAd=0&subId=1007_21242&subIdentifier=daa3014d4b8c4524b34bf9adff37b940_
+94 *$document,permissions=join-ad-interest-group=(),from=~localhost -- trckde01.de 1 get doc https://trckde01.de/de01,iphone,15,pro,max_787.html?idPartner=69&idCampaignAd=0&subId=1007_21242&subIdentifier=daa3014d4b8c4524b34bf9adff37b940_
+94 *$document,permissions=run-ad-auction=(),from=~localhost -- trckde01.de 1 get doc https://trckde01.de/de01,iphone,15,pro,max_787.html?idPartner=69&idCampaignAd=0&subId=1007_21242&subIdentifier=daa3014d4b8c4524b34bf9adff37b940_
+94 *$document,permissions=attribution-reporting=(),from=~localhost -- trckde01.de 1 get doc https://trckde01.de/de01,iphone,15,pro,max_787.html?idPartner=69&idCampaignAd=0&subId=1007_21242&subIdentifier=daa3014d4b8c4524b34bf9adff37b940_
+94 no-remote-fonts: * true -- trckde01.de 1 get doc https://trckde01.de/de01,iphone,15,pro,max_787.html?idPartner=69&idCampaignAd=0&subId=1007_21242&subIdentifier=daa3014d4b8c4524b34bf9adff37b940_
+91 trckde01.de 1 get doc https://trckde01.de/de01,iphone,15,pro,max_787.html?idPartner=69&idCampaignAd=0&subId=1007_21242&subIdentifier=daa3014d4b8c4524b34bf9adff37b940_
+91 *$document,permissions=browsing-topics=(),from=~localhost -- www.sbbq3otrk.com 1 get doc https://www.sbbq3otrk.com/2LP3GRS/WJ5Z1N/?sub1=21242&sub2=&sub3=69552dc4942e4489b0a1db9269f69fa22407e
+91 *$document,permissions=idle-detection=(),from=~localhost -- www.sbbq3otrk.com 1 get doc https://www.sbbq3otrk.com/2LP3GRS/WJ5Z1N/?sub1=21242&sub2=&sub3=69552dc4942e4489b0a1db9269f69fa22407e
+91 *$document,permissions=join-ad-interest-group=(),from=~localhost -- www.sbbq3otrk.com 1 get doc https://www.sbbq3otrk.com/2LP3GRS/WJ5Z1N/?sub1=21242&sub2=&sub3=69552dc4942e4489b0a1db9269f69fa22407e
+91 *$document,permissions=run-ad-auction=(),from=~localhost -- www.sbbq3otrk.com 1 get doc https://www.sbbq3otrk.com/2LP3GRS/WJ5Z1N/?sub1=21242&sub2=&sub3=69552dc4942e4489b0a1db9269f69fa22407e
+91 *$document,permissions=attribution-reporting=(),from=~localhost -- www.sbbq3otrk.com 1 get doc https://www.sbbq3otrk.com/2LP3GRS/WJ5Z1N/?sub1=21242&sub2=&sub3=69552dc4942e4489b0a1db9269f69fa22407e
+91 no-remote-fonts: * true -- www.sbbq3otrk.com 1 get doc https://www.sbbq3otrk.com/2LP3GRS/WJ5Z1N/?sub1=21242&sub2=&sub3=69552dc4942e4489b0a1db9269f69fa22407e
+89 www.sbbq3otrk.com 1 get doc https://www.sbbq3otrk.com/2LP3GRS/WJ5Z1N/?sub1=21242&sub2=&sub3=69552dc4942e4489b0a1db9269f69fa22407e
+89 *$document,permissions=browsing-topics=(),from=~localhost -- gfstrck.com 1 get doc https://gfstrck.com/?a=21242&c=365066&oc=209383&sr=t&s1=yxqLP&vt=1697371770401&h=7f357ea145f42ab964eb292830e49768cd388260&req=https%3A%2F%2Ftrack.emldmonly.com%2F%3Fa%3D21242%26c%3D365066%26co%3D15878%26mt%3D3%26s1%3DyxqLP&co=15878&mt=3&sip=192.42.116.176&sh=61135e84468a557f5389cb1c922db57e126dd9a9
+89 *$document,permissions=idle-detection=(),from=~localhost -- gfstrck.com 1 get doc https://gfstrck.com/?a=21242&c=365066&oc=209383&sr=t&s1=yxqLP&vt=1697371770401&h=7f357ea145f42ab964eb292830e49768cd388260&req=https%3A%2F%2Ftrack.emldmonly.com%2F%3Fa%3D21242%26c%3D365066%26co%3D15878%26mt%3D3%26s1%3DyxqLP&co=15878&mt=3&sip=192.42.116.176&sh=61135e84468a557f5389cb1c922db57e126dd9a9
+89 *$document,permissions=join-ad-interest-group=(),from=~localhost -- gfstrck.com 1 get doc https://gfstrck.com/?a=21242&c=365066&oc=209383&sr=t&s1=yxqLP&vt=1697371770401&h=7f357ea145f42ab964eb292830e49768cd388260&req=https%3A%2F%2Ftrack.emldmonly.com%2F%3Fa%3D21242%26c%3D365066%26co%3D15878%26mt%3D3%26s1%3DyxqLP&co=15878&mt=3&sip=192.42.116.176&sh=61135e84468a557f5389cb1c922db57e126dd9a9
+89 *$document,permissions=run-ad-auction=(),from=~localhost -- gfstrck.com 1 get doc https://gfstrck.com/?a=21242&c=365066&oc=209383&sr=t&s1=yxqLP&vt=1697371770401&h=7f357ea145f42ab964eb292830e49768cd388260&req=https%3A%2F%2Ftrack.emldmonly.com%2F%3Fa%3D21242%26c%3D365066%26co%3D15878%26mt%3D3%26s1%3DyxqLP&co=15878&mt=3&sip=192.42.116.176&sh=61135e84468a557f5389cb1c922db57e126dd9a9
+89 *$document,permissions=attribution-reporting=(),from=~localhost -- gfstrck.com 1 get doc https://gfstrck.com/?a=21242&c=365066&oc=209383&sr=t&s1=yxqLP&vt=1697371770401&h=7f357ea145f42ab964eb292830e49768cd388260&req=https%3A%2F%2Ftrack.emldmonly.com%2F%3Fa%3D21242%26c%3D365066%26co%3D15878%26mt%3D3%26s1%3DyxqLP&co=15878&mt=3&sip=192.42.116.176&sh=61135e84468a557f5389cb1c922db57e126dd9a9
+89 no-remote-fonts: * true -- gfstrck.com 1 get doc https://gfstrck.com/?a=21242&c=365066&oc=209383&sr=t&s1=yxqLP&vt=1697371770401&h=7f357ea145f42ab964eb292830e49768cd388260&req=https%3A%2F%2Ftrack.emldmonly.com%2F%3Fa%3D21242%26c%3D365066%26co%3D15878%26mt%3D3%26s1%3DyxqLP&co=15878&mt=3&sip=192.42.116.176&sh=61135e84468a557f5389cb1c922db57e126dd9a9
+86 no-strict-blocking: true (temporary) ++ gfstrck.com 1 get doc https://gfstrck.com/?a=21242&c=365066&oc=209383&sr=t&s1=yxqLP&vt=1697371770401&h=7f357ea145f42ab964eb292830e49768cd388260&req=https%3A%2F%2Ftrack.emldmonly.com%2F%3Fa%3D21242%26c%3D365066%26co%3D15878%26mt%3D3%26s1%3DyxqLP&co=15878&mt=3&sip=192.42.116.176&sh=61135e84468a557f5389cb1c922db57e126dd9a9
+78 ||gfstrck.com^ -- gfstrck.com 1 get doc https://gfstrck.com/?a=21242&c=365066&oc=209383&sr=t&s1=yxqLP&vt=1697371770401&h=7f357ea145f42ab964eb292830e49768cd388260&req=https%3A%2F%2Ftrack.emldmonly.com%2F%3Fa%3D21242%26c%3D365066%26co%3D15878%26mt%3D3%26s1%3DyxqLP&co=15878&mt=3&sip=192.42.116.176&sh=61135e84468a557f5389cb1c922db57e126dd9a9
+78 *$document,permissions=browsing-topics=(),from=~localhost -- track.emldmonly.com 1 get doc https://track.emldmonly.com/?a=21242&c=365066&co=15878&mt=3&s1=yxqLP
+78 *$document,permissions=idle-detection=(),from=~localhost -- track.emldmonly.com 1 get doc https://track.emldmonly.com/?a=21242&c=365066&co=15878&mt=3&s1=yxqLP
+78 *$document,permissions=join-ad-interest-group=(),from=~localhost -- track.emldmonly.com 1 get doc https://track.emldmonly.com/?a=21242&c=365066&co=15878&mt=3&s1=yxqLP
+78 *$document,permissions=run-ad-auction=(),from=~localhost -- track.emldmonly.com 1 get doc https://track.emldmonly.com/?a=21242&c=365066&co=15878&mt=3&s1=yxqLP
+78 *$document,permissions=attribution-reporting=(),from=~localhost -- track.emldmonly.com 1 get doc https://track.emldmonly.com/?a=21242&c=365066&co=15878&mt=3&s1=yxqLP
+78 no-remote-fonts: * true -- track.emldmonly.com 1 get doc https://track.emldmonly.com/?a=21242&c=365066&co=15878&mt=3&s1=yxqLP
+76 track.emldmonly.com 1 get doc https://track.emldmonly.com/?a=21242&c=365066&co=15878&mt=3&s1=yxqLP
+76 *$document,permissions=browsing-topics=(),from=~localhost -- tinyurl.com 1 get doc https://tinyurl.com/LPiphone14
+76 *$document,permissions=idle-detection=(),from=~localhost -- tinyurl.com 1 get doc https://tinyurl.com/LPiphone14
+76 *$document,permissions=join-ad-interest-group=(),from=~localhost -- tinyurl.com 1 get doc https://tinyurl.com/LPiphone14
+76 *$document,permissions=run-ad-auction=(),from=~localhost -- tinyurl.com 1 get doc https://tinyurl.com/LPiphone14
+76 *$document,permissions=attribution-reporting=(),from=~localhost -- tinyurl.com 1 get doc https://tinyurl.com/LPiphone14
+76 no-remote-fonts: * true -- tinyurl.com 1 get doc https://tinyurl.com/LPiphone14
+74 no-strict-blocking: true (temporary) ++ tinyurl.com 1 get doc https://tinyurl.com/LPiphone14
+72 ||tinyurl.com^ -- tinyurl.com 1 get doc https://tinyurl.com/LPiphone14
+12 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get image https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/favicon.ico
+11 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get image https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/images/christmas/49194_04.jpg
+11 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get image https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/images/Halloween.jpg
+11 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get script https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/lib/bootstrap/dist/js/bootstrap.bundle.min.js
+11 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get script https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/lib/jquery/dist/jquery.min.js
+11 *$document,permissions=browsing-topics=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 post doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns/Completed
+11 *$document,permissions=idle-detection=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 post doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns/Completed
+11 *$document,permissions=join-ad-interest-group=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 post doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns/Completed
+11 *$document,permissions=run-ad-auction=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 post doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns/Completed
+11 *$document,permissions=attribution-reporting=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 post doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns/Completed
+11 no-remote-fonts: * true -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 post doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns/Completed
+10 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 post doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns/Completed
+10 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get image https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/favicon.ico
+8 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get script https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/lib/bootstrap/dist/js/bootstrap.bundle.min.js
+8 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get script https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/lib/jquery/dist/jquery.min.js
+8 *$document,permissions=browsing-topics=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou
+8 *$document,permissions=idle-detection=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou
+8 *$document,permissions=join-ad-interest-group=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou
+8 *$document,permissions=run-ad-auction=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou
+8 *$document,permissions=attribution-reporting=(),from=~localhost -- account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou
+0 account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top 1 get doc https://account-amazon-merchant-center-campaign-v3-signin-identifier.nabs.top/Uns?raju2=amz&4a=spam@example.org&nrn5126=&ou%20ow=ion%20You%20owe%20me%208720%20dollars%20Gregory%20looked%20back%20even%20more%20anxiou

Don't forget to rebase

@spirillen spirillen added todo 🗒️ ReBase This Merge request need to be rebased from master labels Oct 15, 2023
@spirillen
Copy link
Collaborator

After a second though... this might be more like scam... than phishing, there are no requests for more personal data than is visible on fakebook

image

spirillen added a commit to mypdns/matrix that referenced this pull request Oct 15, 2023
- 1gewinner.de
- cleverpush.com
- emldmonly.com
- gfstrck.com
- googleapis.com
- naps.top
- sbbq3otrk.com
- tinyurl.com
- trckde01.de

Rel: mitchellkrogza/phishing#270 (comment)
@spirillen
Copy link
Collaborator

Closed for inactivity

@spirillen spirillen closed this Dec 7, 2023
@spirillen spirillen added the wontfix This will not be worked on label Dec 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ReBase This Merge request need to be rebased from master todo 🗒️ wontfix This will not be worked on
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants