add theaerie.ca to add-wildcard-domain #367
Conversation
theaerie[.]ca is now hosting the kit that was previously on nico[.]sa and before that ajstelecom[.]com[.]mx
|
I just filed an abuse report using the same form as yesterday. The recent trend is that if the U.S. based division that the form reports to has access, then a response is typically seen within 1-2 business days. On the other hand, when the division is located in another country, the response may take much longer as was the case with ajstelecom[.]com[.]mx, which took about two weeks to resolve. |
|
Damned I love the details in your reports (:de:) |
Thanks! I'll transfer the information to your list once I catch up with my C++ homework. I just wanted to try to get the new host out there as quickly as possible in the meantime. |
Don't forget the Rust work... that help keeping you from mem leaks |
theaerie[.]ca is now hosting the kit that was previously on nico[.]sa and before that ajstelecom[.]com[.]mx
Domain/URL/IP(s) where you have found the Phishing:
Impersonated domain
Describe the issue
This (likely recently compromised) site is hosting the phishing kit that was previously active at nico[.]sa, see #366. Before that the group was using ajstelecom[.]com[.]mx. See #362 #353 and #343 for a recent history of this activity group. The previous host had more than 250 malicious endpoints identified in a two week period. I don't have a facebook account but you will likely be able to find lures and additional URIs there until I can update this submission with additional samples after the search engines have had a chance to recrawl the various social media platforms.
Related external source
Screenshot
Click to expand