Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add reluzformaturas.com.br to add-wildcard-domain #435

Conversation

g0d33p3rsec
Copy link
Contributor

@g0d33p3rsec g0d33p3rsec commented Jul 2, 2024

Phishing Domain/URL/IP(s):

https://reluzformaturas.com.br/M2syODhKMnA2SjgzM2M=
https://reluzformaturas.com.br/M0ozODFCOWg5bTZGM0s=
https://reluzformaturas.com.br/M2U0bjBGN1I2WTFwMjE=
https://reluzformaturas.com.br/MzI0SDJhMnk3czduNGk=
https://reluzformaturas.com.br/M2kzSzdrMkwwMDBvNVQ=
https://reluzformaturas.com.br/M1MzVDdlNmE3YTZmOXk=
https://reluzformaturas.com.br/M2o0ZzJKMmo2RDdrMDA=
https://reluzformaturas.com.br/M2QzNzVGN2Q0NTlXMnI=
https://reluzformaturas.com.br/M0gzejBjNzMzWTc3Nng=
https://reluzformaturas.com.br/M0U0ODJPM2ExYzFvNnk=
https://reluzformaturas.com.br/M2k0ZjJtM0IxNzZVOTI=
https://reluzformaturas.com.br/M1k0TzJlM0UwWjdzMmk=
https://reluzformaturas.com.br/M2kxZjhZOUgxcDhSOG4=
https://reluzformaturas.com.br/M1U0ZTJxM1gwcDZBMlg=
https://reluzformaturas.com.br/M1A0NzJ6M1UwWjVlMWU=
https://reluzformaturas.com.br/M1I0czJtMzQxSDJRM2o=
https://reluzformaturas.com.br/M0s0ODB5OXAyNTltNUg=
https://reluzformaturas.com.br/M3g0ZTJKMXM1SDNINmc=
https://reluzformaturas.com.br/M0w0ZDJtM1U5WjdmM3g=

Impersonated domain

https://www.betway.co.za
https://www.1voucher.co.za/
https://ff.garena.com/
https://www.tut.ac.za/
https://www.wsu.ac.za/

Describe the issue

This domain is now hosting the phishing kit that previously at abcmueblesbogota[.]com (#432), ergoterapiacaribu[.]ch (#426), ijconnects[.]com (#421), cbcaps[.]shop (#417), bersowir[.]org (#416), brunotasso[.]com[.]br (#413), wisbechguide[.]uk (#408), pescacancun[.]com (#406), bkengineersindia[.]com (#405), englishplusmore[.]com (#404), carnesboinobre[.]com[.]br (#398), technowide[.]com[.]tr (#396), jestertunes[.]com (#393), safecartusa[.]com (#391), foreverfarley[.]com (#387), azezieldraconous[.]com (#381), westernautomobileassembly[.]com (#376) , littleswanaircon[.]com[.]sg (#372), iwan2travel[.]com (#370), applesforfred[.]com (#369), theaerie[.]ca (#367), nico[.]sa (#366), ajstelecom[.]com[.]mx (#362), and others (more than 130 domains since 2021).

Related external source

Screenshot

Click to expand

image
image
99ab9c31-8674-41ab-b61f-e886dcfa7c54
image
image
image
image
image
image
image
image
image
image
image
image
image
image
image

@spirillen spirillen merged commit 6e3c8fc into mitchellkrogza:main Jul 2, 2024
1 check passed
@spirillen
Copy link
Collaborator

Hoping it didn't took to much time to response and merge...

spirillen added a commit to mypdns/matrix that referenced this pull request Jul 2, 2024
Fix #614
Rel: mitchellkrogza/phishing#435

----

Thanks to jetBrains for sponsoring IntelliJ (Ultimate Edition)
For non-commercial open source.
This helps My Privacy DNS to develop tools and maintain the blacklists.

Signed-off-by: Spirillen <pdns@protonmail.com>
@g0d33p3rsec g0d33p3rsec deleted the add-reluzformaturas.com.br-to-wildcard-list branch July 2, 2024 20:31
@g0d33p3rsec
Copy link
Contributor Author

Hoping it didn't took to much time to response and merge...

Your response time was near instantaneous. 😎

iam-py-test added a commit to iam-py-test/my_filters_001 that referenced this pull request Jul 2, 2024
@g0d33p3rsec
Copy link
Contributor Author

I just received a response to my initial abuse ticket. It looks like this domain is being hosted by the same shared provider as #362 which was one of the slower hosts I've worked with thus far.
Screenshot 2024-07-02 194847

spirillen added a commit to mypdns/matrix that referenced this pull request Jul 3, 2024
Fix https://github.com/mypdns/matrix/issues/6130

Rel: mitchellkrogza/phishing#435

----

Thanks to jetBrains for sponsoring IntelliJ (Ultimate Edition)
For non-commercial open source.
This helps My Privacy DNS to develop tools and maintain the blacklists.

Signed-off-by: Spirillen <pdns@protonmail.com>
spirillen added a commit to mypdns/matrix that referenced this pull request Jul 3, 2024
Fix https://github.com/mypdns/matrix/issues/6130

Rel: mitchellkrogza/phishing#435

----

Thanks to jetBrains for sponsoring IntelliJ (Ultimate Edition)
For non-commercial open source.
This helps My Privacy DNS to develop tools and maintain the blacklists.

Signed-off-by: Spirillen <pdns@protonmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants