Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add-domain - phishing (cf) #748

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ninjacatcher
Copy link
Contributor

Phishing Domain/URL/IP(s):

coinomi.is
phamton.is
safepal.llc
sun-io.app
exodus.farm
exodus.kim
exodus.llc
safepal.bid
safepal.one
safepal.page
safepal.zip
tokenpocket.biz
safepal.com.mx
tradingview.la
tokenpocket.ink
exodus.cab
safepal.co.com
safepal.com.mx
metamask-extension.app
metamask-extension.net
safepal.me
safepal.one
web-safepal.com
safepal.ooo
targern.com
tokenpocket.cam
tokenpocket.how
tokenpocket.ink
tokenpocket.llc
v2-safepal.com
app.phanntom.pro
ledjer.cc
legder.cc
ff-info-online.com
trezor-wallet.fr
trustwallet.ing
phantom.ong

Impersonated domain

metamask
coinomi
safepal
exodus
tonkeeper
trustwallet
trezor
ledger
phantom wallet
and various other companies, it would take a long time to list them all.

Describe the issue

Most are exactly the same method of attack described in #694 and #703

Related external source

https://www.virustotal.com/gui/domain/coinomi.is
https://www.virustotal.com/gui/domain/phamton.is
https://www.virustotal.com/gui/domain/safepal.llc
https://www.virustotal.com/gui/domain/sun-io.app
https://www.virustotal.com/gui/domain/exodus.farm
https://www.virustotal.com/gui/domain/exodus.kim
https://www.virustotal.com/gui/domain/exodus.llc
https://www.virustotal.com/gui/domain/safepal.bid
https://www.virustotal.com/gui/domain/safepal.one
https://www.virustotal.com/gui/domain/safepal.page
https://www.virustotal.com/gui/domain/safepal.zip
https://www.virustotal.com/gui/domain/tokenpocket.biz
https://www.virustotal.com/gui/domain/safepal.com.mx
https://www.virustotal.com/gui/domain/tradingview.la
https://www.virustotal.com/gui/domain/tokenpocket.ink
https://www.virustotal.com/gui/domain/exodus.cab
https://www.virustotal.com/gui/domain/safepal.co.com
https://www.virustotal.com/gui/domain/safepal.com.mx
https://www.virustotal.com/gui/domain/metamask-extension.app
https://www.virustotal.com/gui/domain/metamask-extension.net
https://www.virustotal.com/gui/domain/safepal.me
https://www.virustotal.com/gui/domain/safepal.one
https://www.virustotal.com/gui/domain/web-safepal.com
https://www.virustotal.com/gui/domain/safepal.ooo
https://www.virustotal.com/gui/domain/targern.com
https://www.virustotal.com/gui/domain/tokenpocket.cam
https://www.virustotal.com/gui/domain/tokenpocket.how
https://www.virustotal.com/gui/domain/tokenpocket.ink
https://www.virustotal.com/gui/domain/tokenpocket.llc
https://www.virustotal.com/gui/domain/v2-safepal.com
https://www.virustotal.com/gui/domain/app.phanntom.pro
https://www.virustotal.com/gui/domain/ledjer.cc
https://www.virustotal.com/gui/domain/legder.cc
https://www.virustotal.com/gui/domain/ff-info-online.com
https://www.virustotal.com/gui/domain/trezor-wallet.fr
https://www.virustotal.com/gui/domain/trustwallet.ing
https://www.virustotal.com/gui/domain/phantom.ong

Takedown requests from APVA (soon to be available from Netcraft as well):
https://incident.antiphish.org/9f5a1f2766df/
https://incident.antiphish.org/744d18b52175/
https://incident.antiphish.org/76a22a206cfe/
https://incident.antiphish.org/9ee1f640ba7e/
https://incident.antiphish.org/24e870e1c7c7/
https://incident.antiphish.org/8e381377fdfa/
https://incident.antiphish.org/e109a967f45e/
https://incident.antiphish.org/82e3bbbb55bc/
https://incident.antiphish.org/e5be41a3a0f9/
https://incident.antiphish.org/df9b8ddaf181/
https://incident.antiphish.org/0b7444a6c993/
https://incident.antiphish.org/2c405b447f0b/
https://incident.antiphish.org/f97afd1e7a8b/
https://incident.antiphish.org/68469656666f/

Screenshot

Click to expand pls check incident antiphish and netcraft pages for screenshots

@ninjacatcher
Copy link
Contributor Author

@spirillen or @g0d33p3rsec could you remove some duplicate domains from the https://github.com/Phishing-Database/phishing/blob/master/add-domain file ? thx

@spirillen
Copy link
Contributor

My little sort script should be taking care of that, once merged

@g0d33p3rsec are you taking care of @ninjacatcher PR's?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants