├── iok_test.go ├── logsource.yml ├── indicators ├── remitly-47bfa74f.yml ├── bazhanwang-website-copier.yml ├── generic-email-ec34bc68.yml ├── okta-6a6c442.yml ├── shopify-NCv2F.yml ├── shopify-YgjX6.yml ├── royal-mail-dccfe2d7.yml ├── royal-mail-cd74ee99.yml ├── shopify-45ca55e3.yml ├── shopify-c546c6a9.yml ├── hex-encoded-body.yml ├── singlefile.yml ├── etherscan-253344b.yml ├── rot13-encoded-body.yml ├── getform-io.yml ├── formpost-app.yml ├── formspree-io.yml ├── formsubmit-co.yml ├── nocodeform-io.yml ├── actionforms-io.yml ├── twitter-91a19aa.yml ├── form2chat-io.yml ├── facebook-6c79b.yml ├── themetags-template-service.yml ├── webscrapbook-cloner.yml ├── mobirise-website-builder.yml ├── steam-8c89c4f.yml ├── toastrjs-crypto-drainer-0d0f9db.yml ├── metamask-604ec65.yml ├── microsoft-b3fcc7b.yml ├── recaptcha.yml ├── cazanova-cookie.yml ├── ipapi-co.yml ├── facebook-54b8f7e.yml ├── generic-crypto-0694191.yml ├── generic-scam-3ei9ur8a.yml ├── mark-of-the-web.yml ├── anpost-7b94e511.yml ├── coinsbit-a4a01a8.yml ├── paypal-6c455a6.yml ├── dibae-e6f3d238.yml ├── discord-nitro-7a09ee6.yml ├── testcookie-nginx-module.yml ├── credicard-7246c9c.yml ├── royal-mail-GbyBld.yml ├── facebook-pl-5b1aed4d.yml ├── spankki-d612de8e.yml ├── shopify-89NDeg.yml ├── bookmark-grabber-f6a19cec.yml ├── ionos-45d7f514.yml ├── nordpass-79fa7dc3.yml ├── shopify-f7Ejw.yml ├── steam-JcQRrby.yml ├── vystar-creditunion-084ea74.yml ├── 123-reg-63c26.yml ├── banco-falabella-5fed617.yml ├── data-content-attribute-obfuscation.yml ├── facebook-9z3vzzzj2s.yml ├── etc-e623c655.yml ├── webflow-website-creator.yml ├── avis-0fbd3ca.yml ├── base64-encoded-body.yml ├── coinbase-69638f20.yml ├── submit-form-com.yml ├── coinbase-zG3nVT0g.yml ├── santander-d639dea.yml ├── base64-url-encoded-body.yml ├── class-attribute-obfuscation.yml ├── generic-crypto-f634ac3.yml ├── m3dular-ea8f67e.yml ├── trkrsrvrdb-crypto-drainer-14658cf1.yml ├── steam-4540135.yml ├── steam-4f8189ec.yml ├── banco-de-la-nacion-0blz45du.yml ├── fake-chrome-error.yml ├── smbc-10ddf87.yml ├── commbank-d69bdec1.yml ├── santander-951d27d.yml ├── dhl-27b89b9e.yml ├── microsoft-outlook-9e75296.yml ├── account-deletion-countdown.yml ├── smbc-9776441.yml ├── steam-ee34fa99.yml ├── fauxmoralis-6a3cac21.yml ├── luno-exchange-beb8d53.yml ├── transferwise-d777126.yml ├── facebook-83d65db.yml ├── facebook-account-recovery-0e420f8.yml ├── mystic-stealer-88b6ef2f.yml ├── steam-de077e20.yml ├── bbva-dd072db.yml ├── httrack.yml ├── meta-506188c.yml ├── bancolombia-68a8d3f.yml ├── ficohsa-39e336ff.yml ├── spox-chase-8b20b051.yml ├── crew3-crypto-drainer-0827f6e1.yml ├── facebook-2b493308.yml ├── interfisa-banco-rw6n5v.yml ├── microsoft-be5a6fa.yml ├── nuevo-banco-del-chaco-ri0z68ca.yml ├── bookmark-grabber-bf623f6.yml ├── amadey-botnet-afb0c86a.yml ├── fake-crypto-mining-arbitrageProducts.yml ├── santander-85b6cae.yml ├── banco-de-galicia-bd53a32.yml ├── opensea-389-9bec97c22fa2e411.yml ├── steam-tu2yq4ic.yml ├── finesse-crypto-drainer-9c933ae7.yml ├── hsbc-ea738a3.yml ├── pagopa-197bb96bc.yml ├── visa-dff000d.yml ├── facebook-e9da0f06.yml ├── gomorrah-stealer-9bead31e.yml ├── patelco-48ba653f.yml ├── netflix-n3s7h9g2.yml ├── facebook-54b8f7e-landing.yml ├── credicorp-bank-du47yo.yml ├── discord-ee3f9f72.yml ├── banco-davivienda-067fef0.yml ├── rakuten-1f160470.yml ├── smbc-acab82b5.yml ├── webmail-27971b3a.yml ├── scotiabank-76fc8cb.yml ├── m&t-bank-6b1866b8.yml ├── microsoft-EwNaWJpB.yml ├── uol-mail-6xm0cu.yml ├── fake-crypto-mining-inviteRequired.yml ├── banco-de-la-republica-g5d6u78z.yml ├── international-card-services.yml ├── hardteam-crypto-drainer-f42d93a4.yml ├── bank-of-america-a53b161.yml ├── github-helopbs-03d6d129.yml ├── adobe-5c70696.yml ├── banco-del-pacifico-1kzes5jt.yml ├── bbva-k3dums5h.yml ├── fake-crypto-giveaway-cbn4xt8m.yml ├── metamask-06f6d4f9.yml ├── telekom-deutschland-34f36ea7.yml ├── usps-9514901.yml ├── ark-investment-crypto-3465f6c.yml ├── microsoft-tech-support-0589be7.yml ├── microsoft-tech-support-jp-d94c3cf.yml ├── banco-de-galicia-vyk7k7oo.yml ├── facebook-pl-f675021b.yml ├── banco-cuscatlan-sdtltm.yml ├── mygovau-d0a5f9fd.yml ├── 1password-191635.yml ├── banco-promerica-ef73ish1.yml ├── settingsjs-crypto-drainer-d810a56.yml ├── coinbase-5d238ea1.yml ├── instagram-appeal-510emm.yml ├── rhadamanthys-stealer-26461dbb.yml ├── saison-b85570be.yml ├── facebook-07c20f69.yml ├── lokibot-stealer-b5463607.yml ├── coinbase-cf711368.yml ├── microsoft-544eva7.yml ├── office-365-l03ttm.yml ├── discord-664a17b.yml ├── exodus-wallet.yml ├── facebook-vt-887906f.yml ├── fake-crypto-mining-noChrome.yml ├── tuya-redirect-4ewqnc.yml ├── dpd-1550312.yml ├── facebook-appeal-91f3caf.yml ├── instagram-copyright-yzvbov.yml ├── facebook-parachute.yml ├── rusc-crypto-drainer-f4180c6.yml ├── fake-crypto-mining-MiningPool.yml ├── outlook-hco41m.yml ├── microsoft-outlook-142e470f.yml ├── banco-santa-fe-9d6d57a2.yml ├── facebook-pl-7d71c1c.yml ├── tokenup-crypto-scam.yml ├── banco-atlantida-dxde4jyt.yml ├── discord-fake-error-43143a94.yml ├── instagram-ag0soj.yml ├── navyfederal-7fh9xqpk.yml ├── suncoastcu-4c74e401.yml ├── kimsuky-nginx-fake-error-9b43f670.yml ├── valorant-landing-page-7plil474.yml ├── ups-69b689e.yml ├── bbva-aeng1e8e.yml ├── facebook-9dda3b8f.yml ├── discord-9e6c4a9.yml ├── kucoin-8fo0kgp3.yml ├── asli-crypto-drainer-ea8f67e.yml ├── fake-404-page.yml ├── scotiabank-TYnAqzTX.yml ├── pagopa-019638cd.yml ├── bank-of-america-kgzrkd.yml ├── generic-latin-america-bank-c419e0d.yml ├── facebook-d47226ee.yml ├── bancor-5bb0b5u3.yml ├── instagram-tpexkd.yml ├── banco-del-pacifico-bl54hwhz.yml ├── dhl-f8e6d46.yml ├── smu-crypto-drainer-d9da4dc1.yml ├── daviplata-jwl1yd.yml ├── drainer-Iil1il-crypto-scam.yml ├── banco-de-galicia-npy0f6km.yml ├── discord-4ek3us.yml ├── fake-crypto-mining-ReceiveVoucher3.yml ├── roblox-survey-scam-9170a30d.yml ├── imbetter-stealer-1f52021a.yml ├── roblox-8l0pamh6.yml ├── amazon-jp-28bd59a.yml ├── amazon-token-cryptocurrency-scam-shfxgk.yml ├── crypto-monkey-drainer-65ftuybhy.yml ├── fake-crypto-trading-warmReminder.yml ├── amerant-bank-4tfevg.yml ├── fake-crypto-mining-ReceiveVoucher4.yml ├── fake-crypto-mining-ReceiveVoucher.yml ├── fake-crypto-trading-yuebaoIndex.yml ├── generic-crypto-scam-dd1f3101.yml ├── microsoft-fyfcvk8e.yaml ├── banco-de-galicia-2mo4sf.yml ├── valorant-7plil474.yml ├── bookmark-grabber-d7eb986c.yml ├── chenlun-88426540.yml ├── facebook-7c475854.yml ├── mufg-483cbea7.yml ├── discord-oauth2-scam-u8eviyps.yml ├── unibank-njdemh.yml ├── westpac-c5c1bfe0.yml ├── microsoft-rxkr4n3b.yml ├── avvillas-a5lnamb9.yml ├── apple-icloud-467ab986.yml ├── microsoft-zuu2wvfc.yml ├── anz-bank-cd6ec9e7.yml ├── banco-pichincha-niug0z.yml ├── bancolombia-jr5mnv.yml └── bancolombia-nfimdx.yml ├── .github └── workflows │ ├── go.yml │ └── rules.yml ├── go.mod ├── tools └── urlscan-iok │ └── urlscan-iok.go └── urlscanio_test.go /iok_test.go: -------------------------------------------------------------------------------- 1 | package iok 2 | 3 | import "testing" 4 | 5 | // A dummy test just to ensure that the iok.go init functions don't panic 6 | func Test(t *testing.T) {} 7 | -------------------------------------------------------------------------------- /logsource.yml: -------------------------------------------------------------------------------- 1 | title: Sigma config for use with the phish.report/IOK library 2 | backends: 3 | - github.com/bradleyjkemp/sigma-go 4 | 5 | fieldmappings: 6 | title: $.title[*] 7 | js: $.js[*] 8 | css: $.css[*] 9 | cookies: $.cookies[*] 10 | headers: $.headers[*] 11 | requests: $.requests[*] 12 | -------------------------------------------------------------------------------- /indicators/remitly-47bfa74f.yml: -------------------------------------------------------------------------------- 1 | title: Remitly Phishing Kit 47bfa74f 2 | references: 3 | - https://urlscan.io/result/47bfa74f-3efb-4dd1-b9ec-a9a862cf6a5b 4 | 5 | detection: 6 | httrack: 7 | html|contains: "" 8 | 9 | condition: httrack 10 | 11 | tags: 12 | - kit 13 | - target.remitly 14 | -------------------------------------------------------------------------------- /indicators/bazhanwang-website-copier.yml: -------------------------------------------------------------------------------- 1 | title: BazhanWang Website Copier 2 | description: | 3 | Detects the BazhanWang website copier. 4 | 5 | references: 6 | - https://urlscan.io/result/09890a1d-f314-4409-9ce8-75d4980361f5/ 7 | 8 | detection: 9 | 10 | copierSignature: 11 | html|contains: '' 12 | 13 | condition: copierSignature 14 | 15 | tags: 16 | - cloning 17 | -------------------------------------------------------------------------------- /indicators/generic-email-ec34bc68.yml: -------------------------------------------------------------------------------- 1 | title: Generic Email ec34bc68 2 | description: | 3 | A generic email phishing kit loading CSS from an appspot project using a hard-coded access token. 4 | references: 5 | - https://urlscan.io/result/67743b55-f830-49e6-b71e-2fc71e4b8914/ 6 | detection: 7 | bootstrapToken: 8 | requests|contains: 'bootstrap.min.css?alt=media&token=ec34bc68-b721-48e5-a02a-8deed9a44325' 9 | 10 | condition: bootstrapToken 11 | -------------------------------------------------------------------------------- /indicators/okta-6a6c442.yml: -------------------------------------------------------------------------------- 1 | title: Camouflaged Okta kit (old) 2 | description: | 3 | An older version of the Okta phishing kit [described here](https://phish.report/IOK/indicators/okta-5844ad4) 4 | related: 5 | - id: okta-5844ad4 6 | detection: 7 | jsChunks: 8 | requests|contains|all: 9 | - _nuxt/6a6c442.js 10 | - _nuxt/d795c50.js 11 | 12 | condition: jsChunks 13 | 14 | tags: 15 | - kit 16 | - target.okta 17 | -------------------------------------------------------------------------------- /indicators/shopify-NCv2F.yml: -------------------------------------------------------------------------------- 1 | title: Shopify phishing kit NCv2F 2 | description: | 3 | Shopify phishing kit containing a high-entropy CSP nonce which should be a high quality indicator. 4 | references: 5 | - https://urlscan.io/result/63289b3a-190b-494d-8f58-fca3394dc2c9 6 | 7 | detection: 8 | nonce: 9 | html|contains: 'nonce="NCv2FFfdPZWddG+A/Zi5yTs/nZJyLqZDkwaDP81TGJ4="' 10 | 11 | condition: nonce 12 | 13 | tags: 14 | - kit 15 | - target.shopify 16 | -------------------------------------------------------------------------------- /indicators/shopify-YgjX6.yml: -------------------------------------------------------------------------------- 1 | title: Shopify phishing kit YgjX6 2 | description: | 3 | Shopify phishing kit containing a high-entropy CSP nonce which should be a high quality indicator. 4 | references: 5 | - https://urlscan.io/result/a6cfccfc-0f7e-4609-9f29-4d14276813f1 6 | 7 | detection: 8 | nonce: 9 | html|contains: 'nonce="YgjX6ESY7Epmq2JvWnoY7nPjsTKrDju2KP3CtnBB+ds="' 10 | 11 | condition: nonce 12 | 13 | tags: 14 | - kit 15 | - target.shopify 16 | -------------------------------------------------------------------------------- /indicators/royal-mail-dccfe2d7.yml: -------------------------------------------------------------------------------- 1 | title: Royal Mail Phishing Kit dccfe2d7 2 | description: | 3 | Detects a Royal Mail phishing kit claiming that "a parcel cost £ 0.9 Payment failed" 4 | 5 | references: 6 | - https://urlscan.io/result/2e24e3be-de40-4eb4-bae3-7365c0076902 7 | 8 | detection: 9 | selection: 10 | requests|contains: app.dccfe2d7.css 11 | condition: selection 12 | 13 | tags: 14 | - kit 15 | - target.royal-mail 16 | - target_country.uk 17 | -------------------------------------------------------------------------------- /indicators/royal-mail-cd74ee99.yml: -------------------------------------------------------------------------------- 1 | title: Royal Mail Phishing Kit cd74ee99 2 | description: | 3 | Detects a Royal Mail phishing kit claiming that there are "issues with your shipping address" 4 | 5 | references: 6 | - https://urlscan.io/result/739b68d2-fd6b-460c-b9b3-7256b3c3cd07 7 | 8 | detection: 9 | selection: 10 | requests|contains: app.cd74ee99.css 11 | condition: selection 12 | 13 | tags: 14 | - kit 15 | - target.royal-mail 16 | - target_country.uk 17 | -------------------------------------------------------------------------------- /indicators/shopify-45ca55e3.yml: -------------------------------------------------------------------------------- 1 | title: Shopify phishing kit 45ca55e3 2 | description: | 3 | Shopify phishing kit containing a high-entropy device identifier which should be a high quality indicator. 4 | references: 5 | - https://urlscan.io/result/ad736505-fb24-4ecd-9b94-3dc301608371 6 | 7 | detection: 8 | deviceID: 9 | html|contains: 'data-trekkie-device-id="45ca55e3-e43e-4b13-b123-6d86ca72d41a"' 10 | 11 | condition: deviceID 12 | 13 | tags: 14 | - kit 15 | - target.shopify 16 | -------------------------------------------------------------------------------- /indicators/shopify-c546c6a9.yml: -------------------------------------------------------------------------------- 1 | title: Shopify phishing kit c546c6a9 2 | description: | 3 | Shopify phishing kit containing a high-entropy device identifier which should be a high quality indicator. 4 | references: 5 | - https://urlscan.io/result/401d6161-cb5d-4e15-a9ac-20cf0a3ba857 6 | 7 | detection: 8 | deviceID: 9 | html|contains: 'data-trekkie-device-id="c546c6a9-c197-40d4-817c-9fc681c519e9"' 10 | 11 | condition: deviceID 12 | 13 | tags: 14 | - kit 15 | - target.shopify 16 | -------------------------------------------------------------------------------- /indicators/hex-encoded-body.yml: -------------------------------------------------------------------------------- 1 | title: Hex-encoded document body 2 | description: | 3 | To evade static analysis, the document body can returned hex encoded in the response 4 | where JavaScript can decode it and append it to the DOM. 5 | 6 | This helps defeat simple scanners which don't evaluate JavaScript. 7 | 8 | detection: 9 | documentWriteUnescape: 10 | html|contains: "document.write(unescape(" 11 | 12 | condition: documentWriteUnescape 13 | 14 | tags: 15 | - anti-analysis 16 | -------------------------------------------------------------------------------- /indicators/singlefile.yml: -------------------------------------------------------------------------------- 1 | title: SingleFile website cloner 2 | description: | 3 | SingleFile is a Chrome extension allowing you to save a complete webpage (HTML, CSS, JS, etc.) into a single file. 4 | 5 | references: 6 | - https://chrome.google.com/webstore/detail/singlefile/mpiodijhokgodhhofbcjdecpffjipkle?hl=en 7 | 8 | detection: 9 | singlefileComment: 10 | html|contains: 11 | - "Page saved with SingleFile" 12 | condition: singlefileComment 13 | 14 | tags: 15 | - cloning 16 | -------------------------------------------------------------------------------- /indicators/etherscan-253344b.yml: -------------------------------------------------------------------------------- 1 | title: Etherscan Crypto Phishing Kit 253344b 2 | description: | 3 | Detects a phishing kit targeting users of Etherscan. 4 | 5 | references: 6 | - https://urlscan.io/result/253344bb-8f9f-4ac6-8449-a2730776d9b6 7 | 8 | detection: 9 | 10 | jsCode: 11 | js|contains: 'api.php?sendValue' 12 | 13 | localStorageItem: 14 | js|contains: 'urcheckacstate' 15 | 16 | condition: jsCode and localStorageItem 17 | 18 | tags: 19 | - kit 20 | - target.etherscan 21 | -------------------------------------------------------------------------------- /.github/workflows/go.yml: -------------------------------------------------------------------------------- 1 | name: Go 2 | on: 3 | push: 4 | branches: [ main ] 5 | pull_request: 6 | branches: [ main ] 7 | 8 | jobs: 9 | build-and-test: 10 | name: Unit tests 11 | runs-on: ubuntu-latest 12 | steps: 13 | - name: Set up Go 1.x 14 | uses: actions/setup-go@v2 15 | with: 16 | go-version: ^1.18 17 | 18 | - name: Check out code into the Go module directory 19 | uses: actions/checkout@v2 20 | 21 | - name: Test 22 | run: go test -v ./... 23 | -------------------------------------------------------------------------------- /indicators/rot13-encoded-body.yml: -------------------------------------------------------------------------------- 1 | title: rot13 encoded body 2 | description: | 3 | To evade static analysis, the document body can returned with each character rotated by 4 | some fixed amount in the response where JavaScript can decode it and append it to the DOM. 5 | 6 | This helps defeat simple scanners which don't evaluate JavaScript. 7 | 8 | detection: 9 | characterRotation: 10 | html|contains: "String.fromCharCode(s.charCodeAt(i)-1)" 11 | 12 | condition: characterRotation 13 | 14 | tags: 15 | - anti-analysis 16 | -------------------------------------------------------------------------------- /indicators/getform-io.yml: -------------------------------------------------------------------------------- 1 | title: Exfiltration using getform.io 2 | description: | 3 | getform is a service that takes HTML form submissions and sends the results to an email address. 4 | 5 | It can be used by threat actors building "serverless" phishing pages i.e. where they don't have a backend server that can send emails or store logs. 6 | related: 7 | - id: formspree-io 8 | 9 | detection: 10 | formAction: 11 | html|contains: "action=\"https://getform.io/f/" 12 | condition: formAction 13 | 14 | tags: 15 | - exfiltration 16 | -------------------------------------------------------------------------------- /indicators/formpost-app.yml: -------------------------------------------------------------------------------- 1 | title: Exfiltration using formpost.app 2 | description: | 3 | formpost.app is a service that takes HTML form submissions and sends the results to an email address. 4 | 5 | It can be used by threat actors building "serverless" phishing pages i.e. where they don't have a backend server that can send emails or store logs. 6 | related: 7 | - id: getform-io 8 | 9 | detection: 10 | formAction: 11 | html|contains: "action=\"https://formpost.app/" 12 | condition: formAction 13 | 14 | tags: 15 | - exfiltration 16 | -------------------------------------------------------------------------------- /indicators/formspree-io.yml: -------------------------------------------------------------------------------- 1 | title: Exfiltration using formspree.io 2 | description: | 3 | Formspree is a service that takes HTML form submissions and sends the results to an email address. 4 | 5 | It can be used by threat actors building "serverless" phishing pages i.e. where they don't have a backend server that can send emails or store logs. 6 | related: 7 | - id: getform-io 8 | 9 | detection: 10 | formAction: 11 | html|contains: "action=\"https://formspree.io/f/" 12 | condition: formAction 13 | 14 | tags: 15 | - exfiltration 16 | -------------------------------------------------------------------------------- /indicators/formsubmit-co.yml: -------------------------------------------------------------------------------- 1 | title: Exfiltration using FormSubmit.co 2 | description: | 3 | FormSubmit is a service that takes HTML form submissions and sends the results to an email address. 4 | 5 | It can be used by threat actors building "serverless" phishing pages i.e. where they don't have a backend server that can send emails or store logs. 6 | related: 7 | - id: getform-io 8 | 9 | detection: 10 | formAction: 11 | html|contains: "action=\"https://formsubmit.co/" 12 | condition: formAction 13 | 14 | tags: 15 | - exfiltration 16 | -------------------------------------------------------------------------------- /indicators/nocodeform-io.yml: -------------------------------------------------------------------------------- 1 | title: Exfiltration using NoCodeForm 2 | description: | 3 | NoCodeForm is a service that takes HTML form submissions and sends the results to an email address. 4 | 5 | It can be used by threat actors building "serverless" phishing pages i.e. where they don't have a backend server that can send emails or store logs. 6 | related: 7 | - id: getform-io 8 | 9 | detection: 10 | formAction: 11 | html|contains: "action=\"https://nocodeform.io/f/" 12 | condition: formAction 13 | 14 | tags: 15 | - exfiltration 16 | -------------------------------------------------------------------------------- /indicators/actionforms-io.yml: -------------------------------------------------------------------------------- 1 | title: Exfiltration using ActionForms 2 | description: | 3 | ActionForms is a service that takes HTML form submissions and sends the results to an email address. 4 | 5 | It can be used by threat actors building "serverless" phishing pages i.e. where they don't have a backend server that can send emails or store logs. 6 | related: 7 | - id: getform-io 8 | 9 | detection: 10 | formAction: 11 | html|contains: "action=\"https://www.actionforms.io/e/r/" 12 | condition: formAction 13 | 14 | tags: 15 | - exfiltration 16 | -------------------------------------------------------------------------------- /indicators/twitter-91a19aa.yml: -------------------------------------------------------------------------------- 1 | title: Twitter Phishing Kit 91a19aa 2 | description: | 3 | Detects a phishing kit developed by a Turkish actor 4 | targeting users of Twitter. 5 | 6 | detection: 7 | pageFavicon: 8 | html|contains: 'https://www.imajkoruma.com/wp-content/uploads/2019/02/twitter.png' 9 | 10 | formDefinition: 11 | html|contains|all: 12 | - 'name="girisFormu"' 13 | - 'action="login.php"' 14 | 15 | condition: pageFavicon and formDefinition 16 | 17 | tags: 18 | - kit 19 | - target.twitter 20 | -------------------------------------------------------------------------------- /indicators/form2chat-io.yml: -------------------------------------------------------------------------------- 1 | title: Exfiltration using Form2Chat 2 | description: | 3 | Form2Chat is a service that takes HTML form submissions and sends the results to an email address or instant messenger service. 4 | 5 | It can be used by threat actors building "serverless" phishing pages i.e. where they don't have a backend server that can send emails or store logs. 6 | related: 7 | - id: getform-io 8 | 9 | detection: 10 | formAction: 11 | html|contains: "https://app.form2chat.io/f/" 12 | condition: formAction 13 | 14 | tags: 15 | - exfiltration 16 | -------------------------------------------------------------------------------- /indicators/facebook-6c79b.yml: -------------------------------------------------------------------------------- 1 | title: Facebook intellectual property infringment phishing kit 6c79b 2 | description: | 3 | A Facebook phishing kit themed around intellectual property infringement 4 | 5 | Observed being distributed by emailtosalesforce@[...].salesforce.com email addresses 6 | references: 7 | - https://urlscan.io/result/4bedbfd8-31f2-4719-85a5-069b72e266fd/ 8 | 9 | detection: 10 | background: 11 | requests|contains: 'banner.6c79bf718e7d7de19193.png' 12 | 13 | condition: background 14 | 15 | tags: 16 | - kit 17 | - target.facebook 18 | -------------------------------------------------------------------------------- /indicators/themetags-template-service.yml: -------------------------------------------------------------------------------- 1 | title: ThemeTags Template Service 2 | description: | 3 | Detects page templates made by ThemeTags. 4 | Services like this are commonly abused by phishing pages. 5 | 6 | references: 7 | - https://urlscan.io/result/54b8f7ec-22f8-416f-b253-213d28262587 8 | - https://urlscan.io/result/d45ebbf2-ecf0-4a83-a908-7c7d08522d1c 9 | 10 | detection: 11 | 12 | metaTagSig: 13 | html|contains: 'name="author" content="ThemeTags"' 14 | 15 | condition: metaTagSig 16 | 17 | tags: 18 | - template_service.themetags 19 | -------------------------------------------------------------------------------- /indicators/webscrapbook-cloner.yml: -------------------------------------------------------------------------------- 1 | title: WebScrapBook website cloner 2 | description: | 3 | WebScrapBook is a chrome extension used by phishers to clone target websites. 4 | 5 | Github: https://github.com/danny0838/webscrapbook 6 | 7 | references: 8 | - https://chrome.google.com/webstore/detail/webscrapbook/oegnpmiddfljlloiklpkeelagaeejfai 9 | 10 | related: 11 | - id: httrack 12 | - id: savepage-we 13 | 14 | detection: 15 | 16 | htmlAttribute: 17 | html|contains: "data-scrapbook" 18 | 19 | condition: htmlAttribute 20 | 21 | tags: 22 | - cloning 23 | -------------------------------------------------------------------------------- /indicators/mobirise-website-builder.yml: -------------------------------------------------------------------------------- 1 | title: Mobirise Website Builder 2 | description: | 3 | Detects signatures left behind by the Mobirise Website Builder. 4 | 5 | references: 6 | - https://mobirise.com 7 | - https://urlscan.io/result/0fbd3caa-14be-4565-ad9f-d11d7ec0fdf5 8 | 9 | detection: 10 | 11 | mobiriseSignature: 12 | html|contains|all: 13 | - 'Site made with Mobirise Website Builder' 14 | - 'https://mobirise.com' 15 | 16 | condition: mobiriseSignature 17 | 18 | tags: 19 | - website_builder 20 | - website_builder.mobirise 21 | -------------------------------------------------------------------------------- /indicators/steam-8c89c4f.yml: -------------------------------------------------------------------------------- 1 | title: Steam Phishing Kit 8c89c4f 2 | description: | 3 | Steam phishing kit containing an image URL that only appears in phishing pages, 4 | additionally uses Discord Nitro as a lure. 5 | 6 | references: 7 | - https://urlscan.io/search/#hash%3A8c89c4f3023d02b04197a30ca20f42ca7eb2634e1432ffff7b9d641a1f71a066 8 | 9 | detection: 10 | 11 | image: 12 | html|contains: 'https://cdn.discordapp.com/attachments/818120722869911602/883999740071657542/nitro.png' 13 | 14 | condition: image 15 | 16 | tags: 17 | - kit 18 | - target.steam 19 | -------------------------------------------------------------------------------- /indicators/toastrjs-crypto-drainer-0d0f9db.yml: -------------------------------------------------------------------------------- 1 | title: ToastrJS Crypto Drainer 0d0f9db 2 | description: | 3 | Detects a crypto drainer. 4 | 5 | references: 6 | - https://urlscan.io/result/0d0f9dbc-de02-4ba7-b141-90938b828c82 7 | - https://urlscan.io/result/d83511c9-e75f-4b58-a06f-6b093eed01d3 8 | 9 | detection: 10 | 11 | fileName: 12 | requests|contains: 'toastr.js' 13 | 14 | faviconSrc: 15 | html|contains: 'bootcs.com/fav.ico' 16 | 17 | condition: fileName and faviconSrc 18 | 19 | tags: 20 | - cryptocurrency 21 | - cryptocurrency.ethereum 22 | -------------------------------------------------------------------------------- /indicators/metamask-604ec65.yml: -------------------------------------------------------------------------------- 1 | title: Metamask Phishing Kit 604ec65 2 | description: | 3 | Metamask Phishing kit that uses WebFlow. 4 | Allowing us to flag it due to it having the same WebFlow site key for each phish. 5 | 6 | references: 7 | - https://urlscan.io/result/8953ff2a-f891-40cb-9310-7edab6f0876a 8 | - https://urlscan.io/result/b4830e43-ef8c-40ac-b4d7-ddf540f2c43b 9 | 10 | detection: 11 | 12 | webFlowSiteKey: 13 | html|contains: 'data-wf-site="604ec65d7935b45ce251b35e"' 14 | 15 | condition: webFlowSiteKey 16 | 17 | tags: 18 | - kit 19 | - target.metamask 20 | -------------------------------------------------------------------------------- /indicators/microsoft-b3fcc7b.yml: -------------------------------------------------------------------------------- 1 | title: Microsoft Phishing Kit b3fcc7b 2 | description: | 3 | Detects a Microsoft phishing kit targeting 4 | Spanish speaking users. 5 | 6 | references: 7 | - https://urlscan.io/result/b3fcc7b6-3193-418a-8a8c-0989d448fb94 8 | 9 | detection: 10 | 11 | hiddenFormID: 12 | html|contains: 'idmedu129' 13 | 14 | formElementIDs: 15 | html|contains|all: 16 | - 'nm1' 17 | - 'nm2' 18 | - 'contenido1' 19 | 20 | condition: hiddenFormID and formElementIDs 21 | 22 | tags: 23 | - kit 24 | - target.microsoft 25 | -------------------------------------------------------------------------------- /indicators/recaptcha.yml: -------------------------------------------------------------------------------- 1 | title: reCAPTCHA 2 | description: To make it harder to analysts to get a good capture of a phishing site, some are using Google's reCAPTCHA service. 3 | references: 4 | - https://developers.google.com/recaptcha/docs/display 5 | 6 | detection: 7 | buttonElement: 8 | html|contains|all: 9 | - "g-recaptcha" 10 | - "data-sitekey" 11 | 12 | programmaticInvoke: 13 | js|contains: 14 | - "grecaptcha.execute(" 15 | - "grecaptcha.render(" 16 | 17 | condition: buttonElement or programmaticInvoke 18 | 19 | tags: 20 | - anti-analysis 21 | -------------------------------------------------------------------------------- /indicators/cazanova-cookie.yml: -------------------------------------------------------------------------------- 1 | title: Cazanova Phishing Kit 2 | description: | 3 | Cazanova is the alias of a prolific phishing kit creator. 4 | Lucky for us, they like to sign their work by using `cazanova` for their cookie name rather than the default `PHPSESSID`, 5 | which makes it simple to identify their work. 6 | 7 | references: 8 | - https://www.wmcglobal.com/blog/cazanova-morphine-kit-deep-dive 9 | 10 | detection: 11 | 12 | cazanovaCookie: 13 | cookies|startswith: "cazanova=" 14 | 15 | condition: cazanovaCookie 16 | 17 | tags: 18 | - kit 19 | - threat_actor.cazanova 20 | -------------------------------------------------------------------------------- /indicators/ipapi-co.yml: -------------------------------------------------------------------------------- 1 | title: ipapi 2 | description: | 3 | ipapi is a GeoIP service allowing you to get the country code and other information from an IP address. It's regularly used by phishing kits which want to hide themselves to analysts outside the country they're targeting. 4 | 5 | This is a very naive approach (often the entire phishing site is loaded but then immediately redirected away from), but is often enough to evade basic sandboxes. 6 | 7 | detection: 8 | ipapiLookup: 9 | html|contains: "https://ipapi.co/" 10 | 11 | condition: ipapiLookup 12 | 13 | tags: 14 | - cloaking 15 | -------------------------------------------------------------------------------- /indicators/facebook-54b8f7e.yml: -------------------------------------------------------------------------------- 1 | title: Facebook Phishing Kit 54b8f7e 2 | description: | 3 | Detects a Facebook phishing kit. 4 | 5 | references: 6 | - https://urlscan.io/result/d45ebbf2-ecf0-4a83-a908-7c7d08522d1c 7 | 8 | detection: 9 | 10 | formExfil: 11 | html|contains: 'rek.php' 12 | 13 | styleSheets: 14 | requests|contains|all: 15 | - 'becak.css' 16 | - 'galon.css' 17 | 18 | logoImage: 19 | requests|contains: 'https://i.ibb.co/T19ghq4/789.png' 20 | 21 | condition: formExfil and styleSheets and logoImage 22 | 23 | tags: 24 | - kit 25 | - target.facebook 26 | -------------------------------------------------------------------------------- /indicators/generic-crypto-0694191.yml: -------------------------------------------------------------------------------- 1 | title: Generic Crypto Phishing Kit 0694191 2 | description: | 3 | Generic Crypto Scam phishing kit that includes a reference to 4 | the owner of the website via a HTML link tag 5 | 6 | references: 7 | - https://urlscan.io/result/8773a4dc-ccea-49f4-9d35-f907b76d662e 8 | - https://urlscan.io/result/0895fbf8-8802-49d3-8f5f-2e40df0ad1fa 9 | 10 | detection: 11 | 12 | relLinkBack: 13 | html|contains: 'https://www.blogger.com/profile/06941916716624837130' 14 | 15 | condition: relLinkBack 16 | 17 | tags: 18 | - kit 19 | - target.binance 20 | - target.tesla 21 | -------------------------------------------------------------------------------- /indicators/generic-scam-3ei9ur8a.yml: -------------------------------------------------------------------------------- 1 | title: generic-scam-3ei9ur8a 2 | description: Generic scam in the form of a fake news page. Often hosted on pages.dev. 3 | 4 | references: 5 | - https://urlscan.io/result/3c7ccd8c-1119-4cbd-8ae5-7764347e1c95 6 | - https://urlscan.io/result/70980d2c-3436-44d7-8fe5-52b39a5ee771 7 | - https://urlscan.io/result/89602dcc-1ac4-4820-a65e-4f2077bbbaa2 8 | 9 | detection: 10 | pageTitle: 11 | title: 12 | - "Work At Home Special Report!" 13 | pageContains: 14 | html|contains: "Home Profit System" 15 | condition: pageTitle and pageContains 16 | 17 | tags: 18 | - kit 19 | -------------------------------------------------------------------------------- /indicators/mark-of-the-web.yml: -------------------------------------------------------------------------------- 1 | title: Mark of the Web 2 | description: | 3 | The "Mark of the Web" is an Internet Explorer compatibility feature inserted into HTML by browsers when using their "Save webpage" feature. 4 | 5 | The comment includes the original URL that the HTML was cloned from. 6 | references: 7 | - https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/ms537628(v=vs.85)?redirectedfrom=MSDN#what-is-the-mark-of-the-web 8 | 9 | detection: 10 | motw: 11 | html|contains: "' 17 | 18 | nonceCSP: 19 | html|contains: 'nonce="MjE2LDE0MCwxNzgsMTgwLDY1LDEwOCwxNCwyMjQ="' 20 | 21 | condition: developerSignature and nonceCSP 22 | 23 | tags: 24 | - kit 25 | - target.discord 26 | - threat_actor.strolly 27 | -------------------------------------------------------------------------------- /indicators/kucoin-8fo0kgp3.yml: -------------------------------------------------------------------------------- 1 | title: KuCoin Phishing Kit 8fo0kgp3 2 | description: | 3 | Detects a KuCoin phishing kit deployed often on replit.com. 4 | 5 | references: 6 | - https://urlscan.io/result/768a3795-b37c-44c4-9ff3-8bd14dc0ec97 7 | 8 | detection: 9 | 10 | title: 11 | html|contains: 12 | - Iniciar Sesión | KuCoin 13 | 14 | form: 15 | html|contains|all: 16 | - form action="step.php" method="post" 17 | - class="cointer" 18 | 19 | loginEmail: 20 | html|contains|all: 21 | - Celular 22 | - Email 23 | - con codigo QR 24 | 25 | loginPhone: 26 | html|contains|all: 27 | - Celular 28 | - Email 29 | - con codigo QR 30 | 31 | condition: title and form and (loginEmail or loginPhone) 32 | 33 | tags: 34 | - kit 35 | - target.kucoin 36 | - target_country.argentina 37 | -------------------------------------------------------------------------------- /indicators/asli-crypto-drainer-ea8f67e.yml: -------------------------------------------------------------------------------- 1 | title: Asli Crypto Drainer ea8f67e 2 | description: | 3 | Detects a family of crypto drainers that utilises 4 | a similarly structured landing page. 5 | 6 | references: 7 | - https://urlscan.io/result/f930ba09-8c22-4b4f-8cfe-6506e1f01bfb 8 | - https://urlscan.io/result/168274a9-c66b-44c3-b7f8-ce6412a9b2d7 9 | 10 | detection: 11 | 12 | jQueryHash: 13 | html|contains: '894YE6QWD5I59HgZOGReFYm4dnWc1Qt5NtvYSaNcOP+u1T9qYdvdihz0PPSiiqn/+/3e7Jo4EaG7TubfWGUrMQ==' 14 | 15 | fakeTimeElement: 16 | html|contains: '' 17 | 18 | fakeText: 19 | html|contains|all: 20 | - 'PRE-SALE IS LIVE' 21 | - 'LIMITED SALE' 22 | - 'All other links are FAKE' 23 | - 'Thank you for your support and patience!' 24 | 25 | 26 | condition: jQueryHash and fakeTimeElement and fakeText 27 | 28 | tags: 29 | - threat_actor_country.china 30 | - crypto_drainer.asli 31 | - cryptocurrency 32 | - cryptocurrency.ethereum 33 | -------------------------------------------------------------------------------- /tools/urlscan-iok/urlscan-iok.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import ( 4 | "context" 5 | "flag" 6 | "fmt" 7 | "log" 8 | "net/http" 9 | "os" 10 | "os/signal" 11 | "syscall" 12 | 13 | iok "phish.report/IOK" 14 | ) 15 | 16 | var uuid = flag.String("uuid", "", "[required] the urlscan.io result ID to scan for IOKs") 17 | 18 | func main() { 19 | flag.Parse() 20 | if *uuid == "" { 21 | flag.Usage() 22 | os.Exit(1) 23 | } 24 | 25 | ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGTERM) 26 | defer cancel() 27 | input, err := iok.InputFromURLScan(ctx, *uuid, http.DefaultClient) 28 | if err != nil { 29 | log.Fatal(err) 30 | } 31 | 32 | matches, err := iok.GetMatches(input) 33 | if err != nil { 34 | log.Fatal(err) 35 | } 36 | 37 | if len(matches) == 0 { 38 | fmt.Println("No matches!") 39 | return 40 | } 41 | 42 | fmt.Println("Matching indicators:") 43 | for _, match := range matches { 44 | fmt.Println("\t*", match.Title, "https://phish.report/IOK/indicators/"+match.ID) 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /indicators/fake-404-page.yml: -------------------------------------------------------------------------------- 1 | title: Fake Not Found page 2 | description: | 3 | A common way for phishing sites to avoid detection is by presenting a fake 404 error page when requested using the "wrong" User Agent (or from the wrong GeoIP location). 4 | 5 | These fake error pages exactly mimic the HTML of an Apache 404 page, but unless the threat actor has configured their site to hide it, there's two giveaways it's fake: 6 | - It sends an `X-Powered-By: PHP` header 7 | - It sets a `PHPSESSID` cookie 8 | 9 | These are both clear evidence that the 404 page has been generated by PHP and not by Apache. 10 | 11 | detection: 12 | notfoundPageFragments: 13 | html|contains: 14 | - "404 Not Found" 15 | - "

The requested URL was not found on this server.

" 16 | 17 | phpHeader: 18 | headers|contains: "X-Powered-By: PHP" 19 | 20 | phpCookie: 21 | cookies|startswith: "PHPSESSID=" 22 | 23 | condition: notfoundPageFragments and (1 of php*) 24 | 25 | tags: 26 | - cloaking 27 | -------------------------------------------------------------------------------- /indicators/scotiabank-TYnAqzTX.yml: -------------------------------------------------------------------------------- 1 | title: Bank of Nova Scotia (Scotiabank) Phishing Kit TYnAqzTX 2 | description: | 3 | Detects a phishing kit for the Bank of Nova Scotia (Scotiabank) targeting Spanish speaking users. 4 | Deployed often on replit.com. 5 | 6 | references: 7 | - https://www.scotiaonline.scotiabank.com/ 8 | - https://urlscan.io/result/1ec9979c-a03d-4466-9696-747e522b07d7/ 9 | - https://urlscan.io/result/cb65e495-fc75-4536-94be-7831e04c4124/ 10 | - https://urlscan.io/result/f3dd32bb-281d-4559-8679-2d287a26e7fd/ 11 | 12 | detection: 13 | 14 | img: 15 | html|contains|all: 16 | - img src="img/war.svg" 17 | - img src="img/ojo.svg" 18 | - img src="img/depart.svg" 19 | 20 | script: 21 | html|contains: 22 | - script src="js/funciones.js" 23 | 24 | form: 25 | html|contains: 26 | -
27 | 28 | condition: img and script and form 29 | 30 | tags: 31 | - kit 32 | - target.scotiabank 33 | -------------------------------------------------------------------------------- /urlscanio_test.go: -------------------------------------------------------------------------------- 1 | package iok 2 | 3 | import ( 4 | "context" 5 | "github.com/bradleyjkemp/cupaloy/v2" 6 | "net/http" 7 | "sort" 8 | "testing" 9 | ) 10 | 11 | func TestInputFromURLScan(t *testing.T) { 12 | tests := []string{ 13 | "be1f3938-ec14-4c0e-8f0a-45fb1ea423b3", 14 | "55545c59-1b1c-452b-9b33-0b5d63a0d825", 15 | } 16 | for _, tt := range tests { 17 | t.Run(tt, func(t *testing.T) { 18 | input, err := InputFromURLScan(context.Background(), tt, http.DefaultClient) 19 | if err != nil { 20 | t.Fatal(err) 21 | } 22 | 23 | // because resources are fetched in parallel the output is non-deterministic, so we need to sort each field 24 | sortField(input.Title) 25 | sortField(input.JS) 26 | sortField(input.CSS) 27 | sortField(input.Cookies) 28 | sortField(input.Headers) 29 | sortField(input.Requests) 30 | 31 | cupaloy.SnapshotT(t, input) 32 | }) 33 | } 34 | } 35 | 36 | func sortField(f []string) { 37 | sort.Slice(f, func(i, j int) bool { 38 | return f[i] < f[j] 39 | }) 40 | } 41 | -------------------------------------------------------------------------------- /indicators/pagopa-019638cd.yml: -------------------------------------------------------------------------------- 1 | title: PagoPA Phishing Kit 019638cd 2 | description: | 3 | Detects sites that mimic the payment process of the PagoPA platform established by the Italian Government for payments to public administrations. 4 | The kit uses the Cleave JS library to validate credit card numbers and dates. 5 | first_seen: 2025-04-14 6 | references: 7 | - https://cert-agid.gov.it/wp-content/uploads/2025/04/pagoPA.json 8 | - https://urlscan.io/result/019638cd-0a40-76fc-8fe0-4bcd550f9c0f 9 | - https://urlscan.io/result/01963b32-dccf-75d1-bfc9-00807a035688 10 | 11 | detection: 12 | 13 | requestsContent: 14 | requests|contains: 'cleave.min.js' 15 | 16 | jsContent: 17 | js|contains: 'function isInputNumber(evt)' 18 | 19 | domContents: 20 | dom|contains|all: 21 | - 'pagamento' 22 | - 'pagopa' 23 | - 'action="logz/log.php"' 24 | 25 | condition: requestsContent and jsContent and domContents 26 | 27 | tags: 28 | - kit 29 | - target_country.italy 30 | - target.pagopa 31 | -------------------------------------------------------------------------------- /indicators/bank-of-america-kgzrkd.yml: -------------------------------------------------------------------------------- 1 | title: Bank of America Phishing Kit kgzRkD 2 | description: | 3 | Detects a phishing kit targeting Bank of America. This kit is already detected by Urlscan. 4 | Found as a result of it being deployed on Replit. 5 | 6 | 7 | references: 8 | - https://urlscan.io/result/928c09f2-1a08-4a13-a76e-4c8c5e741063/ 9 | - https://urlscan.io/result/3377f34c-fa5a-4171-8ea4-6501c3b70c9b/ 10 | 11 | detection: 12 | 13 | title: 14 | html|contains: 15 | - Bank of America | Online Banking | DebitCard Information 16 | 17 | css: 18 | html|contains|all: 19 | - .fondo{ background:url(prin.png); background-repeat:no-repeat; } 20 | - ".Sign #button:hover{background:url(BotonAzul.png)}" 21 | 22 | form: 23 | html|contains: 24 | - form method="post" action="conplas/sando.php" autocomplete="off" 25 | 26 | 27 | condition: title and css and form 28 | 29 | tags: 30 | - kit 31 | - target.bank_of_america 32 | - target_country.usa 33 | -------------------------------------------------------------------------------- /indicators/generic-latin-america-bank-c419e0d.yml: -------------------------------------------------------------------------------- 1 | title: Generic Latin America Bank Phishing Kit c419e0d 2 | description: | 3 | Detects a phishing kit targeting banks for Latin America, 4 | these kits are often deployed on `replit.com`. 5 | It uses `api.ipify.org` to fetch the victim's IP. 6 | Harvested credentials are delivered into the scammer's Telegram channel 7 | through the use of the `sax.js` script file. 8 | 9 | references: 10 | - https://urlscan.io/result/eec45a86-7b2e-4924-9d2a-70164653692e/ 11 | - https://urlscan.io/result/c419e0d3-1a0d-49f3-814d-211027d681c8 12 | 13 | detection: 14 | 15 | ipDisplay: 16 | html|contains|all: 17 | - '$("#ip")' 18 | - 'id="gfg"' 19 | - 'id="address"' 20 | 21 | formFunction: 22 | html|contains: 'onsubmit="return sender()"' 23 | 24 | scriptFile: 25 | html|contains: 'src="js/sax.js"' 26 | 27 | condition: ipDisplay and formFunction and scriptFile 28 | 29 | tags: 30 | - kit 31 | - target_region.latin_america 32 | -------------------------------------------------------------------------------- /indicators/facebook-d47226ee.yml: -------------------------------------------------------------------------------- 1 | title: Facebook Phishing Kit d47226ee 2 | description: | 3 | Facebook (Meta for Business) phishing kit 4 | that communicates with a master server/API 5 | in order to exfiltrate credentials entered. 6 | 7 | This kit has several anti analysis capabilities, 8 | such as being able to redirect to a non-existent 9 | domain if the organization owning the IP address 10 | of the viewer is part of a pre-defined list, which 11 | is defined in the javascript code. 12 | 13 | references: 14 | - https://urlscan.io/result/d47226ee-0e03-4978-a9b8-1719ed43cfa4 15 | - https://urlscan.io/result/3291f27f-c62d-4713-877c-91e7085af833 16 | 17 | detection: 18 | 19 | kitAssets: 20 | requests|contains|all: 21 | - '62b0718b3254f2a8ab0f.png' 22 | - 'montserrat-latin-400-normal.acb6629fe45c43ad5d8b.woff2' 23 | 24 | kitAPI: 25 | requests|contains: 'flexflex.online' 26 | 27 | condition: kitAssets and kitAPI 28 | 29 | tags: 30 | - kit 31 | - target.facebook 32 | -------------------------------------------------------------------------------- /indicators/bancor-5bb0b5u3.yml: -------------------------------------------------------------------------------- 1 | title: Bancor Phishing Kit 5bb0b5u3 2 | description: | 3 | Detects a Bancor phishing kit deployed often on replit.com. 4 | 5 | references: 6 | - https://urlscan.io/result/2f5aad26-8754-4dc7-98c7-019b2848c329 7 | - https://urlscan.io/result/4900ffe0-f28f-4f46-a4c0-2f8fe5484a14 8 | - https://urlscan.io/result/fa1931a0-fc51-45b0-8fb3-059d472066e6/ 9 | - https://urlscan.io/result/edb68cb2-dd60-4ef1-b812-442855064cd8/ 10 | 11 | detection: 12 | 13 | form: 14 | html|contains|all: 15 | - form id="maleeye" 16 | - action="clave.php" 17 | 18 | css: 19 | html|contains: 20 | - href="./complementos/main.css" 21 | 22 | img: 23 | requests|contains|all: 24 | - complementos/img/Logo-Bancor.png 25 | - complementos/img/user-login.png 26 | - complementos/img/_DSC0103-HDR.jpg 27 | - complementos/font/Roboto-Regular.woff 28 | 29 | condition: form and css and img 30 | 31 | tags: 32 | - kit 33 | - target.bancor 34 | - target_country.argentina 35 | -------------------------------------------------------------------------------- /indicators/instagram-tpexkd.yml: -------------------------------------------------------------------------------- 1 | title: Instagram Phishing Kit TPEXkd 2 | description: | 3 | Detects a phishing kit targeting Instagram. 4 | Commonly deployed on Freenom domains. 5 | 6 | 7 | references: 8 | - https://urlscan.io/result/b861f41c-57f1-445f-bf6d-d80d84f673b4/ 9 | - https://urlscan.io/result/b7fdc491-68bb-42ed-853b-a24623b3dc5b/ 10 | - https://urlscan.io/result/aa338e86-53b1-4cb5-8c15-aea917601246/ 11 | - https://urlscan.io/result/bb82b60a-3de6-4c71-896a-3349ebbcca4c/ 12 | 13 | detection: 14 | 15 | icon: 16 | html|contains: 17 | - link rel="icon" type="image/png" href="form/img/logom.png" 18 | 19 | logo: 20 | html|contains: 21 | - img class="logo" src="form/img/instagram.png" width="190px" 22 | 23 | classes: 24 | html|contains|all: 25 | - class="signin-signup" 26 | - class="sign-in-form" 27 | - class="inputsevindk" 28 | - class="yasinbaykam 29 | 30 | 31 | condition: icon and logo and classes 32 | 33 | tags: 34 | - kit 35 | - target.instagram 36 | -------------------------------------------------------------------------------- /indicators/banco-del-pacifico-bl54hwhz.yml: -------------------------------------------------------------------------------- 1 | title: Banco del Pacífico Phishing Kit bl54hwhz 2 | description: | 3 | Detects a different Banco del Pacífico phishing kit deployed often on replit.com. 4 | 5 | references: 6 | - https://urlscan.io/result/28c040ae-192d-483d-9447-f9a45fd652d7 7 | - https://www.intermatico.com/ebanking/seguridad/login.htm 8 | 9 | detection: 10 | 11 | title: 12 | html|contains: 13 | - Banco del Pacífico 14 | 15 | favicon: 16 | html|contains: 17 | - href="img/pacificon.ico" 18 | 19 | form: 20 | html|contains|all: 21 | - form id="login" name="login" method="post" 22 | - action="load.php" 23 | 24 | img: 25 | html|contains|all: 26 | - img src="img/logo_pacifico1.png" 27 | - img src="img/alert-octagon.png" 28 | - img src="img/key.png" 29 | - img src="img/globe.png" 30 | 31 | condition: title and favicon and form and img 32 | 33 | tags: 34 | - kit 35 | - target.banco_del_pacifico 36 | - target_country.ecuador 37 | -------------------------------------------------------------------------------- /indicators/dhl-f8e6d46.yml: -------------------------------------------------------------------------------- 1 | title: DHL Phishing Kit f8e6d46 2 | description: | 3 | Detects a DHL phishing kit that has several indicators that are 4 | exclusive to the kit itself, such as the endpoint where the 5 | credentials are exfiltrated to, and the name of credit card 6 | validation function. 7 | 8 | references: 9 | - https://urlscan.io/result/073b610e-dcee-4acb-9a08-20ed20e8cf6a 10 | - https://urlscan.io/result/adec9c75-4f47-4563-aee8-d8b9bfebc3f7 11 | - https://urlscan.io/result/27b6403b-ea2d-45a6-918f-d08bc5e37534 12 | - https://urlscan.io/result/71c1dc24-d7de-4ca1-9a62-113ad2b61264 13 | - https://urlscan.io/result/0c66df93-8a8d-41d4-ba4e-61dfda7b50d8 14 | 15 | detection: 16 | 17 | formAction: 18 | html|contains: 'action="./app/jeandhl' 19 | 20 | backgroundImage: 21 | html|contains: 'src="./files/img/delivery-truck.png"' 22 | 23 | cardValidation: 24 | html|contains: 'onkeyup="$cc.validate(event)"' 25 | 26 | condition: formAction and backgroundImage and cardValidation 27 | 28 | tags: 29 | - kit 30 | - target.dhl 31 | -------------------------------------------------------------------------------- /indicators/smu-crypto-drainer-d9da4dc1.yml: -------------------------------------------------------------------------------- 1 | title: SMU Crypto Drainer d9da4dc1 2 | description: | 3 | Detects a crypto drainer that hides commonly within the 4 | file named `utils.js` and has a seperate `showMess.js` file 5 | with functions used to send window alerts. 6 | 7 | references: 8 | - https://urlscan.io/result/d9da4dc1-2252-45b6-b23a-2860b3d31531 9 | - https://urlscan.io/result/b7c65cea-65fe-44c8-ae80-40407936ddc9 10 | - https://urlscan.io/search/#filename%3A%22utils.js%22%20AND%20filename%3A%22showMess.js%22 11 | 12 | detection: 13 | 14 | drainerFiles: 15 | requests|contains|all: 16 | - 'utils.js' 17 | - 'showMess.js' 18 | 19 | alertFunctions: 20 | js|contains|all: 21 | - 'showSuccess' 22 | - 'showError' 23 | - 'showInfo' 24 | 25 | backendEndpoint: 26 | js|contains: 'logo1.png' 27 | 28 | 29 | condition: drainerFiles and alertFunctions and backendEndpoint 30 | 31 | tags: 32 | - kit 33 | - crypto_drainer.smu 34 | - cryptocurrency 35 | - cryptocurrency.ethereum 36 | -------------------------------------------------------------------------------- /indicators/daviplata-jwl1yd.yml: -------------------------------------------------------------------------------- 1 | title: Daviplata Phishing Kit jwL1yd 2 | description: | 3 | Detects a phishing kit targeting Daviplata - a digital platform for making electronic transactions and payments using a mobile phone. Owned by Davivienda, a financial services company based in Colombia. 4 | This was found as a result of this kit being deployed on Replit. 5 | 6 | 7 | references: 8 | - https://www.daviplata.com/ 9 | - https://urlscan.io/result/e60e1ce6-ad53-4b9f-9798-1bd955685e2e/ 10 | - https://urlscan.io/result/ad4c7827-19e4-4ba9-91d2-29638b6cd212/ 11 | - https://urlscan.io/result/860f4e25-981c-4525-aa1c-9bb2cb5dda4a/ 12 | - https://urlscan.io/result/4411b6f0-8b69-4a87-817b-070896e095db/ 13 | 14 | detection: 15 | 16 | hashes: 17 | html|contains|all: 18 | - 2.d18bb301 19 | - main.8d29879f 20 | 21 | images: 22 | html|contains|all: 23 | - logdav.png 24 | - bottom.png 25 | 26 | 27 | condition: hashes and images 28 | 29 | tags: 30 | - kit 31 | - target.daviplata 32 | - target_country.colombia -------------------------------------------------------------------------------- /indicators/drainer-Iil1il-crypto-scam.yml: -------------------------------------------------------------------------------- 1 | title: Ethereum cryptocurrency wallet drainer - Iil1ililIl1iIl1ill1Ilii 2 | 3 | description: | 4 | Detects an Ethereum cryptocurrency wallet drainer that has a 5 | constant variable named Iil1ililIl1iIl1ill1Ilii. 6 | 7 | references: 8 | - https://urlscan.io/result/394f88b9-1486-444e-b33d-f160a3c99189/ 9 | - https://urlscan.io/result/3ffdb605-af12-46e0-9f2a-3dac8438b367/ 10 | - https://urlscan.io/result/86f5a5f4-7286-4f8d-9d35-314f58876322/ 11 | - https://urlscan.io/result/0ecb3ff3-928a-4fe2-80eb-e052bfc1691d/ 12 | - https://urlscan.io/result/4d7e7339-3c07-49c8-acff-9999d3f0e8a8/ 13 | - https://urlscan.io/result/85a90895-e233-4399-91cd-dd4bcea52b8f/ 14 | 15 | detection: 16 | 17 | drainerVariableIdentifierHTML: 18 | html|contains: 'Iil1ililIl1iIl1ill1Ilii' 19 | 20 | drainerVariableIdentifierJS: 21 | js|contains: 'Iil1ililIl1iIl1ill1Ilii' 22 | 23 | condition: drainerVariableIdentifierHTML or drainerVariableIdentifierJS 24 | 25 | tags: 26 | - cryptocurrency 27 | - cryptocurrency.ethereum -------------------------------------------------------------------------------- /indicators/banco-de-galicia-npy0f6km.yml: -------------------------------------------------------------------------------- 1 | title: Banco de Galicia Phishing Kit npy0f6km 2 | description: | 3 | Detects a different Banco de Galicia phishing kit deployed often on replit.com. 4 | 5 | references: 6 | - https://urlscan.io/result/ae6ab5a8-6965-4b44-996a-248636849607 7 | 8 | detection: 9 | 10 | favicon: 11 | html|contains: 12 | - link rel="icon" type="image/gif/png" href="fis/titulo.png" 13 | 14 | title: 15 | html|contains: 16 | - Galicia 17 | 18 | css: 19 | html|contains|all: 20 | - href="./fis/default.min.css" 21 | - href="./fis/customcarousel.min.css" 22 | 23 | form: 24 | html|contains: 25 | - form action="index2.php" method="post" id="form1" 26 | 27 | img: 28 | requests|contains|all: 29 | - fis/titl.png 30 | - fis/tecl.png 31 | - fis/logo.png 32 | - fis/burbu.png 33 | 34 | condition: favicon and title and css and form and img 35 | 36 | tags: 37 | - kit 38 | - target.banco_de_galicia 39 | - target_country.argentina 40 | -------------------------------------------------------------------------------- /indicators/discord-4ek3us.yml: -------------------------------------------------------------------------------- 1 | title: Discord Phishing Kit 4EK3uS 2 | description: | 3 | Detects a phishing kit targeting Discord and Steam by promising a Free Discord Nitro subscription. 4 | 5 | 6 | references: 7 | - https://urlscan.io/result/0030c20b-4573-4e83-8048-47692aa9bf6d/ 8 | - https://urlscan.io/result/44812aa4-942c-43e1-a451-a1c3aeecdb40/ 9 | - https://urlscan.io/result/4bccb167-a836-41ee-9b5e-fecd937445f6/ 10 | - https://urlscan.io/result/a2274bd5-1b28-4bdf-9952-a2fa103f6e84/ 11 | - https://urlscan.io/result/6d7c16d7-374c-40d1-b863-178afb9ba5e6/ 12 | 13 | detection: 14 | 15 | image: 16 | html|contains: 17 | - 22 | 23 | condition: image and embedImage 24 | 25 | tags: 26 | - kit 27 | - target.discord 28 | -------------------------------------------------------------------------------- /indicators/fake-crypto-mining-ReceiveVoucher3.yml: -------------------------------------------------------------------------------- 1 | title: Fake crypto mining - ReceiveVoucher3 2 | 3 | description: | 4 | Detects a malicious DApp that pretends to be a liquidity mining 5 | platform while presenting fake audit reports. Older version of 6 | the fake-crypto-mining-noChrome rule. 7 | 8 | references: 9 | - https://urlscan.io/result/3bf65041-f47e-4b4f-9b6b-997baa7ba1ce/ 10 | - https://urlscan.io/result/ec5f8399-3560-4f6e-a3dd-e4efb87defef/ 11 | - https://urlscan.io/result/02e3f645-638c-4004-b6b8-63274ba3677e/ 12 | - https://urlscan.io/result/6479841b-b9e0-4346-8868-8467a6460ac6/ 13 | - https://urlscan.io/result/7f1c19fe-6861-4742-865e-9caba6d72976/ 14 | 15 | related: 16 | - id: fake-crypto-mining-noChrome 17 | 18 | detection: 19 | 20 | identifier: 21 | js|contains|all: 22 | - 'Receive Voucher' 23 | - 'lang_start_mining' 24 | - 'lang_pool' 25 | - 'lang_team' 26 | - 'lang_profit' 27 | - 'lang_sub_liquidity_ming' 28 | 29 | condition: identifier 30 | 31 | tags: 32 | - cryptocurrency -------------------------------------------------------------------------------- /indicators/roblox-survey-scam-9170a30d.yml: -------------------------------------------------------------------------------- 1 | title: Roblox Survey Scam 9170a30d 2 | description: | 3 | Detects websites that target Roblox players by 4 | pretending to offer free in-game currency, in reality 5 | these sites are designed to trick users into completing 6 | surveys. 7 | 8 | references: 9 | - https://urlscan.io/result/9170a30d-f431-4645-9bf6-767e604ea175/ 10 | - https://urlscan.io/result/2bf52523-8c46-4dd2-9ac9-3f355bd1e8ee/ 11 | - https://urlscan.io/result/14628838-282f-4bdb-b727-42a996d654a4/ 12 | - https://urlscan.io/result/84856127-bba2-45e9-83bb-62a2bf8c5515/ 13 | - https://urlscan.io/result/24f989a8-4985-4ffd-93d7-4837236e5835/ 14 | 15 | detection: 16 | 17 | html: 18 | html|contains: 'searching for amjad ...' 19 | 20 | requests: 21 | requests|contains: '/public/external/check.php' 22 | requests|endswith|all: 23 | - '/public/clockers/PrimeApps/cssXF.css' 24 | - '/public/external/css_frontXF.css' 25 | 26 | condition: html and requests 27 | 28 | tags: 29 | - kit 30 | - target.roblox 31 | -------------------------------------------------------------------------------- /indicators/imbetter-stealer-1f52021a.yml: -------------------------------------------------------------------------------- 1 | title: ImBetter C2 Panel 1f52021a 2 | description: | 3 | Detects the `ImBetter` stealer C2 panel page. 4 | 5 | Using the SVG data we can confidentially detect 6 | the SVG element that is used for the login page 7 | logo. 8 | 9 | references: 10 | - https://www.bridewell.com/insights/blogs/detail/threat-advisory-bridewell-malware-impersonating-online-tools-and-video-games 11 | - https://twitter.com/bridewellsec/status/1631349963840970757 12 | 13 | detection: 14 | 15 | svgData: 16 | html|contains|all: 17 | - 'M6 19C6 16.7909 8.68629 15 12 15C15.3137 15 18 16.7909 18 19' 18 | - 'M12 12C14.2091 12 16 10.2091 16 8C16 5.79086 14.2091 4 12 4C9.79086 4 8 5.79086 8 8C8 10.2091 9.79086 12 12 12Z' 19 | 20 | authScript: 21 | requests|contains: 'auf.js' 22 | 23 | imageFile: 24 | requests|contains: '114cd0fcfa927565b082.png' 25 | 26 | condition: svgData and (authScript or imageFile) 27 | 28 | 29 | tags: 30 | - threat_actor.arv6 31 | - malware.imbetter 32 | - malware -------------------------------------------------------------------------------- /indicators/roblox-8l0pamh6.yml: -------------------------------------------------------------------------------- 1 | title: Roblox Phishing Kit 8l0pamh6 2 | description: | 3 | Detects Roblox phishing sites using a Roblox specific strings 4 | within the DOM. 5 | 6 | Usually at /controlPage/create you can create a "Beaming link" 7 | These are often spread through Discord to victims. 8 | references: 9 | - https://www.youtube.com/watch?v=lUL2vgyhsw4 10 | - https://urlscan.io/result/c716b820-174e-4211-9c09-4663b4a7e47d/ 11 | - https://urlscan.io/result/e76d7a2f-3e6d-455e-8da8-1a94ea6c222f/ 12 | - https://urlscan.io/result/f9ccb8a3-624b-4cb1-b237-36dd81cef6e3/ 13 | - https://urlscan.io/result/1a62439f-de11-4ee6-a0ed-9c482c0c1906/ 14 | 15 | detection: 16 | 17 | realDomains: 18 | hostname|endswith: 19 | - .roblox.com 20 | - .rbxcdn.com 21 | 22 | rbxBodyId: 23 | dom|contains: body id="rbx-body" 24 | 25 | rbxCDN: 26 | dom|contains: rbxcdn 27 | 28 | 29 | condition: rbxCDN and rbxBodyId and not realDomains 30 | 31 | tags: 32 | - kit 33 | - target.roblox 34 | -------------------------------------------------------------------------------- /indicators/amazon-jp-28bd59a.yml: -------------------------------------------------------------------------------- 1 | title: Amazon Phishing Kit 28bd59a 2 | description: | 3 | Detects an Amazon phishing kit targeting Japanese users. 4 | This kit is dynamically generated by Javascript. 5 | 6 | references: 7 | - https://urlscan.io/result/62f94102-0ae5-4394-ac1e-b54dea1c14c6 8 | - https://urlscan.io/result/aaae4e63-afd3-4bde-ab10-096522e91e04/ 9 | - https://urlscan.io/search/#filename:%22AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.6a23b50.png%22 10 | - https://urlscan.io/search/#filename:%2211.8b1570ce205b9a0d5ecb.js%22 11 | 12 | detection: 13 | 14 | randomString: 15 | js|contains: 'fsdffsdfsddsfsd123123' 16 | 17 | pageScript: 18 | requests|contains: '11.8b1570ce205b9a0d5ecb.js' 19 | 20 | imageName: 21 | requests|contains: 'AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.6a23b50.png' 22 | 23 | 24 | condition: randomString and pageScript and imageName 25 | 26 | tags: 27 | - kit 28 | - target.amazon 29 | - target_country.japan 30 | -------------------------------------------------------------------------------- /indicators/amazon-token-cryptocurrency-scam-shfxgk.yml: -------------------------------------------------------------------------------- 1 | title: Amazon Token Cryptocurrency Scam SHFXgk 2 | description: | 3 | Detects a cyptocurrency phishing kit targeting Amazon. It claims to offer an Amazon (AMZ) token pre-sale and leads to an exchange where you can swap cryptocurrencies for this fake token. 4 | This was found as a result of this kit being deployed on Replit. 5 | 6 | 7 | references: 8 | - https://urlscan.io/result/fdab2610-a5ad-4665-8ebb-bdcc5b8fb515/ 9 | - https://urlscan.io/result/f045f38d-044d-4445-86d3-c5b1004a5fc9/ 10 | - https://urlscan.io/result/b87affd1-1f6e-4bd8-b49e-d534993e96bb/ 11 | 12 | detection: 13 | title: 14 | html|contains: 15 | - Amazon Pre-Sale for AMZ (up to 200% bonus) 16 | 17 | meta: 18 | html|contains: 19 | - 20 | 21 | css: 22 | requests|contains: 23 | - cryptocoins.css 24 | 25 | condition: title and meta and css 26 | 27 | tags: 28 | - kit 29 | - target.amazon 30 | - cryptocurrency -------------------------------------------------------------------------------- /indicators/crypto-monkey-drainer-65ftuybhy.yml: -------------------------------------------------------------------------------- 1 | title: Ethereum Wallet Drainer (Monkey Drainer) 2 | description: | 3 | Detects the "Monkey Drainer" phishing script kit 4 | 5 | references: 6 | - https://twitter.com/zachxbt/status/1584955933452484613 7 | - https://urlscan.io/result/8540a3f9-ee2e-43b4-aa75-c79379103bb3/ 8 | - https://urlscan.io/result/f5348120-cbbd-4185-b652-89c6cdbaef9d/ 9 | - https://urlscan.io/result/492cecf2-7f52-4f52-8c5a-c78cfb838025/ 10 | - https://urlscan.io/search/#hash%3Ac64e9c818d03878f82b48c2e2778935a1acb3b867e31b1473e19e856cde37b6e 11 | - https://urlscan.io/search/#hash%3A95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618 12 | - https://urlscan.io/search/#hash%3A67ad2454feca6eb213f4a70cc588137e6bd21ad95c0eda2709faa2317ff90359 13 | 14 | detection: 15 | chain: 16 | html|contains|all: 17 | - 18 | - 19 | 20 | condition: chain 21 | 22 | tags: 23 | - cryptocurrency 24 | - cryptocurrency.ethereum 25 | - threat_actor.monkeydrainer 26 | -------------------------------------------------------------------------------- /indicators/fake-crypto-trading-warmReminder.yml: -------------------------------------------------------------------------------- 1 | title: Fake crypto trading - warmReminder 2 | 3 | description: | 4 | Detects a malicious DApp that requires injected Web3 to 5 | gain access to the fake trading and mining offers. 6 | 7 | references: 8 | - https://urlscan.io/result/33f225d1-1e30-4cd9-90ef-4ae9997dd1e0/ 9 | - https://urlscan.io/result/1d1bd4d6-ba35-4a2f-8569-c0744ee94e7c/ 10 | - https://urlscan.io/result/4c4bee6c-bac3-474d-9ed5-db806907900e/ 11 | - https://urlscan.io/result/7ccbfda1-2eae-4ab3-bc73-4950dabe5c17/ 12 | - https://urlscan.io/result/7578b04d-0917-4005-8b07-e382bd330815/ 13 | 14 | detection: 15 | 16 | identifier: 17 | js|contains|all: 18 | - "Warm reminder" 19 | - "Please visit in wallet" 20 | - "You are currently visiting a decentralized website, please run it in the wallet application" 21 | - "index" 22 | - "futures" 23 | - "dealNav" 24 | - "orderHistory" 25 | - "financeHistory" 26 | - "miningDetails" 27 | 28 | condition: identifier 29 | 30 | tags: 31 | - cryptocurrency -------------------------------------------------------------------------------- /indicators/amerant-bank-4tfevg.yml: -------------------------------------------------------------------------------- 1 | title: Amerant Bank Phishing Kit 4TfEvG 2 | description: | 3 | Detects a phishing kit targeting Amerant Bank. 4 | This was found as a result of this kit being deployed on Replit. 5 | 6 | references: 7 | - https://www.amerantbank.com/ 8 | - https://urlscan.io/result/88c70641-58c8-45f2-843e-a9026f8110cd/ 9 | 10 | detection: 11 | 12 | sciptNonce: 13 | html|contains: 14 | - script id="GTMSnippet" nonce="" data-nonce="8A089EEA61455255137694196DA9B4F13B99A2F276BDFAF6EA792DC184C1CE16" 15 | 16 | csrfToken: 17 | html|contains: 18 | - meta name="csrf-token" content="0_L40lRrtLFzDrKWqGRzeK1Mamr7OvY6ZQ2GU_k7jbHcXRj-BKuuIAkBlMmyeJ1CT5x5KCTlQsajhs3ec7U_1R6eJCg1" 19 | 20 | formCsrfToken: 21 | html|contains: 22 | - input name="__RequestVerificationToken" type="hidden" value="9Sb_nRgfghLwjsglA0aLodG6PcRbAkzYwVZr65U7_BWfj_45RxOFA6ID9WBHrzvHIhGn7fDTkV6KhFiINVLLAK0r62g1" 23 | 24 | 25 | condition: sciptNonce and csrfToken and formCsrfToken 26 | 27 | tags: 28 | - kit 29 | - target.amerant 30 | - target_country.usa 31 | -------------------------------------------------------------------------------- /indicators/fake-crypto-mining-ReceiveVoucher4.yml: -------------------------------------------------------------------------------- 1 | title: Fake crypto mining - ReceiveVoucher4 2 | 3 | description: | 4 | Detects a malicious DApp that pretends to be a liquidity mining platform 5 | while presenting fake audit reports and partners. AJAX call to receive 6 | other contents. 7 | 8 | references: 9 | - https://urlscan.io/search/#hash%3A5218075e53acd18fdd4b8c92cb0dad377bffab9d072cc6205e51ee8e32514a14 10 | - https://urlscan.io/result/011814b3-f30a-4ac7-bac1-db62f71c29de/ 11 | - https://urlscan.io/result/07c863ae-f341-4908-9686-2fc030c40a47/ 12 | - https://urlscan.io/result/a43482f4-83ee-4f17-9928-f6c4bc437e2f/ 13 | 14 | related: 15 | - id: fake-crypto-mining-ReceiveVoucher 16 | 17 | detection: 18 | 19 | jsKeywords: 20 | js|contains|all: 21 | - 'get_html' 22 | - 'php' 23 | - 'html' 24 | - 'user_ajax.' 25 | - 'body' 26 | - 'post' 27 | - 'type' 28 | 29 | jsRequest: 30 | js|contains: 'user_ajax.php' 31 | 32 | condition: jsKeywords and jsRequest 33 | 34 | tags: 35 | - cryptocurrency 36 | -------------------------------------------------------------------------------- /indicators/fake-crypto-mining-ReceiveVoucher.yml: -------------------------------------------------------------------------------- 1 | title: Fake crypto mining - ReceiveVoucher 2 | 3 | description: | 4 | Detects a malicious DApp that pretends to be a cloud mining platform 5 | while presenting fake audit reports. 6 | 7 | references: 8 | - https://urlscan.io/result/3b876cbb-9b3f-43e1-aaea-7fdbdfa9bf89/ 9 | - https://urlscan.io/result/47f06aec-35bb-495d-9cf8-df58178a68d1/ 10 | - https://urlscan.io/result/5be3b536-a4bd-4f81-b9be-1980ef3f955b/ 11 | - https://urlscan.io/result/d14625b5-d46a-44cb-afba-73072046626d/ 12 | - https://urlscan.io/result/714ba508-69aa-48de-b1e3-e53b51cbff38/ 13 | - https://urlscan.io/result/468f540d-4c14-4dca-ad8d-9ed9cca27e41/ 14 | - https://urlscan.io/result/6e2ae131-8b6a-4668-9b13-0df040d677dc/ 15 | - https://urlscan.io/result/7c66056f-fc6f-4e04-ac48-1160f8ac77c4/ 16 | 17 | detection: 18 | 19 | identifier: 20 | html|contains|all: 21 | - "Receive Voucher" 22 | - "You need to pay a miner's fee" 23 | - "audit report" 24 | - "Wallet amount" 25 | 26 | condition: identifier 27 | 28 | tags: 29 | - cryptocurrency -------------------------------------------------------------------------------- /indicators/fake-crypto-trading-yuebaoIndex.yml: -------------------------------------------------------------------------------- 1 | title: Fake crypto trading - yuebaoIndex 2 | 3 | description: | 4 | Detects a malicious DApp that pretends to be a trading 5 | platform that offers AI bots, lending, and mining. 6 | 7 | references: 8 | - https://urlscan.io/result/c0aa6eb6-f455-47df-91a5-02c3d41b6677/ 9 | - https://urlscan.io/result/13f3183f-eb23-4e7f-9079-5cbf82f56a9e/ 10 | - https://urlscan.io/result/a59848cc-b0b4-461a-8e75-b291c63b2524/ 11 | - https://urlscan.io/result/625b5b57-20d5-436a-bd6c-97de4372f1c1/ 12 | - https://urlscan.io/result/408742fc-015d-418d-bb8b-d43fe9e88a87/ 13 | 14 | detection: 15 | 16 | identifier: 17 | js|contains|all: 18 | - 'footer' 19 | - 'yuebaoIndex' 20 | - 'index' 21 | - 'futures' 22 | - 'dealNav' 23 | - 'orderHistory' 24 | - 'financeHistory' 25 | - 'miningDetails' 26 | - 'proclamation' 27 | - 'share' 28 | - 'title' 29 | - 'common' 30 | - 'quantifyOrder' 31 | - 'borrow' 32 | 33 | condition: identifier 34 | 35 | tags: 36 | - cryptocurrency -------------------------------------------------------------------------------- /indicators/generic-crypto-scam-dd1f3101.yml: -------------------------------------------------------------------------------- 1 | title: Generic Crypto Scam dd1f3101 2 | description: | 3 | Detects a generic crypto scam that generally 4 | leverages on using popular people such as 5 | Elon Musk and companies such as OpenAI to lure 6 | victims into sending the target wallet address 7 | crypto (like BTC, ETH, XRP or DOGE). 8 | 9 | references: 10 | - https://urlscan.io/result/21898373-e858-453d-9739-7f9a8926400a 11 | - https://urlscan.io/result/f17fd353-ac2c-41a6-82f9-fa0f979d2b19 12 | - https://urlscan.io/result/405e404a-0676-4db8-8de9-ee91c17c8cdb 13 | 14 | detection: 15 | 16 | attackerWallet: 17 | html|contains: 'participate-address' 18 | 19 | ruleText: 20 | html|contains: 'you can use the built-in calculator on our website' 21 | 22 | giveawayText: 23 | html|contains: 'giveaway for all crypto holders!' 24 | 25 | condition: attackerWallet and ruleText and giveawayText 26 | 27 | tags: 28 | - kit 29 | - target.generic_crypto 30 | - cryptocurrency.btc 31 | - cryptocurrency.eth 32 | - cryptocurrency.xrp 33 | - cryptocurrency.doge 34 | -------------------------------------------------------------------------------- /indicators/microsoft-fyfcvk8e.yaml: -------------------------------------------------------------------------------- 1 | title: Microsoft Phishing Kit fyfcvk8e 2 | description: | 3 | Detects a Microsoft phishing kit with a hardcoded MFA phone number and misspelled words. 4 | The phishing kit calls sc.php to perform license validation prior to loading page content. 5 | 6 | references: 7 | - https://urlscan.io/result/0f35c05b-73e0-4397-9e7e-9e3edb508d16 8 | - https://urlscan.io/result/e73ca666-5a09-4c0e-949b-33a8f6ee7564 9 | - https://urlscan.io/result/0ebaab43-0235-42cc-9304-153f698868d4 10 | - https://urlscan.io/search/#filename%3A%22sc.php%22%20AND%20filename%3A%22jquery-3.1.1.min.js%22%20AND%20filename%3A%22crypto-js.min.js%22 11 | 12 | detection: 13 | 14 | phone: 15 | dom|contains: 16 | - +X XXXXXXXX71 17 | 18 | browser: 19 | dom|contains: 20 | - THIS WORKS AS A SIGNA TURE CHANGE FOR DETECED BROWSER 21 | 22 | licenseServer: 23 | requests|contains|all: 24 | - "sc.php" 25 | - "jquery-3.1.1.min.js" 26 | - "crypto-js.min.js" 27 | 28 | condition: all of them 29 | 30 | tags: 31 | - kit 32 | - target.microsoft 33 | -------------------------------------------------------------------------------- /indicators/banco-de-galicia-2mo4sf.yml: -------------------------------------------------------------------------------- 1 | title: Banco de Galicia Phishing Kit 2mO4SF 2 | description: | 3 | Detects a phishing kit targeting Banco de Galicia. The threat actor operates from Argentina itself. 4 | 5 | 6 | references: 7 | - https://urlscan.io/result/d432c567-d1de-4b56-9ddb-af47248ab423/ 8 | 9 | detection: 10 | 11 | malformedHTML: 12 | html|contains: 13 | - 14 | 15 | banner: 16 | html|contains: 17 | - div class="logo_login" role="banner" data-automation-id="galicia-banner" 18 | 19 | form: 20 | html|contains: 21 | - form action="send.php" method="post" id="form1" onkeypress="return evalEnter(event);" autocomplete="off" 22 | 23 | csrf: 24 | html|contains: 25 | - input name="__RequestVerificationToken" type="hidden" value="NOkPDuCJE_NXUBMT9OQG-KhVO3-R8Uruo-giLM1tLPZAsdDMuxuWaFsp-kpbIt1CHFjZx6z644GVwxBiB9gp6U0zaZWoM_pAGYsQZLEfUM01" 26 | 27 | 28 | condition: malformedHTML and banner and form and csrf 29 | 30 | tags: 31 | - kit 32 | - target.banco_de_galicia 33 | - target_country.argentina 34 | -------------------------------------------------------------------------------- /indicators/valorant-7plil474.yml: -------------------------------------------------------------------------------- 1 | title: Valorant Phishing Kit 7plil474 2 | description: | 3 | Detects a phishing kit targeting Valorant players. It is typically spread on 4 | social media platforms such as TikTok, often luring in gamers using popular 5 | figures such as Tenz, Kyedae and MrBeast. 6 | 7 | references: 8 | - https://www.tiktok.com/search/video?q=mrbeast%20valorant 9 | - https://urlscan.io/result/ceb1f3d8-efed-40b3-85e4-6c9eecd182b7/ 10 | - https://urlscan.io/result/48118e59-979c-48e7-b332-bb802dc5e941/ 11 | - https://urlscan.io/result/5421601f-f2aa-41a5-bf6b-85a264bee2f7/ 12 | 13 | detection: 14 | 15 | requests: 16 | requests|endswith|all: 17 | - '/login' 18 | - 'logins.css' 19 | - '/t/1.css?apiType=css&projectid=dce2cd3c-2b49-496c-8fe8-f7eedea7aa2b' 20 | 21 | jsVariables: 22 | js|contains|all: 23 | - 'makeid' 24 | - 'rqdata_token' 25 | - 'login_mfa' 26 | 27 | condition: requests and jsVariables 28 | 29 | tags: 30 | - kit 31 | - target.valorant 32 | - target.riotgames 33 | -------------------------------------------------------------------------------- /indicators/bookmark-grabber-d7eb986c.yml: -------------------------------------------------------------------------------- 1 | title: Bookmark Grabber d7eb986c 2 | description: | 3 | Detects a phishing page that uses the disguise of an intellectual 4 | property consent form of a crypto news site in order to lure users 5 | into installing a malicious bookmark that steals their Discord token. 6 | 7 | references: 8 | - https://urlscan.io/result/d7eb986c-364b-4308-b434-a85888e6195a 9 | - https://urlscan.io/result/82758014-7cff-475b-b9e9-7dc812252ebf 10 | - https://urlscan.io/result/a54708a1-17ec-4a0f-89b7-134f37a25f02 11 | - https://urlscan.io/result/8e9957cf-09dc-4fdd-bb66-c7cab5136815 12 | 13 | detection: 14 | 15 | iframe: 16 | html|contains: "document.createElement('iframe')" 17 | 18 | frame: 19 | html|contains: "document.createElement('frame')" 20 | 21 | localStorage: 22 | html|contains: 'contentWindow.localStorage' 23 | 24 | discordDomain: 25 | html|contains: 'discord.com' 26 | 27 | condition: (iframe or frame) and localStorage and discordDomain 28 | 29 | tags: 30 | - target.cryptoslate 31 | - target.cryptodose 32 | - target.datawallet 33 | 34 | 35 | 36 | -------------------------------------------------------------------------------- /indicators/chenlun-88426540.yml: -------------------------------------------------------------------------------- 1 | title: Chenlun Phishing Kit 88426540 2 | description: | 3 | Detect phishing sites that contain two distinctive 4 | files named ResourceRedConfig.js and urlConfig.json. 5 | 6 | These files are indicative of a phishing kit developed 7 | by a Chinese threat actor named Chenlun. 8 | references: 9 | - https://urlscan.io/result/88426540-8f66-4fe2-b8f2-526e7025ace7 10 | - https://urlscan.io/result/05189f5c-f969-45da-a6fd-d3fec490f0f7 11 | - https://urlscan.io/result/d4886a4c-114a-4a0a-9b07-614fddc6171f 12 | - https://www.domaintools.com/resources/blog/merry-phishmas-beware-us-postal-service-phishing-during-the-holidays/ 13 | - https://g0njxa.medium.com/chenlun-a-worldwide-phishing-carding-campaigns-provider-a45c4fed6d1b 14 | 15 | detection: 16 | 17 | configScript: 18 | requests|contains: 'ResourceRedConfig.js' 19 | 20 | urlConfig: 21 | requests|endswith: '/ResourceConfig/urlConfig.json' 22 | 23 | condition: configScript and urlConfig 24 | 25 | tags: 26 | - kit 27 | - threat_actor_country.china 28 | - threat_actor.chenlun 29 | - target_country.global 30 | 31 | -------------------------------------------------------------------------------- /indicators/facebook-7c475854.yml: -------------------------------------------------------------------------------- 1 | title: Facebook Phishing Kit 7c475854 2 | description: | 3 | This kit imitates the Facebook help center page 4 | and asks the user to enter their page name, email 5 | address, phone number & full name in order to 'unblock' 6 | their removed facebook page. 7 | 8 | After filling out the form the user is prompted 9 | with a dialog box where they must enter their 10 | Facebook password for their 'security'. 11 | 12 | references: 13 | - https://urlscan.io/result/7c475854-9102-4803-8293-11c4bc17142e 14 | - https://urlscan.io/result/36d2d95b-7a09-408e-abd9-710ff9703aa3 15 | - https://urlscan.io/result/3e88c0af-e0ad-4b42-af21-9ed13dec36f5 16 | 17 | detection: 18 | 19 | faviconUrl: 20 | dom|contains: 'https://www.edigitalagency.com.au/wp-content/uploads/Facebook-logo-blue-circle-large-transparent-png.png' 21 | 22 | facebookLogo: 23 | requests|contains: 'netflixlogo-28853c47.png' 24 | 25 | pageTitle: 26 | title: 'Help Center' 27 | 28 | condition: faviconUrl and facebookLogo and pageTitle 29 | 30 | tags: 31 | - kit 32 | - target.facebook 33 | -------------------------------------------------------------------------------- /indicators/mufg-483cbea7.yml: -------------------------------------------------------------------------------- 1 | title: MUFG Phishing Kit 483cbea7 2 | description: | 3 | Detects a phishing page that targets Japanese users 4 | of MUFG (Mitsubishi UFJ Financial Group) Bank 5 | 6 | This original page seems to have been cloned leaving 7 | a trace of the cloner's useragent in the hidden input 8 | elements of the website's login form 9 | 10 | references: 11 | - https://urlscan.io/result/483cbea7-5acc-42d3-9e3b-c6d413df2ad6 12 | - https://urlscan.io/result/0e072075-0244-49fb-88e6-d09ebbbaaedc 13 | - https://urlscan.io/result/0088bf2a-18ac-4a83-9793-25c113e4c9f4 14 | - https://urlscan.io/result/6484b228-2b2e-45a4-bbc1-1b004cc26beb 15 | 16 | detection: 17 | 18 | clonerUserAgent: 19 | dom|contains: 'Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1' 20 | 21 | redirectUrl: 22 | dom|contains: '/info.php?dilefa=iejfeafe454a56f4a8ew4fa684fa3efawe1faw5ef4awe64fa6w54' 23 | 24 | condition: clonerUserAgent and redirectUrl 25 | 26 | tags: 27 | - kit 28 | - target.mufg 29 | - target_country.japan 30 | 31 | -------------------------------------------------------------------------------- /indicators/discord-oauth2-scam-u8eviyps.yml: -------------------------------------------------------------------------------- 1 | title: Discord oAuth2 Scam u8eviyps 2 | description: | 3 | Detects a Discord oAuth2 scam confirmation page, which is often used in combination with social engineering to get the user to authorize for a spam application. 4 | This for example enables the attacker to add the victims into further scam/advertised servers using the `guilds.join` scope. 5 | 6 | references: 7 | - https://urlscan.io/result/1314542e-6bdd-496d-a89c-dd20eb60cc99/ 8 | - https://urlscan.io/result/8b41d331-9749-492c-9616-b133e27880df/ 9 | - https://urlscan.io/result/0fe1135e-6d7a-4ee9-8da0-c19d971d0ab0/ 10 | 11 | detection: 12 | 13 | title: 14 | html|contains: 15 | - Discord Confirmation 16 | 17 | gif: 18 | html|contains: 19 | - 20 | 21 | message: 22 | html|contains: 23 | -

Your Discord account has been successfully verified, you can close this page

24 | 25 | condition: all of them 26 | 27 | tags: 28 | - scam 29 | - target.discord 30 | -------------------------------------------------------------------------------- /indicators/unibank-njdemh.yml: -------------------------------------------------------------------------------- 1 | title: Unibank Phishing Kit NJdEmH 2 | description: | 3 | Detects a phishing kit targeting Unibank. Unibank is one of the largest private banks established in Azerbaijan. 4 | Threat actors working with this phishing kit appear to be coming from Ukraine (EVEREST AS49223). 5 | 6 | 7 | references: 8 | - https://unibank.az/ 9 | - https://urlscan.io/result/449e4d19-254f-487b-a911-65986cf99384/ 10 | - https://urlscan.io/result/ae412a17-f89b-4f4b-99df-de652b4ddcb9/ 11 | - https://urlscan.io/result/6dab8fb5-4667-4ddd-8a28-c4bfc1ff86ec/ 12 | 13 | detection: 14 | 15 | title: 16 | html|contains: 17 | - UNİBANK 18 | 19 | form: 20 | html|contains: 21 | - form name="form" id="form" method="post" action="indexSend.php" autocomplete="off" onsubmit="return validation()" 22 | 23 | facebookDomainVerification: 24 | html|contains: 25 | - meta name="facebook-domain-verification" content="atzt8tk6o7zuo0wjw3fgp66oqag9uq" 26 | 27 | 28 | condition: title and form and facebookDomainVerification 29 | 30 | tags: 31 | - kit 32 | - target.unibank 33 | - target_country.azerbaijan 34 | -------------------------------------------------------------------------------- /indicators/westpac-c5c1bfe0.yml: -------------------------------------------------------------------------------- 1 | title: Westpac Phishing Kit c5c1bfe0 2 | description: | 3 | Westpac phishing kit which uses the same CSS files and directory structure across various domains. 4 | 5 | references: 6 | - https://urlscan.io/result/0d23637b-49fc-44f8-af76-72f14a101d3a/ 7 | - https://urlscan.io/result/65dabd43-fcf2-4924-bd4c-1641f9919338/ 8 | - https://urlscan.io/result/c5c1bfe0-f3ac-423b-b1f1-00d896c03b2d/ 9 | - https://urlscan.io/result/c034730b-c219-4531-ad57-6e1338e9f81c/ 10 | 11 | detection: 12 | 13 | stylesheet: 14 | html|contains|all: 15 | - '/front_end/front_end_files/000-000-0001combined.css.1a6232cd07874834478c928fa1f30b79eea8fe08.css' 16 | - '/front_end/front_end_files/000-0001combined.css.ad465e8be579042cb5c8ec3d4ebc745fbe87f2b4.css' 17 | - '/front_end/front_end_files/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css' 18 | 19 | shortcutIcon: 20 | html|contains: '/wbc/banking/Themes/Default/Desktop/WBC/Images/favicon.ico.23fb3f626712cf243b43f34a3e3a8e887b8e8250.ico' 21 | 22 | condition: stylesheet and shortcutIcon 23 | 24 | tags: 25 | - kit 26 | - target.westpac 27 | -------------------------------------------------------------------------------- /indicators/microsoft-rxkr4n3b.yml: -------------------------------------------------------------------------------- 1 | title: Microsoft Phishing Kit rxkr4n3b 2 | description: | 3 | Detects a poorly designed and simple Microsoft phishing kit. 4 | Discovered as a result of this being deployed on Replit.com. 5 | 6 | references: 7 | - https://urlscan.io/result/b88dcbad-2ef0-4904-8046-3ca438fb4afa 8 | - https://urlscan.io/result/4a06b13e-57b1-47a6-852b-d68c9518d25f 9 | 10 | detection: 11 | 12 | title: 13 | html|contains: 14 | - PROCESO 15 | 16 | css: 17 | html|contains: 18 | - link rel="stylesheet" type="text/css" href="forma.css" 19 | 20 | form: 21 | html|contains: 22 | - form action="complete.php" method="post" 23 | 24 | inputs: 25 | html|contains|all: 26 | - input type="email" name="lgdmdp" placeholder="EMAIL ALCTUAL" 27 | - input id="clave" type="password" name="djddhd" placeholder="CLAVE ACTUAL" 28 | - input type="submit" class="boton" value="Confirmar" 29 | 30 | img: 31 | html|contains: 32 | - 'img style="width: 101px;" src="imagen.jpg" alt=""' 33 | 34 | condition: all of them 35 | 36 | tags: 37 | - kit 38 | - target.microsoft 39 | -------------------------------------------------------------------------------- /indicators/avvillas-a5lnamb9.yml: -------------------------------------------------------------------------------- 1 | title: Banco AV Villas Phishing Kit a5lnamb9 2 | description: | 3 | Detects a Banco AV Villas phishing kit deployed often on replit.com targeting Colombian citizens. 4 | 5 | references: 6 | - https://urlscan.io/result/c1fd550b-afb4-4532-9c7b-92cd53aa13b9 7 | - https://www.avvillas.com.co/bancadigital/inicio 8 | 9 | detection: 10 | 11 | title: 12 | html|contains: 13 | - Consultas Banca Virtual | Banco AV Villas 14 | 15 | meta: 16 | html|contains: 17 | - 18 | 19 | favicon: 20 | html|contains: 21 | - 22 | 23 | form: 24 | html|contains: 25 | - 26 | 27 | condition: title and meta and favicon and form 28 | 29 | tags: 30 | - kit 31 | - target.banco_av_villas 32 | - target_country.colombia 33 | -------------------------------------------------------------------------------- /indicators/apple-icloud-467ab986.yml: -------------------------------------------------------------------------------- 1 | title: Apple iCloud Phishing Kit 467ab986 2 | description: | 3 | An Apple iCloud Phishing Kit appearing in English and Spanish. 4 | This looks for file name references of a stylesheet, title styling and a loader image. 5 | 6 | references: 7 | - https://urlscan.io/result/467ab986-22c1-466a-a9b4-173f6bd75205/ 8 | - https://urlscan.io/result/ec2b7fc2-7906-4f72-9f00-c8b35e6d6328/ 9 | - https://urlscan.io/result/e8eb17de-97c5-4e0a-a755-984208e6c35e/ 10 | - https://urlscan.io/result/224947d7-24c8-4c5f-b67c-236b150e87c2/ 11 | - https://urlscan.io/result/a40f91d6-fd26-4094-b9c6-70976c0df9d2/ 12 | - https://urlscan.io/search/#(filename%3A%22assets%2Flayout%2Fapple.css%22)%20AND%20(filename%3A%22assets%2Fimg%2Fajax-loader.gif%22) 13 | 14 | detection: 15 | stylesheet: 16 | html|contains: "href=\"assets/layout/apple.css\"" 17 | 18 | titleClassStyle: 19 | html|contains: ".Estilo2" 20 | 21 | imageAjaxLoader: 22 | html|contains: "src=\"assets/img/ajax-loader.gif\"" 23 | 24 | condition: stylesheet and titleClassStyle and imageAjaxLoader 25 | 26 | tags: 27 | - kit 28 | - target.icloud 29 | - target.apple 30 | -------------------------------------------------------------------------------- /indicators/microsoft-zuu2wvfc.yml: -------------------------------------------------------------------------------- 1 | title: Microsoft Phishing Kit zuu2wvfc 2 | description: | 3 | Detects a Microsoft phishing kit with a lot of entropy, making it easy to detect. 4 | Discovered as a result of this being deployed on Replit.com. 5 | 6 | references: 7 | - https://urlscan.io/result/4f4e2f28-f18f-466c-8365-80226ea967fa 8 | 9 | detection: 10 | 11 | title: 12 | html|contains: 13 | - Iniciar sesión en tu cuenta Microsoft 14 | 15 | css: 16 | html|contains: 17 | - link rel="stylesheet" title="Converged_v2" type="text/css" href="Converged_v23082_AZXChPIB5jI3ijrmoNll5w2.css" 18 | 19 | form: 20 | html|contains: 21 | - 'form name="f1" id="i0281" novalidate="novalidate" spellcheck="false" method="post" target="_top" autocomplete="off" data-bind="autoSubmit: forceSubmit, attr: { action: postUrl }, ariaHidden: activeDialog" action="secure.php"' 22 | 23 | img: 24 | html|contains: 25 | - https://logincdn.msauth.net/16.000.28510.10/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png 26 | 27 | condition: title and css and form and img 28 | 29 | tags: 30 | - kit 31 | - target.microsoft 32 | -------------------------------------------------------------------------------- /indicators/anz-bank-cd6ec9e7.yml: -------------------------------------------------------------------------------- 1 | title: ANZ Bank Phishing Kit cd6ec9e7 2 | description: | 3 | This kit seems to define a few configuration 4 | values within the page's javascript, possibly 5 | to communicate with the backend which user 6 | of the phishing service owns the phishing page. 7 | 8 | references: 9 | - https://urlscan.io/result/cd6ec9e7-b588-469b-986c-1e2b84d3e9b4 10 | - https://urlscan.io/result/45395d64-b370-4fee-94ae-964fe92965b4 11 | - https://urlscan.io/result/895d7b3b-6bf7-4f42-b36c-150c14867728 12 | 13 | detection: 14 | 15 | pageTitle: 16 | title: "Login - ANZ Internet Banking" 17 | 18 | kitConfiguration: 19 | js|contains|all: 20 | - "var urlroot" 21 | - "var uniqueid" 22 | 23 | kitAssets: 24 | dom|contains|all: 25 | - "//js/option.js" 26 | - "//js/browser.js" 27 | - "//panel/img/logo.PNG" 28 | - "//panel/img/img-01.PNG" 29 | - "//panel/img/anz-logo.1.0.0.svg" 30 | 31 | 32 | condition: pageTitle and kitConfiguration and kitAssets 33 | 34 | tags: 35 | - kit 36 | - target.anz_bank 37 | - target_country.new_zealand 38 | 39 | -------------------------------------------------------------------------------- /indicators/banco-pichincha-niug0z.yml: -------------------------------------------------------------------------------- 1 | title: Banco Pichincha Phishing Kit niUG0Z 2 | description: | 3 | Detects a phishing kit targeting Banco Pichincha. Banco Pichincha is the largest private-sector bank in Ecuador. 4 | This was detected as a result of this kit being deployed on Replit. 5 | 6 | 7 | references: 8 | - https://urlscan.io/result/0c5c87f6-0de1-4b69-bbcf-ebfec08241e6/ 9 | - https://urlscan.io/result/db339903-08f1-4be6-9c55-47227d18f42e/ 10 | - https://urlscan.io/result/473f8be9-a375-48d1-a6c5-cd07a9021d81/ 11 | 12 | detection: 13 | 14 | title: 15 | html|contains: 16 | - Login 17 | 18 | css: 19 | html|contains|all: 20 | - link rel="stylesheet" href="assets/css/explorer-message-05236.css" 21 | - link rel="stylesheet" href="assets/css/styles.05.css" 22 | - link rel="stylesheet" href="assets/css/styles.45fc6f0f.css" 23 | 24 | copyright: 25 | html|contains: 26 | - "© 2022 Banco Pichincha. Todos los derechos reservados" 27 | 28 | 29 | condition: title and css and copyright 30 | 31 | tags: 32 | - kit 33 | - target.banco_pichincha 34 | - target.pichincha 35 | - target_country.ecuador 36 | -------------------------------------------------------------------------------- /indicators/bancolombia-jr5mnv.yml: -------------------------------------------------------------------------------- 1 | title: Bancolombia Phishing Kit jr5mnv 2 | description: | 3 | Detects a phishing kit targeting Bancolombia. 4 | This was found as a result of this kit being deployed on Replit. 5 | 6 | 7 | references: 8 | - https://urlscan.io/result/b4501b15-b767-4c10-a11e-898ae8cf01a7/ 9 | - https://urlscan.io/result/185193df-05e6-40ff-aa2e-694098a4f03a/ 10 | - https://urlscan.io/result/2759a513-0dee-49e5-8dfb-820b1acea250/ 11 | - https://urlscan.io/result/1d52da2c-126c-4a99-bfde-c8a11c2a1a12/ 12 | - https://urlscan.io/result/e577760c-3901-4fd3-93c4-58a9e2613250/ 13 | - https://urlscan.io/result/500c35f2-ca7e-4673-8cf0-19a5f686547f/ 14 | 15 | detection: 16 | 17 | icons: 18 | css|contains|all: 19 | - https://i.imgur.com/8Ezt3Uy.png 20 | - https://i.imgur.com/KROsJQP.png 21 | 22 | images: 23 | html|contains|all: 24 | - img src="toplogpro1.png" 25 | - img src="info.png" 26 | 27 | form: 28 | html|contains: 29 | - form class="login100-form validate-form" method="post" action="rol.php" 30 | 31 | 32 | condition: icons and images and form 33 | 34 | tags: 35 | - kit 36 | - target.bancolombia 37 | - target_country.colombia 38 | -------------------------------------------------------------------------------- /indicators/bancolombia-nfimdx.yml: -------------------------------------------------------------------------------- 1 | title: Bancolombia Phishing Kit nFimdX 2 | description: | 3 | Detects a phishing kit targeting Bancolombia. 4 | This was found as a result of this kit being deployed on Replit. 5 | 6 | This kit has a different message than others. 7 | (Enter your current data to cancel the blocking of your Dynamic Key) 8 | 9 | 10 | references: 11 | - https://urlscan.io/result/aa740cd0-4425-41f3-ba8d-d6c21d40f6a3/ 12 | - https://urlscan.io/result/c7261902-0d35-4580-900d-1ba95c77c5fd/ 13 | - https://urlscan.io/result/423ae757-e8a2-4b1e-b740-d8fca8d40391/ 14 | 15 | detection: 16 | 17 | form: 18 | html|contains: form action="data.php" method="post" class="form_contact" 19 | 20 | image: 21 | html|contains: 26 | - 27 | - 28 | 29 | condition: form and image and background 30 | 31 | tags: 32 | - kit 33 | - target.bancolombia 34 | - target_country.colombia 35 | --------------------------------------------------------------------------------