Closed g0d33p3rsec closed 3 months ago
https://benyex.cl/MzUwZTVaOWUyWjhPNDc= https://benyex.cl/M2k0ZDJCNHQ1NjFWOEw= https://benyex.cl/MjA3ZjBqMjU5VDBCNTg= https://benyex.cl/MzgxeTN6MlEwWjJIMUE= https://benyex.cl/M0M0dTZaNFAyUzFWNEU= https://benyex.cl/MlM4STM3M0U0YzFlOGw= https://benyex.cl/M2E0SDJvMWM1ejNiNms= https://benyex.cl/M3I0ZjZRNEkyNzBlM2U= https://benyex.cl/M0c0bzZZNG01NjM4MG4= https://benyex.cl/M0U0RTZxNGwyTjBoM1I= https://benyex.cl/M1Q0eDZXNFAyazRFNGo= https://benyex.cl/M2szUzZHMlMyWDVWNTI= https://benyex.cl/M2MzVjZmMjEySDVTNXQ= https://benyex.cl/M2EzNzZ5MkoyeTVZNVM= http://benyex.cl/M2czTzYxMnUyYzVxNUs= https://benyex.cl/MjE4UzNEMVg0bDBFN2Y= https://benyex.cl/M0cxVjRYNXc1VTI0OGQ= https://benyex.cl/M0Y0NDBuOUExUjZNOUU= https://benyex.cl/MzQxdzNuMmYwUDJWMVE= https://benyex.cl/M0IzdDBhM20zcDdHNjY= https://benyex.cl/M2E0cTN6OG85bzJoNEg=
https://facebook.com/ https://www.instagram.com/ https://www.betway.co.za https://crossfire.z8games.com/ https://www.tut.ac.za/ https://www.ufh.ac.za/ https://www.ufs.ac.za/ https://www.wsu.ac.za/
This domain is now hosting the phishing kit that previously at lebomashilo[.]co[.]za (#462), havenhills[.]za[.]com (https://github.com/mitchellkrogza/phishing/pull/459), intrinsicisle[.]za[.]com (https://github.com/mitchellkrogza/phishing/pull/452), reluzformaturas[.]com[.]br (https://github.com/mitchellkrogza/phishing/pull/435), abcmueblesbogota[.]com (https://github.com/mitchellkrogza/phishing/pull/432), ergoterapiacaribu[.]ch (https://github.com/mitchellkrogza/phishing/pull/426), ijconnects[.]com (https://github.com/mitchellkrogza/phishing/pull/421), cbcaps[.]shop (https://github.com/mitchellkrogza/phishing/pull/417), bersowir[.]org (https://github.com/mitchellkrogza/phishing/pull/416), brunotasso[.]com[.]br (https://github.com/mitchellkrogza/phishing/pull/413), wisbechguide[.]uk (https://github.com/mitchellkrogza/phishing/pull/408), pescacancun[.]com (https://github.com/mitchellkrogza/phishing/pull/406), bkengineersindia[.]com (https://github.com/mitchellkrogza/phishing/pull/405), englishplusmore[.]com (https://github.com/mitchellkrogza/phishing/pull/404), carnesboinobre[.]com[.]br (https://github.com/mitchellkrogza/phishing/pull/398), technowide[.]com[.]tr (https://github.com/mitchellkrogza/phishing/pull/396), jestertunes[.]com (https://github.com/mitchellkrogza/phishing/pull/393), safecartusa[.]com (https://github.com/mitchellkrogza/phishing/pull/391), foreverfarley[.]com (https://github.com/mitchellkrogza/phishing/pull/387), azezieldraconous[.]com (https://github.com/mitchellkrogza/phishing/pull/381), westernautomobileassembly[.]com (https://github.com/mitchellkrogza/phishing/pull/376) , littleswanaircon[.]com[.]sg (https://github.com/mitchellkrogza/phishing/pull/372), iwan2travel[.]com (https://github.com/mitchellkrogza/phishing/pull/370), applesforfred[.]com (https://github.com/mitchellkrogza/phishing/pull/369), theaerie[.]ca (https://github.com/mitchellkrogza/phishing/pull/367), nico[.]sa (https://github.com/mitchellkrogza/phishing/pull/366), ajstelecom[.]com[.]mx (https://github.com/mitchellkrogza/phishing/pull/362), and others (more than 130 domains since 2021).
Phishing Domain/URL/IP(s):
Impersonated domain
Describe the issue
This domain is now hosting the phishing kit that previously at lebomashilo[.]co[.]za (#462), havenhills[.]za[.]com (https://github.com/mitchellkrogza/phishing/pull/459), intrinsicisle[.]za[.]com (https://github.com/mitchellkrogza/phishing/pull/452), reluzformaturas[.]com[.]br (https://github.com/mitchellkrogza/phishing/pull/435), abcmueblesbogota[.]com (https://github.com/mitchellkrogza/phishing/pull/432), ergoterapiacaribu[.]ch (https://github.com/mitchellkrogza/phishing/pull/426), ijconnects[.]com (https://github.com/mitchellkrogza/phishing/pull/421), cbcaps[.]shop (https://github.com/mitchellkrogza/phishing/pull/417), bersowir[.]org (https://github.com/mitchellkrogza/phishing/pull/416), brunotasso[.]com[.]br (https://github.com/mitchellkrogza/phishing/pull/413), wisbechguide[.]uk (https://github.com/mitchellkrogza/phishing/pull/408), pescacancun[.]com (https://github.com/mitchellkrogza/phishing/pull/406), bkengineersindia[.]com (https://github.com/mitchellkrogza/phishing/pull/405), englishplusmore[.]com (https://github.com/mitchellkrogza/phishing/pull/404), carnesboinobre[.]com[.]br (https://github.com/mitchellkrogza/phishing/pull/398), technowide[.]com[.]tr (https://github.com/mitchellkrogza/phishing/pull/396), jestertunes[.]com (https://github.com/mitchellkrogza/phishing/pull/393), safecartusa[.]com (https://github.com/mitchellkrogza/phishing/pull/391), foreverfarley[.]com (https://github.com/mitchellkrogza/phishing/pull/387), azezieldraconous[.]com (https://github.com/mitchellkrogza/phishing/pull/381), westernautomobileassembly[.]com (https://github.com/mitchellkrogza/phishing/pull/376) , littleswanaircon[.]com[.]sg (https://github.com/mitchellkrogza/phishing/pull/372), iwan2travel[.]com (https://github.com/mitchellkrogza/phishing/pull/370), applesforfred[.]com (https://github.com/mitchellkrogza/phishing/pull/369), theaerie[.]ca (https://github.com/mitchellkrogza/phishing/pull/367), nico[.]sa (https://github.com/mitchellkrogza/phishing/pull/366), ajstelecom[.]com[.]mx (https://github.com/mitchellkrogza/phishing/pull/362), and others (more than 130 domains since 2021).
Related external source
Screenshot
Click to expand
                