Democratizing Threat Intelligence
Joined August 2025
- Tweets154
- Following0
- Followers110
- Likes117
Webamon retweeted
Webamon found a Calendly-dressed fake bot check that sends Windows users through File Explorer. The pasted command is designed to write C# into %TEMP%, compile it with csc.exe and run the result - no PowerShell involved.
intel.webamon.com/report/d6f…
IOCs:
Observed lure/payload domains:
arrivals-creative[.]com
apt-finder[.]org
Historical Calendly-link fingerprint matches:
foursets[.]agency
fourset[.]digital
#ThreatIntel #Cyber #Malware
138 sites, one kit, and ADNOC’s name on one of them.
Today’s Webamon daily hunt: a fake “AI trading platform” lead funnel localised for 30 countries, with an Arabic “ADNOC Profit” version capturing UAE phone numbers for callback fraud.
138 domains share one page template, all still serving when checked. 137 of them never mention the brand in the domain name, so domain watchlists miss them.
448 parked domains, 13 landers, one fake "Virus scan: Safe" download page.
Today's Webamon daily hunt: lapsed business domains on a parking feed bounce visitors through an ad redirector to rotating .xyz pages that fake a security check before a download.
The landing links are single use, so replaying one shows a blank page. 448 domains share a single content fingerprint since 16 Aug, and all 13 landers were still hosting on one server at time of check
hashtag#threatintel hashtag#malvertising hashtag#malware
2
1
41
Today’s hunt: 552 throwaway domains, one phishing kit, and Colombian mobile phone bills as the bait.
Since 4 August an operator has been registering random .bond domains in batches, none with a brand in the name, and pointing them at “Portal de Recaudos” bill payment pages themed on Movistar, Tigo and ePayco. Scanners get a neutral decoy page; the lure lives in the title and the landing hostnames.
547 of the 552 would never trip a brand-name or typosquat alert. One page fingerprint finds all of them, and 128 are still hosting today.
1
2
85
Nine domains. One kit. A gas giant and a bank as the bait.
Today's Webamon daily hunt: fake crypto "invest platforms" branded БЕЛТРАНСГАЗ MAIB, borrowing Belarus's state gas transmitter and Moldova's largest bank, with the brand swapped between waves on one title template. 9 domains share a single content fingerprint, 5 still hosting at time of check. None carries a malicious tag yet.
Standing query for anyone on Webamon:
fingerprint.scripts:050e33fd98c9333efe4aae3c0c97c0c278b1982b3a397404213e7fe2dfe66123
Verified 31 Oct 2026.
#threatintel #investmentfraud #crypto
30
Daily Hunt, 29 Oct 2026
71 throwaway .vip domains, all registered and serving in a single day and all still live, run one kit, tied together by a single Webamon content fingerprint. No brand is impersonated. It is pure social engineering into an off‑store Android app install.
We pulled the full page and traced the chain end to end:
1. Doorway. 71 disposable .vip domains, random names, one shared page kit (fingerprint.dom:d0a15b8b…).
2. Lure. An 11‑step Chinese adult‑dating “survey” funnel: women near you, a warning screen, yes/no consent questions, then body‑type, age and distance pickers, ending on a fabricated result (“Congrats, 216 women near you, 87 online”).
3. Beacon. On load the page POSTs to 43.213.75[.]63:57866/instatll?tag=Walk, tracking each funnel entry per traffic source.
4. Payload. The final button is literally labelled Download/Install App. Its handler sniffs the user agent and routes non‑iOS visitors to a direct download on kokcsgo[.]com (Android) and iOS visitors to nzctjvr[.]com. Neither is an app store, so this is an off‑store sideload. When Webamon fetched the Android URL it returned ERR_ABORTED, i.e. the URL serves a file, not a page.
Infrastructure: doorways on 43.213.75[.]63 (AWS, ASN 16509) and Forewin Telecom HK (115.126.104[.]19–23); install tracker on the same AWS host; delivery on kokcsgo[.]com and nzctjvr[.]com.
Standing query on Webamon (verified 29 Oct 2026):
fingerprint.dom:d0a15b8bc72e5951fd80f517b77a10948a094b68fc7af85b3effb7401ab9b77e
#threatintel #mobilemalware #android #sideloading
Webamon retweeted
I’m usually more interested in what sits underneath a page than the name stuck on the front of it.
This AI trading template appeared across 612 domains in five days. _pf_hp and /core/submit.php kept showing up as the names and languages changed.
Want to threat hunt it? intel.webamon.com/search?luc…
