Webamon

448 parked domains, 13 landers, one fake "Virus scan: Safe" download page.

Today's Webamon daily hunt: lapsed business domains on a parking feed bounce visitors through an ad redirector to rotating .xyz pages that fake a security check before a download.

The landing links are single use, so replaying one shows a blank page. 448 domains share a single content fingerprint since 16 Aug, and all 13 landers were still hosting on one server at time of check

hashtag#threatintel hashtag#malvertising hashtag#malware

Today’s hunt: 552 throwaway domains, one phishing kit, and Colombian mobile phone bills as the bait.

Since 4 August an operator has been registering random .bond domains in batches, none with a brand in the name, and pointing them at “Portal de Recaudos” bill payment pages themed on Movistar, Tigo and ePayco. Scanners get a neutral decoy page; the lure lives in the title and the landing hostnames.

547 of the 552 would never trip a brand-name or typosquat alert. One page fingerprint finds all of them, and 128 are still hosting today.

New on the Webamon community blog from Sam Dalgleish (2/2)

New on the Webamon community blog from Sam Dalgleish (1/2)

Auto Tagging Fingerprints is no live for all scans