With cybercriminals continuing to populate the cybercrime ecosystem with hundreds of malicious released including a variety of typosquatted domains it shouldn't be surprising that hundreds of thousands of users continue falling victim to fraudulent and malicious malware and exploits serving schemes.
In this post I'll profile a currently active fraudulent and malicious typosquatted domain portfolio successfully impersonating Facebook and Twitter for the purpose of enticing users into interacting with the rogue and malicious domains.
Related domains known to have participated in the campaign:
hxxp://sm-url.info
hxxp://sm-urls.info
hxxp://smurls.info
hxxp://smirl.info
hxxp://smalladdr.info
hxxp://sm-irl.info
hxxp://tnylnk.info
hxxp://tnysite.info
hxxp://smalink.info
hxxp://profilelink.info
hxxp://muypix.info
hxxp://profilehoster.info
hxxp://quiklynk.info
hxxp://tnyur.info
hxxp://skurls.info
hxxp://smrls.info
hxxp://smulrs.info
hxxp://snurls.info
hxxp://link-out.info
hxxp://make-small.info
hxxp://make-tiny.info
hxxp://makesmall.info
hxxp://maketiny.info
hxxp://maketny.info
hxxp://mehprofile.info
hxxp://muhprofile.info
hxxp://quickprofile.info
hxxp://quiklink.info
hxxp://quikprofile.info
hxxp://small-url.info
hxxp://smalllink.info
hxxp://tinyout.info
hxxp://go-out.info
hxxp://out-link.info
hxxp://tny-url.info
hxxp://posta-link.info
hxxp://tiny-out.info
hxxp://private-pics.info
hxxp://private-pix.info
hxxp://coool-pics.info
hxxp://sxypics.info
hxxp://sxypix.info
hxxp://my-link-out.info
hxxp://my-lynk.info
hxxp://go-to-my-pix.info
hxxp://my-profile-lnk.info
hxxp://smaller-link.info
hxxp://smaller-urls.info
hxxp://pics-url.info
hxxp://pix-url.info
hxxp://quick-pix.info
hxxp://quick-profile.info
hxxp://pics-links.info
hxxp://pix-links.info
hxxp://check-my-pics.info
hxxp://check-my-profile.info
hxxp://check-my-link.info
hxxp://click-links.info
hxxp://my-photo-profile.info
hxxp://photo-profile.info
hxxp://my-video-profile.info
hxxp://video-profile.info
hxxp://hotvideoprofile.info
hxxp://my-videos-profile.info
hxxp://myphotoprofile.info
hxxp://mypictureprofile.info
hxxp://mysexyphotos.info
hxxp://mysexypix.info
hxxp://mysexyvideos.info
hxxp://mysexyvids.info
hxxp://mysxyphotos.info
hxxp://mysxypics.info
hxxp://mysxypictures.info
hxxp://mysxyprofile.info
hxxp://mysxyvideos.info
hxxp://mysxyvids.info
hxxp://myvideoprofile.info
hxxp://myvideosprofile.info
hxxp://profile-link.info
hxxp://sxyprofiles.info
hxxp://myhotphotos.info
hxxp://myhotpictures.info
hxxp://myhotprofile.info
hxxp://myhotvideos.info
hxxp://myhotvids.info
hxxp://my-photos-r-cool.info
hxxp://my-profile-page.info
hxxp://my-cool-profile.info
hxxp://my-photo-spot.info
hxxp://my-profile-spot.info
hxxp://my-video-spot.info
hxxp://myphotopages.info
hxxp://myprofilepages.info
hxxp://photo-pages.info
hxxp://profile-pages.info
hxxp://videoz-profile.info
hxxp://myphoto-gallery.info
hxxp://myphoto-spot.info
hxxp://myvideo-spot.info
hxxp://myvideospot.info
hxxp://show-my-pictures.info
hxxp://show-my-videos.info
hxxp://show-my-vids.info
hxxp://show-off-pics.info
hxxp://show-off-vids.info
hxxp://show-your-photos.info
hxxp://check-my-page.info
hxxp://show-my-picx.info
hxxp://show-my-vidds.info
hxxp://my-profile-site.info
hxxp://profile-sites.info
hxxp://profile-space.info
hxxp://view-my-profile.info
hxxp://view-profile.info
hxxp://profile-link2.info
hxxp://profile-link3.info
hxxp://profile-link4.info
hxxp://profile-link5.info
hxxp://profile-link6.info
hxxp://profile-link7.info
hxxp://profile-link8.info
hxxp://twitpic-1.info
hxxp://twitpic-2.info
hxxp://twitpic-3.info
hxxp://twitpic-4.info
hxxp://my-pictures-domain.info
hxxp://photo-profile-sites.info
hxxp://picture-profile-site.info
hxxp://picture-profile-sites.info
hxxp://picture-profiles.info
hxxp://video-profile-site.info
hxxp://video-profile-sites.info
hxxp://myprofile-site.info
hxxp://photo-gallery-sites.info
hxxp://photogallery-site.info
hxxp://photogallery-sites.info
hxxp://theprofileiste.info
hxxp://photo-galleries-1.info
hxxp://photo-galleries-10.info
hxxp://photo-galleries-2.info
hxxp://photo-galleries-3.info
hxxp://photo-galleries-4.info
hxxp://photo-galleries-5.info
hxxp://photo-galleries-6.info
hxxp://photo-galleries-7.info
hxxp://photo-galleries-8.info
hxxp://photo-galleries-9.info
hxxp://unrated-profiles-1.info
hxxp://unrated-profiles-10.info
hxxp://unrated-profiles-2.info
hxxp://unrated-profiles-3.info
hxxp://unrated-profiles-4.info
hxxp://unrated-profiles-5.info
hxxp://unrated-profiles-6.info
hxxp://unrated-profiles-7.info
hxxp://unrated-profiles-8.info
hxxp://unrated-profiles-9.info
hxxp://unrated-profile-1.info
hxxp://unrated-profile-10.info
hxxp://unrated-profile-2.info
hxxp://unrated-profile-3.info
hxxp://unrated-profile-4.info
hxxp://unrated-profile-5.info
hxxp://unrated-profile-6.info
hxxp://unrated-profile-7.info
hxxp://unrated-profile-8.info
hxxp://unrated-profile-9.info
hxxp://r-rated-photos-1.info
hxxp://r-rated-photos-10.info
hxxp://r-rated-photos-2.info
hxxp://r-rated-photos-3.info
hxxp://r-rated-photos-4.info
hxxp://r-rated-photos-5.info
hxxp://r-rated-photos-7.info
hxxp://r-rated-photos-8.info
hxxp://r-rated-photos-9.info
hxxp://r-rated-profile-1.info
hxxp://r-rated-profile-10.info
hxxp://r-rated-profile-2.info
hxxp://r-rated-profile-3.info
hxxp://r-rated-profile-4.info
hxxp://r-rated-profile-5.info
hxxp://r-rated-profile-6.info
hxxp://r-rated-profile-7.info
hxxp://r-rated-profile-8.info
hxxp://r-rated-profile-9.info
hxxp://unrated-gallery-1.info
hxxp://unrated-gallery-10.info
hxxp://unrated-gallery-2.info
hxxp://unrated-gallery-3.info
hxxp://unrated-gallery-4.info
hxxp://unrated-gallery-5.info
hxxp://unrated-gallery-6.info
hxxp://unrated-gallery-7.info
hxxp://unrated-gallery-8.info
hxxp://unrated-gallery-9.info
hxxp://profile-unrated-1.info
hxxp://profile-unrated-10.info
hxxp://profile-unrated-2.info
hxxp://profile-unrated-3.info
hxxp://profile-unrated-4.info
hxxp://profile-unrated-5.info
hxxp://profile-unrated-6.info
hxxp://profile-unrated-7.info
hxxp://profile-unrated-8.info
hxxp://profile-unrated-9.info
hxxp://iprosa.com
hxxp://sm-urls.com
hxxp://snkirl.com
hxxp://tnulk.com
hxxp://smulx.com
hxxp://tnysnorl.com
hxxp://supalnk.com
hxxp://tnyweb.com
hxxp://smlnk.com
hxxp://profilehoster.com
hxxp://make-small.com
hxxp://my-link-out.com
hxxp://url-out.com
hxxp://profile-out.com
hxxp://tiny-out.com
hxxp://posta-link.com
hxxp://coool-pics.com
hxxp://twitpics-1.com
hxxp://twitpics-4.com
hxxp://twitpics-2.com
hxxp://twitpics-3.com
hxxp://profile-video-gallery.com
hxxp://fb-photo-gallery.com
hxxp://fb-gallery.com
hxxp://profile-photo-gallery.com
hxxp://profilegallerysite.com
hxxp://profilepicturesite.com
hxxp://my-profile-gallery.com
hxxp://profile-gallery.com
hxxp://profile-galleries.com
hxxp://her-profile-pictures.com
hxxp://her-picture-sites.com
hxxp://her-photo-site.com
hxxp://gallery-link.com
hxxp://her-photo-sites.com
hxxp://her-profile-photos.com
hxxp://her-profile-out.com
hxxp://her-profiles.com
hxxp://her-picture-site.com
hxxp://photosites-now.com
hxxp://photos-for-fb.com
hxxp://photosforfb.com
hxxp://photo-galleries-onilne.com
Stay tuned for an updated set of typosquatted malicious and fraudulent domains impersonating popular brands to be published anytime soon.
Independent Contractor. Bitcoin: 15Zvie1j8CjSR52doVSZSjctCDSx3pDjKZ Email: dancho.danchev@hush.com OMEMO: ddanchev@conversations.im | OTR: danchodanchev@xmpp.jp | TOX ID: 2E6FCA35A18AA76B2CCE33B55404A796F077CADA56F38922A1988AA381AE617A15D3D3E3E6F1
Thursday, February 07, 2019
Historical OSINT - Profiling a Typosquatted Facebook and Twitter Impersonating Fraudulent and Malicious Domains Portfolio
Tags:
Facebook,
Fraud,
Information Security,
Online Fraud,
Scams,
Security,
Twitter,
Typosquatting
Independent Security Consultancy, Threat Intelligence Analysis (OSINT/Cyber Counter Intelligence) and Competitive Intelligence research on demand. Insightful, unbiased, and client-tailored assessments, neatly communicated in the form of interactive reports - because anticipating the emerging threatscape is what shapes the big picture at the end of the day. Approach me at dancho.danchev@hush.com