I've recently stumbled upon a pretty interesting phishing campaign including the actual hosting infrastructure behind the campaign where I've decided to share my findings with everyone in particular the fact that the campaign including several other which I'll profile in this post are currently hosted on Ipfs's Web 3.0 infrastructure.
Sample screenshots include:
Sampe URL redirection chain:
hxxp://trustwave-ibank[.]com/l/LiinkedInhardest/900/ -> hxxp://kit[.]fontawesome[.]com/585b051251[.]js (b5a82299925ac96a1454732ab97f2bb5) - 104[.]18[.]23[.]52
Related MD5s known to have been dropping the same identical phishing infrastructure javascript obfuscation script include:
00666c31b9016602ffe0eae49a5e4ee5d4a079ad101c8e70aa1cdd2295e3937f
009710a0792b2f8dda23bee9f79644b3b19d092962d09aec19eff04d217d1f94
01db44f671d5b9e2ed3ca4a7f2e9d58d9887fd28d54d5b1d531e14ba8df47f6e
03026db9bd10d9d980923a457f2774497a34c96bea1ebf7cb74f13383af2271c
03763ee4d8e0d5e495fc8966702f3933f8f1547b25804038ab89acab01cb67df
03c186b5d249f5c9ded786871d5cc99130ce8c24c54bf8151868ee03c2db0a6a
04527364ea88ac8a81af4e4c0da13221fc31fac2d17ff73e11ecdaa8975b9596
0497603023cec2168783ec0a9d29e5b9f0d3e40e6b832b205892fcab82bbd0ed
04ee5db7857c070cde6a99962fd71d9d0f4bf5a23a5203605b0f23e10de649d3
067e21f3b35b0fa5ac87c47b6b87b3f5e8f14928e8028fba92b79a29c404a84d
086d54913106d49ceced058de30b80732cb57b68b9bf1ad75e0535fe48a737f8
099afbc81e7c19775fc09a26d75b10997e36ae0fe23dd078c131a963fce15896
09cdc9b2be4d497be6c3392ff2cdc8a2145498a568110c99cb2d285945d8a3c9
0c5cd0f3718725137d566f1892ff4c3aaa4ef31dcec98ca932f7315306352144
0d5aa9847cb1cada491651830baf32a7b255464bca14fc787663a55cdb02e3c6
0ec1d2ca6f2f015f2440cf6b16ec8fab91208b23524d93f77b7734189590abc7
0fb5d884ea6cde5c7b4bb5ae590a0971f7cb2ae6e9d110d89b1c57b006d13a81
11c6248d01c2c52fd93f4e1676ede5afe332b32303db5e4d4b813285c2fc2a25
11cb76d18eb86a1a55b2d6d0da43c361501a67826b9bf43b774a5bfbf3b6a203
12c6f1f85e3a0bae45a13e8fa70c37a35782fd8ed4a05eb35e4704c0a0e09105
12f06ca666f09b7dda09f399896024e3344fe19d243dacd7eb2698ca9bb94530
1300a1f6e068d2362b958a53ee4ded3e6ed7b63b04649d3f8a708d8ce5e33ca0
14922a4bc2884913ab6e57b1965e82181b06cac1b6261c3a16475a4fbd3735ce
15449d0dc1b76471fc269cdaa37d2e5f10fb812f417d5d271b7aefc63e6ae137
15ac93c9c5be20926f8b58084d71900c3e846abaf053a54bee19db41a6c709da
15ff41a7b686de66a8cb47dbf37006966dd81b5148ca352532b605551a0c6a0e
1806f6e00b38287c20d58104a7d3728223e4171f57f3b36844e178d44995dc0f
1846902858f655ea58b601568aa80ecbf1b54bceba87875dd01dccad75918e36
1882fa1bed2a53a486dc07f4eb1858e6b9233402ef0f7b475246102189e8a405
19915d17f3bb2c2f6cba6d7c8f70fdc1d3793d811d5d6ee21e9253b17fc24c1a
19ecf0308f99a39fcc1124c6b67a486f43b10460e4810eef69089267d69edb09
1a0b8de3d820d16121d6435726b496bd281b2537e83b2ee8ec5fcceb87f2a623
1ab79910d98da1afabe2e982392b5c71ba5a28d6396cb5d49570f0bc06b595d2
1c7cf6889ff637ed4d2148122235f9b44367d3b1ba4305ae2b2e126ba26147c9
1d94581a181cd2c1be0d6329936c715a6cd39fb2a09d912de95699c37527ae41
1dd547317b93f57528fa914c0cf791eeb396736fe8876132680cc39f3dc77d2c
1e85b60b46b9683a64e466785a5bf429025aa651cf7a84765740eef7deffaf8d
1eb4424393a6f3846816f47cf68012de2f8407d5b1f9a93f67c1b620f3eab3de
1ec05ec963b867ad5df3e8deba62ac3d35b5ec8d5064fc541f848a863dedfd6e
1f9123ec02d098965c87ff2d24ab0b1b6bebf1ee5be4505896717f5b8762c924
2022f9b2f554dd627190f25f3873e9bc83ae3a8222f8cbeeb3944ca14c5a78b0
205c0eac682985f26e8e0a365dbd7341f9b14ca7c43f0c969da861f0163bffdc
20b9787348f3c6cf47aa38e61125563adc32fa5d849c87f7409b60e23c59f510
212a8b969ddc4dee979b49c95255fcc6a7ef8c53c61f3298730a69ae724d239b
215ff84fb3036e712bd0d12f088ee233153f4fb12508100e08230372e33d44f2
21b748624f3a1e051a500d58ba040da5f8b2ea70a8532b6d088b1a2c07b75ecc
21e9c9d74b660ea8bf9cf36e7dfd436df609392127a7fd2d25e4a73eda7e6ca6
222b8e161cbc5fba915d20ed6c3f0c6f7526ca97890d8c24597ce545b1e212fb
232ecd1594f1bc189386283aec3f58a0faecca1dd1104c80a65b54a379716c87
2337b867ba75be2ec6f1875c936c334e690e70803836f228218b373c59af2fcc
2468c116fbc5bb5d655cffeffd719713ae452acd1e3c78bd2c9feb095cd5cbe8
2490346bab166bda27784aeb6abfb901ec8c31886352d977c5d0536c678b43fc
25add11d66040c5756d6e1cee59bc3e9c5ecd14ca4dd5b0c9ed991b933898c07
25f587f9293cf6df19255c64eb29614331201b3b47072195ee0cdda55826d534
2663c11155339c9da783a558efa38c25f428aa86bb5399c25f1eb1d25e732f97
26819f449dbfd75ebf2bbb5b6cf21229fd938d057771a9fd74ac28409111d2a0
26b2c8ceb1d451d1e93ff1c6229b777e77616abd07b64bac2559c18af267f1c2
29344e7092d7812f3e3d66223245b28258cceca3aef7450446094f2a4afe43a6
294a220cfa3675df66875b81e671600b72a00089bc7fc533c38bba972b83df40
2a48ea40bda49df5299b61352a8517844514c737859121308bea23fdb36ef2a2
2bd621264997b87796442ebd3cef538f513bdd760eeda865b5fa01bd0c6ae93d
2cd75ebd673f90ffd220eada6c23a7c3ba6bd65373f2ad21f04e9fe0a3330a2f
2cf6f97e357019bcde90cfeb07d664c27738ac57c71878274a68b168c1ff362c
2ddc96ce6263cb86da936ca7bffdaf14ca9fc282bf3191c773e2a2138b59a211
2ee32b86f64f031ba0ea9c0338e5a05d755afb2f92d6345cfed12869b2b229a7
2ef37e17c2d4e7bbcaf32d1a3cbdd930dee84cc69ad4b5c5b61d7e668371e471
2f6536cd2911877579d15f06a8cbb9e8a1b38b30fbba1e02f87656506ed14e44
2ff46bcd28e4741fa3ccd7168e0bfb3c726feeff9f485009a6136e8c21dc7328
316d5e87447ff9ae455f39943a3f62754ab8bf59b58ca01e536bdbc35a398cbc
316dc156b5cbc2667a692e0c4b2872e36fd40a557b56039aa1e8b78e955aa905
31a252de3cda5129ee70ad35e122d0c16f8d1588cbd800ad335e93f25852ad32
32c02dca3807ee08769be869298695c0a6f42a85567184f6041da6798cfa95fd
32e7e27ee627b7f5f2cc87646806a1dc418e658a6bad41ee120ce71d97bee711
33e3bdda78378fc3176e4366fa4307cfa08e6ec5d62a6f4b965ad2cfe98ba24b
346ab3fde761b60b51e396d9c6f73fe422f35cddc15f7df82780c4050b9dabc3
36b2ebd67e048f439bedb33e715c90f628780654e7cdcb5a0576e568fe8c39b8
3710fa3fa5f706a79b052f37f0c9e21bbd23d20fb2012be847cf250315181436
376a64bedc7e8d6765d95b93e820756ca7ef387d24aa45297b1d825d25ecaa0f
391b3c42a7a085bf8faed2d50d7d27aae15a1f02bb9d5fb2b6addd0b388b8575
393a47fc36abdb40dca0c284eb095901fb849143789761665ee2598d993bb033
39587f141a90d4946782c95e75d672932749304aa32dd7fad1d9974f2d691d63
3a6e2cadd8d4303ef21e39dcac3d2416cac6b9f514059d8184e7bf11ee77b801
3bed8a6e4eb5e9ca916bd155906fe707ae1dc41c31c1ce7e796b480196d6a2fb
3e0169e424bc5395904bcfdf9d0f7e6f7fafc7d3d197f228fef3e974677deac0
3e9bba8ba18dbacae4c63faff36dbc2d6188c11fe2bad163988718033fce2df7
3ee695468e4afb12c30e2dc37935828e06d0866637cd572901c88a4d8c211fdb
3f0323572f48ebac6d75fd67359c580135a30d80a7693b520b9432d9146d86e8
3fc2b3fae8147f6649aed2a8719b8771778edc048599217d0cd22c5e70d0dc39
3fd8180a923869ea42540151e384cfcb163d07dedc05b1f9142a970c3dbca614
3ffe69c9e2e2f8a350f7d2ff6e64acf8cffbf390489807b81cf8e4eec87d4047
4011f7d71001982ea1c6815cbe6e747f19bbee86341d8f2807fefb50e080e84e
41cab898ef2d99eb5fe129985763228bb1d102dc66842889d1be4a1139aceb5e
431250db0267a5c5394c50bcdbcb1e34475a185c953f6c7b25489044cb83ebdd
439c8179f7f16d025a756c5e27da17a2dd1a38475bcefde51f8a391f7ec30321
43ec07a0ae1787aed9f382d6f961843c84966ef8669bc7b71c875cd9c17a7a54
441ca3aad8111e0c425948750485d274575b7fa26e00ddb23c429fd260a9c0be
447040fdadfb03b1c7883145193596975fd216db539c3079aa0a9ea9fd68a8f3
44b03e2f300a980f7d8b43a740049913a1513252602dc7de4f4024569ccbfd9f
44d79abd26345b8bbe8603be4d607f994564e7a96f6444c8799cca8316414947
451a2fd94d0ac232e8d243f9f4ddad0a1709048a58365a52240d493cb6f26990
45e7bef47288c638566e1f0906edd51f1ee1d3dc137539a291d86f983a0c954f
4676c4353bfbf014021ad1ce7a59f9a863841904a9639f064b9f5b7f0ab6ba0a
474ec542cc0db502612b2df8df7f06e5d46188cc5c25a19218596af184fddd35
48b6c7a03efb45af665a1a0c291d7ede66560a2da00c9577da19bab3ff23bd43
4aa7eb4a4e1c54d6f990cda0b1789e2bc38028e599bf97db72acc137b68a5891
4bee28337a884c4e60834323630c8c81cefc02ab4144b7d4657817aebea02365
4d0c99bef69a899989b4fd44524616986fcc5c10346f1b74cbec9e3c0c05293f
4de00d4f21465260f7d67d3fc829ba7124ab5324def519398dd98fa74f675f95
4e6f0988adc75d578451338397710b3f9e07de7b3530335db64da5f0d9b587b3
4eef76df493c9cf94149366517a6bd8bd7f4210b548c2766067f2cb00c1dce50
4f4cfecce8e006d342624d6df77527229fc19a72d62e20b83a58724e2d9309da
4f57ba579a15bd0bced0e1aa31fdcff9806c007b004e4fcb86532e69e52fd734
4f9c8e494ef8bc6f94ebeabd6bab4776db239778031e1596db370c74a3c94422
50f60b18f9b006f453512f629112286b804226c82efec01843161e7851137c00
51be858e35374462a81d6ac2255c62c7aec3eef37f5a25340d8c9602f9fa60bd
5266c8e3ade83d4aadce4277ddc59dbc68262030e4ad2dd37273c1370aef65f1
52c02a0f2d6ada3b0e277df6cdcdaeb9e3c232c9c1ffbfca609a316c93d017c8
539f252b37e7b1f2b94f513e91f979e026d0a0999d51e09a0624cbbfaaeae479
53e26d3ea6898d8e6d96336bc0e1ddad21843e4bdf18876522b4dd26f2fe5572
53eed8562c117904b218b2ad0976e43b499c7d70a267b377cdd887fad1d3a29d
55cb6e4d3cca245586ab253f83022aa6480373ee45c62086085515f39a26f318
55e10e3ac2342c0ac29e8a6007e51c852edfc1218c431369a5b1b0a1dd7e2253
5669950c16d76be24f5394983c2e91d22b6b1582ab1e78699ed533df6dcbc192
56ae25ec5b26379514f3cb00a72e4964b94173eb369c5f05e34fe749d6e85d2e
57a02fe0a187a210042ac518f4f55e3452f9bd1aa1680d3ab4437d7ba6c58c43
57d70632eee9752d450ba8fde366824c5e195c6624c910e272f5d30ccad3766b
581042b5b9b2b4d37dd670341f556f98791562739b4c3fe3f416e83163051e32
5863c04d10382cd956f87433d2bd68dcac68eda7c88d7f5970eac64b60b33f73
586613a2506f708c525ba505a0724217d957987cef748931a0834c36e83adc66
5958185f009aead056104cf9525882d685d5e739bea465325e21307857270b71
596eebdb10185419a2e5f5b1836b7d11e472f637f63b0612219bfddee1793d29
5a98f67175dad747f2b4d3cc79bfdfd9fe28b4f2528d1b7f4799d27f62a39231
5e2c927c0a5b6fdc9884bf1e212554942ff72437005f88611e3dc635c0a28a72
6148471c594ff12e93a4dbe51d0ea958cc590d1852426c656a47e0dc8a95ad09
6171d9d842177c2519f7d0bfc3982b341b0f6fb9de3d72f09cbb10e991114c17
61a385620023354b1ed3943c013c283e7ac8e0225090d413e1f15c6edc7b6170
6200f1e6b2c758e70b2e9f2f3166e4ed5f595081a36db3e647ed516272054ee5
627f1c4522ebd5565d288793080603b32a0cb273d30920038669b50aff38efa4
62e51d2de62215019d0c9d4a52ad1760cc18644b96797ffff90aa887d804ffe5
62f8c035666fe30325747701cbe7de11cbd2c0094c207ed9feecb76f970683b9
63df016ec0690ddabd61a6e499a6e01ff48b5d4f46e58d67b581fc22654f9005
6409677afc12251078de62c98d0671a6a1ce1f72217bcc5e084b5f84f8a6c79c
64232a4dd1719fc9c4a5c7f00adbd4529dec86e5a956e4ba82ff0aa7e15e0f01
66d77c256b453f9cefed52b35b9c82f957f0669316acdce52d24958235c4742e
66f43fbb336dc9d743759dbe147113645336e62a35ddd0e25cc506b1e11ae86e
67262c8857e4f6b68673ba61b19c5fc9b81552794c9f2768a92e675ca68abea0
673722230f682ee92d16e719f85652a34ef13664ab1341d6d49b90b904b4b455
6764adef097a27375ea4a5921e51dbd8048ff45f10c8ab85d5050433df0b6334
67b71691690e9cc56ca2e67a6889bfc1c92add9a1a7a3c499779f2492d8fe5af
69b9cce961ce3985c54074aa2c9bc7632969380998078b9c8963ec3031b1bf67
Sample domains known to have been responding to 104.18.23.52 include:
hxxp://bafybeifoiwykvei2k2bk5neozkm3f4gdbh6d2agg27alkqq472q64kfcvu[.]ipfs[.]w3s[.]link
hxxp://bafybeiarfn4y7pqaowxql6wbkuhi5izp76feqm5oockodhtskvv4h74kne[.]ipfs[.]w3s[.]link
hxxp://bafybeieq7yeiaqgp6xqpkxqg3znepunq6taakmmb4343a4wxyp4vq2nikm[.]ipfs[.]w3s[.]link
hxxp://bafybeigvjkqkq3s2sz2stcqjq5uve2o6rmiew2occt4bazz62lqbnoj7ku[.]ipfs[.]w3s[.]link
hxxp://bafybeid2udy66wb3k5tvouvyh5vlkzod7jtknlwp3buk4c2rc3vb5p4rja[.]ipfs[.]w3s[.]link
hxxp://bafybeicdnf6pnveieqielvgfd4dgfwb4bs3er6tdv54z3ajxiartcgtwza[.]ipfs[.]w3s[.]link
hxxp://bafybeigxwyg4nnyy62gxpzkc2vker42l4zab3dxm64tqspivlqxtyxojoy[.]ipfs[.]w3s[.]link
hxxp://bafybeieoehbi3bozw4rhtadsuw3wizt6or4dm4afhocd52nt2w4mwmcjsi[.]ipfs[.]w3s[.]link
hxxp://bafybeiah6u2xz7u7lgqbrcjx7dkleth7od2ruwb763scrx53uv6dyyidte[.]ipfs[.]w3s[.]link
hxxp://bafybeiarotivhlx6aowgrqr7wwpnph74fsvk7ausj5amtz4lz2tgtsscf4[.]ipfs[.]w3s[.]link
hxxp://bafybeigno2w5vo3wft7vaiw2emsokkdp3q4fxj6jofuoeki6pr5itmjvxy[.]ipfs[.]w3s[.]link
hxxp://bafybeibgwyojlbt5hivhyxftcmdiiwd4xsx24l3zuyintzqdcqlmgtyssm[.]ipfs[.]w3s[.]link
hxxp://bafybeih3semybz46v2auyau6bwbb6bmn4vnnadw4ra6pyifniuamwhebdm[.]ipfs[.]w3s[.]link
hxxp://bafybeihg2js6ljraoyz5agtnqwngknvtqzgcexfaqq4ifu57s3hmve67hm[.]ipfs[.]w3s[.]link
hxxp://bafybeic4y7xrpjrqp2jubl3btgyjd4vu44xp3t3v2sdyaquxt2oiamiuju[.]ipfs[.]w3s[.]link
hxxp://bafybeibn67lgqdwhfpf3bl5vg7bako3e5x5bj3b5uxm3oxn3lcz7xbrrnq[.]ipfs[.]w3s[.]link
hxxp://bafybeicrq3hypfwbpqhncpcubit7xrnvfncw34s22jc5u622e6zgit6t5q[.]ipfs[.]w3s[.]link
hxxp://bafybeihmtlbpmza7wjzvjsomq6kaestvee2oszw2a5pimjhpxtju7p4msy[.]ipfs[.]w3s[.]link
hxxp://bafkreialqhpgku766iujjzyvkp5ti52svsidzmxh2m22volxvsqitvxjqi[.]ipfs[.]w3s[.]link
hxxp://bafkreidjv4vdxf7pl5b2hctutntnapfjorzd3dfcft6t23wkbveguyndmm[.]ipfs[.]w3s[.]link
hxxp://bafybeicwr6xv2jvegkulb7aelxftow6ipqqiyumcrl6yonyvrqjh6isyfa[.]ipfs[.]w3s[.]link
hxxp://bafybeide2cap7dwaz7noybtd6rkj75afd2g4ktgndfhoijhm3hixlbmzlm[.]ipfs[.]w3s[.]link
hxxp://bafybeibzdym2xb6sticxgaejsykxj4inc3li5dyecapdv7ursp6vilw54e[.]ipfs[.]w3s[.]link
hxxp://bafybeigpvsxliiqp4zrzsvtox7f45w3kxlihnfv7lauby3pv2pmjbtxb44[.]ipfs[.]w3s[.]link
hxxp://bafybeif35ymavla27r645kib4tcgve3qlrzubbijzhq3dscrbmcihj6mya[.]ipfs[.]w3s[.]link
hxxp://bafybeiggma2d77tefczrifpz5wwvhvw2wrcfko2wdk7sifdd33kmtc5zru[.]ipfs[.]w3s[.]link
hxxp://bafybeia2h5v7itkdr3c3njrktfxpnucn7hjlrxtr2wegy2bawd6muumscu[.]ipfs[.]w3s[.]link
hxxp://bafybeia5aj45vwoxl3ieojp2ek35c7cjbz6zqp3whlly5zhllcrjz5hqfy[.]ipfs[.]w3s[.]link
hxxp://bafybeiasmsxxjzhmrgusj3tussufqz6vt63nupiv2mvffvz4ksp6yiydf4[.]ipfs[.]w3s[.]link
hxxp://bafybeifo3sytrpilq7t2jshaziweqy7zyk6whzh3quta6jnjbg5v7nslae[.]ipfs[.]w3s[.]link
hxxp://bafybeif5m3nfcet6xtxuiocna7pesiiepo76apkndx2vry52elx2x7px2q[.]ipfs[.]w3s[.]link
hxxp://bafybeiaemax6uhu6t2ujov3uzdufnbcrdzs7hdwtict4h3ucoxrb4whbey[.]ipfs[.]w3s[.]link
hxxp://bafybeifv53owjok44tyv7mcge3kpehmfbdtnpfgof7heik2j7pneg7eai4[.]ipfs[.]w3s[.]link
hxxp://bafybeibew7lk2mf66wa2gi6d3ezutp336vp377c2hiilib4bdzhrji2wve[.]ipfs[.]w3s[.]link
hxxp://bafybeicsrkxc6pvn2nwzd2wivjwf52n2mn52ulmwhrwndbebmlebpfrhpi[.]ipfs[.]w3s[.]link
hxxp://bafybeifrq3vagytnbl4uw7hqjvpgdn57pdksuvdg4ovtblsbqrgedk56nm[.]ipfs[.]w3s[.]link
hxxp://bafybeibgivahg2moxn6qoqttk2fbkcuvmjhmxxi3bz4tngcjqiyrr2z4vi[.]ipfs[.]w3s[.]link
hxxp://bafybeiftny55ajmwwwzmmyxxjld2aowz663iza5ti3raxukknv7bqqnk4q[.]ipfs[.]w3s[.]link
hxxp://bafybeigbpv4lfshncbqlgvnupht3h6tkcmrermyu7ctvfzoqcu62oshq7a[.]ipfs[.]w3s[.]link
hxxp://bafybeiaix7ewvyraltg67j2puatq4xllzvoch3phd3hop32rtwn2jn4dcu[.]ipfs[.]w3s[.]link
hxxp://bafybeigsx3nzfrocrgg5sryqwb3rcfw7g3oorzug3elm3zk7hjpkablpse[.]ipfs[.]w3s[.]link
hxxp://bafybeifzbqdck3anxdc52kqt3cztk2fwwmls2y574jd22moifmfsvpcxae[.]ipfs[.]w3s[.]link
hxxp://bafybeidit3mup6cs2j6zr3ggs6rqjwwcmm7uahw4izkopn7fihkrdczr7a[.]ipfs[.]w3s[.]link
hxxp://bafybeie2bfzupd7ak53xz4imo4lytra5dlr74zyshuapokjwlvkltqle5e[.]ipfs[.]w3s[.]link
hxxp://bafybeihlwm5wosfdfep67kpxsposkmfy2pg4ty2y6ovgyqeblc5mtq5rsy[.]ipfs[.]w3s[.]link
hxxp://bafybeigqbqkmlulrauaxjq5mw2sjvml6ysjmsvgkourxm6t7gncqiejnum[.]ipfs[.]w3s[.]link
hxxp://bafybeifukg3y6ktng4u3bhwtigo7w7kgy52lbhsrtb2kgyxzc5ihzr22bq[.]ipfs[.]w3s[.]link
hxxp://bafybeigpjhe4o44q4cycljov3zzkdl2ryjvv57lmr5pvekgtjye7budrxi[.]ipfs[.]w3s[.]link
hxxp://bafybeicqu6eclqdjlu6h6q45voumkz6oef5qbgsakuymiaovt2ft6qtzie[.]ipfs[.]w3s[.]link
hxxp://bafybeibucwomwhuava46rcskf7vp56lb2eekoqbg636t3nkfmizzysgrye[.]ipfs[.]w3s[.]link
Stay tuned!
No comments:
Post a Comment