pezkuwichain/phishing
1
0
Fork 0
mirror of https://github.com/pezkuwichain/phishing.git synced 2026-04-22 17:18:04 +00:00
Code Issues Packages Projects Releases Wiki Activity
533 Commits 1 Branch 0 Tags
a874ee8e5e4e2497dbc31306a9322a46c1952e7a
Commit Graph

145 Commits

Author SHA1 Message Date
michalisFr a874ee8e5e Update all.json (#276) 
Also, parity[.]site, polkadot[.]money, polkadot[.]gg (all without content currently but scheduled for takedown by our partners)
 2021-04-21 14:13:14 +02:00
Github Actions c25d3849e1 [CI Skip] release/stable 0.6.103 
skip-checks: true
 2021-04-21 12:08:52 +00:00
michalisFr 3c14f50f43 Update all.json (#275) 
Adding wallet-connect[.]cloud (already taken down)
 2021-04-21 14:06:46 +02:00
Jaco f9038fb496 Add polkastater.link (#274) 
* Add polkastater.link

* Use matching fo category
 2021-04-21 13:25:31 +02:00
Github Actions 9aac817d02 [CI Skip] release/stable 0.6.100 
skip-checks: true
 2021-04-19 19:00:06 +00:00
Mich 8dba2e774e Update all.json (#271) 
freshly registered new bad URLs
 2021-04-19 21:57:50 +03:00
Github Actions cd97cadd9b [CI Skip] release/stable 0.6.99 
skip-checks: true
 2021-04-19 12:42:12 +00:00
Mich a74ec4ecec Update all.json (#270) 
2 bad urls
one of them targets uniswap, but also had polkadot option (site already revoked)

the other one is is the usual fake multi wallet connect protocol

also saw
MyPolkaDotWallet.com
polkadotwallet.io

No eminent danger, just cyber squatting, same vendor that wanted 200K for a domain polkadot.co (lol nice high hopes)
 2021-04-19 15:40:20 +03:00
Github Actions c811b7f5e4 [CI Skip] release/stable 0.6.98 
skip-checks: true
 2021-04-18 06:17:49 +00:00
Mich a4f529fedd Update all.json (#269) 
* Update all.json

one polka and a few wallet connect clones

* Update all.json

Co-authored-by: Jaco <jacogr@gmail.com>
 2021-04-18 08:15:49 +02:00
Dan Shields 2c5c234b9f web-unlock[dot]net (#266) 
is this redundant? as subdomains are covered? so we could remove any subdomains?
 2021-04-16 21:45:13 +03:00
Dan Shields b273c4fa92 phishing from tech support (#265) 
wallet address given to "tech support", `walletfirmware.web-unlock[dot]net/wallets.html` was given as a way to "sync" my problems away.
 2021-04-16 20:05:10 +03:00
Mich d8be393d69 Update all.json (#261) 
add new bad URL registered yesterday
 2021-04-16 07:53:28 +02:00
Mich ba00c14cc7 Update all.json (#254) 
just registered
 2021-04-13 19:19:47 +02:00
Github Actions 16a1907e77 [CI Skip] release/stable 0.6.86 
skip-checks: true
 2021-04-13 17:05:29 +00:00
michalisFr 6de10d5789 Update all.json (#252) 
Added bscpad[.]in

for https://bscpad[.]in/whitelist/polkadotwallet.html
 2021-04-13 19:03:32 +02:00
Github Actions 7db9454eb4 [CI Skip] release/stable 0.6.85 
skip-checks: true
 2021-04-13 15:24:37 +00:00
michalisFr 0ea72bf56f Update all.json (#251) 
Added 
polkadotchain[.]net
polkadotparachain[.]com
polkadottoken[.]org

from PR #243 pre-emptively
 2021-04-13 18:22:49 +03:00
Github Actions 70ac205c29 [CI Skip] release/stable 0.6.84 
skip-checks: true
 2021-04-13 06:08:32 +00:00
Mich 507dc35256 Update all.json (#243) 
I am seeing a lot of domains which I am having trouble classify.
They are all named polkadot something (gold, advanced, bank) and always come up with a blank page only with an email address.

advancedpolkadot[.]com - "info@blockchain.st"
goldpolkadot[.]com - "info@blockchain.st"
polkado[.]com -  "info@blockchain.st"
polkadotbank[.]com - "info@blockchain.st"

I would like to check with the team if this email rings any bells. 

If not I suggest to blacklist those just in case, despite them not serving bad content right now.

My suspicion is that those could be used for
- cybersquatting (re-sell domains for higher price)
- SEO reputation gains (and future advertisement placement on yahoo, duckduckgo or google leading to the fake polkadot clones showing on top)
- GeoFenced phish - serving contents only to users of a particular country.
 2021-04-13 08:06:43 +02:00
Github Actions 12096ad39d [CI Skip] release/stable 0.6.83 
skip-checks: true
 2021-04-13 05:09:12 +00:00
michalisFr 91c5f1dea0 Update all.json (#248) 
Added dot-give[.]com
 2021-04-13 07:06:39 +02:00
Mich bf968f25f1 Update all.json (#249) 
add new bad url
promoted via twitter fake impersonator profile
 2021-04-13 07:06:16 +02:00
michalisFr 9cf2d4c6df Update all.json (#247) 
Added polkagiveaway[.]com. Site is currently down but a user fell for it.

Also, oxy[.]dev which is copycat of a W3F grant recipient. The original project is oxydev.ir
 2021-04-12 13:59:17 +02:00
Github Actions 81c070aa92 [CI Skip] release/stable 0.6.81 
skip-checks: true
 2021-04-12 09:20:26 +00:00
michalisFr 1002a81fa1 Update all.json (#246) 2021-04-12 11:18:02 +02:00
Github Actions d60935e4cd [CI Skip] release/stable 0.6.77 
skip-checks: true
 2021-04-11 19:13:28 +00:00
Mich 2d0f0a7f84 Update all.json (#237) 
scam is not even set up yet
relatively high confidence this is ripe for blocking, based on where it is hosted.
(many other scams on the same IP)
 2021-04-11 07:44:48 +02:00
Github Actions 0c4b0e5f05 [CI Skip] release/stable 0.6.74 
skip-checks: true
 2021-04-09 19:05:39 +00:00
Mich 20a8921e16 Update all.json (#236) 
new bad url
also dodgy: polkadot-mixer[.]to
 2021-04-09 21:03:28 +02:00
Mich 3e3d63ce02 Update all.json (#235) 
Scam is not set up yet but based on where it i hosted adding in advance.
 2021-04-08 14:03:07 +02:00
Github Actions 1e8deae4e4 [CI Skip] release/stable 0.6.70 
skip-checks: true
 2021-04-08 07:10:04 +00:00
Mich 51efb16b2e Update all.json (#230) 
* Update all.json

2 more bad "polkastarter" URLs
Both share the same hoting IP via DNS A 185.104.45.68

* Update all.json

Co-authored-by: Jaco Greeff <jacogr@gmail.com>
 2021-04-08 09:07:46 +02:00
Github Actions 51a431116b [CI Skip] release/stable 0.6.69 
skip-checks: true
 2021-04-08 06:59:57 +00:00
Mich b7918c5dbf Update all.json (#231) 
Found one more, adding TLD only + full FQDN and the end URL they redirect users to to steal the mnemonic seed phrase.
 2021-04-08 08:57:50 +02:00
Github Actions 2f90d5bde4 [CI Skip] release/stable 0.6.68 
skip-checks: true
 2021-04-08 06:57:26 +00:00
Mich 3c7601959a Add new bad URL registered yesterday (#229) 
Domain: polkastarter.fund
Registrar: NameCheap, Inc.
Registered On: 2021-04-07

https://cdn.discordapp.com/attachments/807400385642889286/829465778566725662/Screenshot_2021-04-08_at_0.18.24.png
https://urlscan.io/result/7c6d1356-0331-47a4-b0f7-d3bfdf239468/
 2021-04-08 08:55:21 +02:00
Github Actions cd1c504b73 [CI Skip] release/stable 0.6.67 
skip-checks: true
 2021-04-07 18:28:51 +00:00
michalisFr 84f98782d1 Update all.json (#228) 
Two more:
polkadotjs.online
polkadot-airdropevents.network
 2021-04-07 21:26:39 +03:00
michalisFr 02a5d9e4a8 Update all.json (#227) 
Another one: polkadot.casa

Some sort of investment fraud for bitcoin. I guess all bitcoin domains were taken.
 2021-04-07 21:25:51 +03:00
Github Actions 379bb62a7b [CI Skip] release/stable 0.6.66 
skip-checks: true
 2021-04-07 16:59:11 +00:00
michalisFr 25b8af2c2a Update all.json (#226) 
Added 
- walletweb.net 
- wallets-validation.com
- walletconnectsupport.com
- walletconnect.buzz
- kusama.fund
- polkapool.live
- mynodeswallet.online
- walletconnects.support
- walletconnect.biz
- substrate.mobi
 2021-04-07 19:57:07 +03:00
Bill Laboon 762692c377 Add "Polkadoot" (#225) 
Definitely a scam, asks for Bitcoin wallet when signing up but due to name, I think it makes sense to add here
 2021-04-07 12:29:41 +02:00
Jaco Greeff 8dc6e8d0ec Add whitelist-network.com (#221) 2021-04-05 11:50:56 +02:00
Github Actions 58d098278b [CI Skip] release/stable 0.6.58 
skip-checks: true
 2021-04-04 09:39:20 +00:00
Mich 35d55d3cab Add new bad URL (#220) 
Known bad TLD, new subdomain.
 2021-04-04 12:37:16 +03:00
Github Actions c12f5db67d [CI Skip] release/stable 0.6.56 
skip-checks: true
 2021-04-03 05:05:44 +00:00
Mich 16aa695358 add new bad URL (#216) 
registered today
 2021-04-03 07:03:48 +02:00
Mich d0f0e37552 Add new bad URL (#213) 
polkadot-promo.net

advancedpolkadot[.]com - "info@blockchain.st" 💁‍♂️😕
goldpolkadot[.]com - "info@blockchain.st" 💁‍♂️😕
polkadot[.]casa/#top-widget1 - some sort of bitcoin ponzi, not related to DOT, ignoring
polkadotsevent[.]com - landing page, will monitor it
polkadot365[.]com - landing page, will monitor it
polkadotbank[.]com - "info@blockchain.st" 💁‍♂️😕
 2021-04-02 15:20:11 +03:00
Github Actions 1b713fe3a2 [CI Skip] release/stable 0.6.53 
skip-checks: true
 2021-04-02 04:50:19 +00:00