Thread by @SlickRockWeb

Current scam targeting political campaigns. Not sure if its purely a financial scam or if the links might include malspam. Campaign receives an ominous email saying its campaign web domain will expire if it not immediately renewed. #malware #spam #malspam #infosec #elections2020

Clicking on the bit(.)ly URL shortened link takes the user through a javascript redirect chain & likely redirects depending on a variety of factors (victim fingerprinting) to another site. Here the user lands on domainremit(.)com #malware #spam #malspam #infosec #elections2020

Here the user is asked to enter their information and eventually enter online payment information. The thing is the domain in question was NOT in danger of expiring & the language is clever by saying "search engine registration" #malware #spam #malspam #infosec #elections2020

The original email was sent from an IP address (104.194.139.99) hosted at the Bulletproof hosting company FranTech Solutions out of Wyoming. Some of you will recognize them from other campaigns. I will leave it at that. #malware #spam #malspam #infosec #elections2020