Thread by @PhantomXSec

Possible nexus noted between an actor conducting Naver phishing and now Crypto.

Email gameproducters@outlook[.]com reported by @prevailion has also registered boredsnakesclub[.]com a typo squat of the legitimate BoredSnakesClub website. 1/

prevailion.com/what-wicked-we…

#Phishing

Previous reporting on gameproducters@outlook[.]com listed them as registering dozens of Naver-themed phishing domains, examples below. 2/

navercomf[.]link
navercnid[.]link
naverdcom[.]click
navercomd[.]link
navernidc[.]link
naveracom[.]link
naverecom[.]click

#Phishing #Naver

The phishing domain boredsnakesclub[.]com was registered on 4/24/2022.

It was directly cloned from the legitimate website the same day using HTTrack Website Copier/3.x.

3/

#Phishing #NFTs

At the bottom of the HTML there are references to JavaScripts located on themta[.]site and thedoodles[.]site.

A Google cache result for themta[.]site is below, but it was pretending to be the 'Metaverse Travel Agency'.

4/

#Phishing #NFTs

The thedoodles[.]site is active but is a shell of a site with minimal functionality.

It's HTML shows references to the same JavaScript file on themta[.]site.

It was registered by tree99111@hotmail[.]com, also in the @prevailion report. 5/

#Phishing #NFTs

Both boredsnakesclub[.]com and thedoodles[.]site are hosted on @OVHcloud IP 158.69.133[.]72.

A cursory check on the IP shows a large number of crypto-currency phishing sites co-located there.

#Phishing #NFTs

When themta[.]site was active, it was hosted on @OVHcloud IP 51.222.199[.]226.

Quick look at the IP shows a number of crypto-currency phishing sites being hosted there, including sites targeting @squiggles @ARKANGELSNFT @cartoonsnft.

#Phishing #NFTs

@OVHcloud The @OVHcloud IP 158.69.133[.]72 is actually hosting 65 phishing sites targeting crypto-currency users.

Targets include @the_x2y2 @polarbearsnft

#Phishing #NFT #Crypto

Full List:
pastebin.com/7a2Vz49Y