Add DHL phish #499
Merged
Add DHL phish #499
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
spirillen
reviewed
Oct 16, 2024
| @@ -1,3 +1,5 @@ | |||
| 25a40529.pws-assistenz.de | |||
There was a problem hiding this comment.
Interesting as this domain are involving sedoparking.com (mypdns/matrix#1187)
spirillen
reviewed
Oct 16, 2024
add-domain
Outdated
| @@ -1,3 +1,5 @@ | |||
| 25a40529.pws-assistenz.de | |||
| 25a40529.classen-metallbau.com | |||
There was a problem hiding this comment.
This domain are redirecting to dh.pepacerutti.it
curl -I 25a40529.classen-metallbau.com
HTTP/1.1 301 Moved Permanently
Date: Wed, 16 Oct 2024 11:57:50 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 16 Oct 2024 12:57:50 GMT
Location: http://dh.pepacerutti.it/25a40529/B25a40529This should be fixed
There was a problem hiding this comment.
And this domain redirects to
curl http://dh.pepacerutti.it/25a40529/B25a40529
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https:///25a40529.pws-assistenz.de">here</a>.</p>
</body></html>Which makes this record a unnecessary
spirillen
added a commit
to mypdns/matrix
that referenced
this pull request
Oct 16, 2024
Fix #1187 Fixes #MTX-1189 Rel Phishing-Database/phishing#499 Signed-off-by: Spirillen <[email protected]>
This record are just redirecting to 25a40529.pws-assistenz.de|phishing
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Phishing Domain/URL/IP(s):
https://25a40529.pws-assistenz.de/http://25a40529.classen-metallbau.com/Impersonated domain
dhl.deDescribe the issue
This impersonates DHL by asking for freight cost money. The .com domain will redirect to the .de one.
Related external source
Screenshot
Click to expand