add additional USPS lure hosts to IP block lists #516

g0d33p3rsec · 2024-11-26T17:56:02Z

Phishing Domain/URL/IP(s):

129.226.206.133
https://uspscom-freighut.top/track/
https://uspscom-freighu.top/track/
https://uspscom-freight.top/track/

198.11.183.177
https://usps.com-info-addk.cfd/x/
https://usps.com-info-addz.cfd/x/
https://usps.com-info-addm.cfd/x/
https://usps.com-info-addp.cfd/x/
https://usps.com-info-addq.cfd/x/
https://usps.com-info-addn.cfd/x/
https://usps.com-info-adda.cfd/x/
https://usps.com-info-addo.cfd/x/
https://usps.com-l.win/x/
https://usps.com-k.win/x/
https://usps.com-d.win/x/
https://usps.com-e.win/x/
https://usps.com-c.win/x/
https://usps.com-i.win/x/
https://usps.com-j.win/x/
https://usps.com-f.win/x/
https://usps.com-m.win/x/
https://usps.com-b.win/x/
https://usps.com-g.win/x/
https://usps.com-h.win/x/
https://examinecheck.com-street-addw.cfd/x/
https://examinecheck.com-street-adi.cfd/x/
https://examinecheck.com-street-addj.cfd/x/
https://examinecheck.com-street-addh.cfd/x/
https://examinecheck.com-street-addi.cfd/x/
https://examinecheck.com-street-addg.cfd/x/
https://examinecheck.com-street-adl.cfd/x/
https://examinecheck.com-street-ade.cfd/x/
https://examinecheck.com-street-addo.cfd/x/
https://information.com-street-addp.cfd/x/
https://information.com-street-addq.cfd/x/
https://information.com-street-addb.cfd/x/
https://information.com-street-add.cfd/x/
https://information.com-street-addc.cfd/x/
https://information.com-street-ads.cfd/x/
https://information.com-street-adds.cfd/x/
https://information.com-street-addt.cfd/x/
https://information.com-street-addf.cfd/x/

8.221.106.55
https://uspswakg.top/I/
https://uspswakf.top/I/ 
https://uspswakd.top/I/
https://uspswaks.top/I/
https://uspswakb.top/I/
https://uspswakv.top/I/ 
https://uspswakc.top/I/
https://uspswakx.top/I/
https://uspswako.top/I/
https://uspswaki.top/I/ 
https://uspswaku.top/I/
https://uspswaky.top/I/
https://uspswakr.top/I/
https://uspswake.top/I/ 
https://uspsekwg.top/I/
https://uspsekwf.top/I/
https://uspsekwd.top/I/
https://uspsekws.top/I/
https://uspsekwb.top/I/
https://uspsekwv.top/I/
https://uspsekwc.top/I/
https://uspsekwx.top/I/
https://uspsekwz.top/I/ 
https://uspsekwo.top/I/
https://uspsekwi.top/I/
https://uspsekwu.top/I/
https://uspsekwy.top/I/ 
https://uspsekwr.top/I/
https://uspsekwa.top/I/
https://uspswenr.top/I/
https://uspswkef.top/I/
https://uspswkeg.top/I/
https://uspswked.top/I/
https://uspswkes.top/I/
https://uspswkev.top/I/
https://uspswkec.top/I/
https://uspswkex.top/I/
https://uspswkez.top/I/
https://uspswkeo.top/I/
https://uspswkei.top/I/
https://uspswkeu.top/I/
https://uspswkey.top/I/
https://uspswker.top/I/
https://uspswkea.top/I/
https://uspswzrb.top/I/ 
https://uspswzrc.top/I/
https://uspswzro.top/I/

Impersonated domain

tools.usps.com

Describe the issue

Adding additional IP addresses hosting USPS phishing lures and staged domains. Related to #513

Related external source

Screenshot

Click to expand

spirillen · 2024-11-27T09:06:17Z

No matter how I test these, they all seems inactive... Do you have anything "Fresh" you can add?

Subject                                                                                              Status      Source
---------------------------------------------------------------------------------------------------- ----------- ----------
usps.com-info-addk.cfd                                                                               INACTIVE    STDLOOKUP
usps.com-info-addz.cfd                                                                               INACTIVE    STDLOOKUP
usps.com-info-addm.cfd                                                                               INACTIVE    STDLOOKUP
usps.com-info-addp.cfd                                                                               INACTIVE    STDLOOKUP
usps.com-info-addq.cfd                                                                               INACTIVE    STDLOOKUP
usps.com-info-adda.cfd                                                                               INACTIVE    STDLOOKUP
usps.com-info-addn.cfd                                                                               INACTIVE    STDLOOKUP
usps.com-l.win                                                                                       INACTIVE    STDLOOKUP
usps.com-k.win                                                                                       INACTIVE    STDLOOKUP
usps.com-info-addo.cfd                                                                               INACTIVE    STDLOOKUP
usps.com-e.win                                                                                       INACTIVE    STDLOOKUP
usps.com-c.win                                                                                       INACTIVE    STDLOOKUP
usps.com-d.win                                                                                       INACTIVE    STDLOOKUP
usps.com-i.win                                                                                       INACTIVE    STDLOOKUP
usps.com-j.win                                                                                       INACTIVE    STDLOOKUP
usps.com-f.win                                                                                       INACTIVE    STDLOOKUP
usps.com-b.win                                                                                       INACTIVE    STDLOOKUP
usps.com-m.win                                                                                       INACTIVE    STDLOOKUP
usps.com-g.win                                                                                       INACTIVE    STDLOOKUP
usps.com-h.win                                                                                       INACTIVE    STDLOOKUP
examinecheck.com-street-addw.cfd                                                                     INACTIVE    STDLOOKUP
examinecheck.com-street-addj.cfd                                                                     INACTIVE    STDLOOKUP
examinecheck.com-street-addh.cfd                                                                     INACTIVE    STDLOOKUP
examinecheck.com-street-adi.cfd                                                                      INACTIVE    STDLOOKUP
examinecheck.com-street-addi.cfd                                                                     INACTIVE    STDLOOKUP
examinecheck.com-street-adl.cfd                                                                      INACTIVE    STDLOOKUP
examinecheck.com-street-addg.cfd                                                                     INACTIVE    STDLOOKUP
examinecheck.com-street-ade.cfd                                                                      INACTIVE    STDLOOKUP
examinecheck.com-street-addo.cfd                                                                     INACTIVE    STDLOOKUP
information.com-street-addp.cfd                                                                      INACTIVE    STDLOOKUP
information.com-street-addq.cfd                                                                      INACTIVE    STDLOOKUP
information.com-street-addb.cfd                                                                      INACTIVE    STDLOOKUP
information.com-street-add.cfd                                                                       INACTIVE    STDLOOKUP
information.com-street-ads.cfd                                                                       INACTIVE    STDLOOKUP
information.com-street-addc.cfd                                                                      INACTIVE    STDLOOKUP
information.com-street-addf.cfd                                                                      INACTIVE    STDLOOKUP
information.com-street-adds.cfd                                                                      INACTIVE    STDLOOKUP
information.com-street-addt.cfd                                                                      INACTIVE    STDLOOKUP
uspscom-freight.top                                                                                  ACTIVE      NETINFO
uspscom-freighut.top                                                                                 ACTIVE      NETINFO
uspscom-freighu.top                                                                                  ACTIVE      NETINFO

Subject                                                                                              Status      Source     Expiration Date   HTTP Code  Checker
---------------------------------------------------------------------------------------------------- ----------- ---------- ----------------- ---------- -------------
https://uspscom-freighut.top/track/                                                                  INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://uspscom-freighu.top/track/                                                                   INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://uspscom-freight.top/track/                                                                   INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-info-addk.cfd/x/                                                                    INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-info-addz.cfd/x/                                                                    INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-info-addp.cfd/x/                                                                    INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-info-adda.cfd/x/                                                                    INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-info-addo.cfd/x/                                                                    INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-info-addm.cfd/x/                                                                    INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-d.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-c.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-info-addq.cfd/x/                                                                    INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-info-addn.cfd/x/                                                                    INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-e.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-i.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-j.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-f.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-l.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-m.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-k.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-h.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-b.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://usps.com-g.win/x/                                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-addw.cfd/x/                                                          INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-adi.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-addh.cfd/x/                                                          INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-addi.cfd/x/                                                          INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-addj.cfd/x/                                                          INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-addg.cfd/x/                                                          INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-adl.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-ade.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-addp.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://examinecheck.com-street-addo.cfd/x/                                                          INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-addq.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-addb.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-add.cfd/x/                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-ads.cfd/x/                                                            INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-addc.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-adds.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-addt.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY
https://information.com-street-addf.cfd/x/                                                           INACTIVE    DNSLOOKUP  Unknown           Unknown    AVAILABILITY

g0d33p3rsec · 2024-11-27T16:38:16Z

The domains seem to be rotated pretty quickly, which is why I've been hesitant to add the individual domains (at least those that look to be intentionally disposable) to the matrix and instead block by IP here. Some of the inactive URLs are from tabs I was working to clear out, but still go to show the intent and history of that IP.

https://urlscan.io/search/#page.ip:%22198.11.183.177%22 shows the scan history at urlscan.

https://urlscan.io/ip/198.11.183.177 shows the dates the various related domains were registered. https://search.censys.io/hosts/198.11.183.177/data/table can be used to confirm.

https://urlscan.io/result/45f9d166-e6f4-4404-af7a-dd8cdf68971e/ is a scan I just did.

To find these, I just identified the IP and recently associated domains and scanned using the URI pattern of other known lures hosted at that IP address. The most common patterns I have been seeing are /i/, /x/, /track/, and /us/. All lures on the same IP should follow the same pattern.

g0d33p3rsec · 2024-11-27T23:10:18Z

I'd also happily ban the entire .top gTLD and use an allow-list for the few sites using the registrar for legitimate purposes.
https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/

g0d33p3rsec · 2024-11-27T23:13:54Z

examinecheck.com-street-addw.cfd

sites you are showing as inactive still have recent urlscan.io hits

I wonder if you are hitting a geofence. Do you have a way to try from an U.S. IP address?

g0d33p3rsec · 2024-11-27T23:27:43Z

https://www.virustotal.com/gui/ip-address/129.226.206.133
https://www.virustotal.com/gui/ip-address/198.11.183.177

It'll be a few before the most recent IP is detected by most of the engines on VirusTotal, but it shouldn't take long. I just added the IOC URLs. Look at how many related domains the single IP has hosted this month https://www.virustotal.com/gui/ip-address/8.221.106.55/relations

g0d33p3rsec · 2024-11-28T02:25:33Z

Interesting, I'm also getting 404's when trying from some other services. If you want to try playing with what I'm seeing, try an IP I haven't added yet. Here's some of the other one's that are active today that I haven't enumerated yet:
https://urlscan.io/ip/49.51.200.214 is using /track/ so rescanning any of the domains from the IP page with that added should return a lure.
https://urlscan.io/ip/43.153.93.24 uses /i/
https://urlscan.io/ip/49.51.186.70 /us/
https://urlscan.io/ip/156.244.41.195 /us/
https://urlscan.io/ip/49.51.71.26 /track/
https://urlscan.io/ip/43.135.128.131 /update/

The screenshots all have different package numbers so urlscan is able to reach them somehow. Anyrun and VirusTotal both often 404. Also, noticing a bunch of domains listing Mandiant instead of VirusTotal as the resolver on the VT relations pages.

g0d33p3rsec · 2024-11-28T03:02:01Z

@sprillen check this out. A link that returns the lure on urlscan.io https://urlscan.io/result/b05c7c4d-22cd-4678-a7a4-023f497c769b/#summary

404 on VT https://www.virustotal.com/gui/url/90ffdfcaaabda5d8d36b3bd630abf2cee665538d330552f747fec37674c0da68/details

looking at the DOM on urlscan

and scanning the referenced javascript file from VirusTotal https://www.virustotal.com/gui/url/f29b3aaf91e16d190774c406bf1b3be45d74c81e20bad5ac39a9c97c2a7dd8e3/details

https://www.virustotal.com/gui/file/a560c663abdff084c2f9017af0b5593ebee394ddfe3ad3dda62e4f4481fadae0/behavior

spirillen · 2024-11-28T14:56:20Z

I'd also happily ban the entire .top gTLD and use an allow-list for the few sites using the registrar for legitimate purposes. https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/

😄

spirillen · 2024-11-28T15:05:01Z

Phishing domains are annoying, the are on, then off, then on... But @mypdns do handle IP blacklisting as well, just remember to use the label for IP IP Range

Or the url= https://github.com/mypdns/matrix/issues/new?assignees=spirillen&labels=Phishing,IP%20Range&milestone=Phishing&template=domain_blacklist.yml&title=

g0d33p3rsec · 2024-11-28T16:51:32Z

Phishing domains are annoying, the are on, then off, then on...

Then sprinkle in the fun introduced by malicious traffic distribution systems and cloudflare.

But @mypdns do handle IP blacklisting as well, just remember to use the label for IP IP Range

Or the url= https://github.com/mypdns/matrix/issues/new?assignees=spirillen&labels=Phishing,IP%20Range&milestone=Phishing&template=domain_blacklist.yml&title=

Very nice! That should make both of our lives easier. Adding by domain would have been a sort of self-DoS due to the volume and their ephemeral nature. I think with this sort of thing, I have enough confidence from the supporting evidence, like passive DNS replication or certificate transparency logs, that the action could be legally justified/ easily defended.

g0d33p3rsec · 2024-11-28T16:59:38Z

I'd also happily ban the entire .top gTLD and use an allow-list for the few sites using the registrar for legitimate purposes. https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/

😄

https://web.archive.org/web/20240726003701/https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/

The Chinese company in charge of handing out domain names ending in “.top” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of new findings that .top was the most common suffix in phishing websites over the past year, second only to domains ending in “.com.”

On July 16, the Internet Corporation for Assigned Names and Numbers (ICANN) sent a letter to the owners of the .top domain registry. ICANN has filed hundreds of enforcement actions against domain registrars over the years, but in this case ICANN singled out a domain registry responsible for maintaining an entire top-level domain (TLD).
Among other reasons, the missive chided the registry for failing to respond to reports about phishing attacks involving .top domains.

ICANN letter to .top registrar

spirillen · 2024-11-28T17:21:46Z

Can see we'll need another kind of system to handle ~500.000 phishing domains pr year...

Thanks for sharing.

And I love see the death of the Chinese company behind all these phishing attacks, it just indicates, that one individual could blacklist Jiangsu Bangning Science & Technology Co. Ltd. DNS servers without loosing a hole lot

g0d33p3rsec added 2 commits November 26, 2024 12:18

add 129.226.206.133 to IP block lists

2eebb7e

add 198.11.183.177 to IP blocklists

3c4d72d

g0d33p3rsec changed the title ~~add 129.226.206.133 to IP block lists~~ add additional USPS lure hosts to IP block lists Nov 26, 2024

iam-py-test added a commit to iam-py-test/my_filters_001 that referenced this pull request Nov 27, 2024

Fix Phishing-Database/phishing#516

bc9362b

g0d33p3rsec and others added 2 commits November 27, 2024 17:23

Merge branch 'mitchellkrogza:main' into usps-phishing

27cfa87

add 8.221.106.55 to IP blocklists

9168337

spirillen closed this in mypdns/matrix@8dc08b7 Nov 28, 2024

spirillen reopened this Nov 28, 2024

spirillen merged commit e31be7b into Phishing-Database:main Nov 28, 2024
2 checks passed

g0d33p3rsec mentioned this pull request Nov 28, 2024

add additional IPs hosting USPS delivery failrue lures #518

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add additional USPS lure hosts to IP block lists #516

add additional USPS lure hosts to IP block lists #516

g0d33p3rsec commented Nov 26, 2024 •

edited

Loading

spirillen commented Nov 27, 2024

g0d33p3rsec commented Nov 27, 2024 •

edited

Loading

g0d33p3rsec commented Nov 27, 2024

g0d33p3rsec commented Nov 27, 2024 •

edited

Loading

g0d33p3rsec commented Nov 27, 2024 •

edited

Loading

g0d33p3rsec commented Nov 28, 2024 •

edited

Loading

g0d33p3rsec commented Nov 28, 2024 •

edited

Loading

spirillen commented Nov 28, 2024

spirillen commented Nov 28, 2024

g0d33p3rsec commented Nov 28, 2024

g0d33p3rsec commented Nov 28, 2024

spirillen commented Nov 28, 2024

add additional USPS lure hosts to IP block lists #516

add additional USPS lure hosts to IP block lists #516

Conversation

g0d33p3rsec commented Nov 26, 2024 • edited Loading

Phishing Domain/URL/IP(s):

Impersonated domain

Describe the issue

Related external source

Screenshot

spirillen commented Nov 27, 2024

g0d33p3rsec commented Nov 27, 2024 • edited Loading

g0d33p3rsec commented Nov 27, 2024

g0d33p3rsec commented Nov 27, 2024 • edited Loading

g0d33p3rsec commented Nov 27, 2024 • edited Loading

g0d33p3rsec commented Nov 28, 2024 • edited Loading

g0d33p3rsec commented Nov 28, 2024 • edited Loading

spirillen commented Nov 28, 2024

spirillen commented Nov 28, 2024

g0d33p3rsec commented Nov 28, 2024

g0d33p3rsec commented Nov 28, 2024

spirillen commented Nov 28, 2024

g0d33p3rsec commented Nov 26, 2024 •

edited

Loading

g0d33p3rsec commented Nov 27, 2024 •

edited

Loading

g0d33p3rsec commented Nov 27, 2024 •

edited

Loading

g0d33p3rsec commented Nov 27, 2024 •

edited

Loading

g0d33p3rsec commented Nov 28, 2024 •

edited

Loading

g0d33p3rsec commented Nov 28, 2024 •

edited

Loading