Gouda

!

[Gouda @PaganiGouda]

Dear @Namecheap

🚨gazette-du-sorcier[.]me subdomain forum[.]gazette-du-sorcier[.]me redirects to an illegal KUBET gambling site targeting VN users (login forms + deposit promotions).
Violates VN Criminal Code Arts. 321–322.

[Gouda @PaganiGouda]

🚨Dear @Spaceship

x[.]mykedai[.]app is redirecting users to lipowrap[.]plazadiscounts[.]com, which promotes unauthorized EE88 gambling with registration forms collecting personal information.
Evidence:
Exact link: https://t.co/piIqiIybnP
Redirects to: https://t.co/GxzYwc1Q9O
Screenshots and urlscan attached

[Gouda @PaganiGouda]

@Namecheap thanks Namecheap

[Gouda @PaganiGouda]

@Namecheap Thanks namecheap

[Gouda @PaganiGouda]

@Namecheap Thank you, Namecheap we respect you.

[Gouda @PaganiGouda]

@spaceship thanks Spaceship

[MalwareHunterTeam @malwrhunterteam]

Some strange DNS TXT records these have:
get.xiner[.]top
get.yabgo[.]top
get.xabatay[.]top
get.api-mall[.]vip
🤔
🤷‍♂️

[Gouda @PaganiGouda]

keonhacailabet[.]com is promoting unauthorized
gambling with login and registration buttons redirecting
users to phishing forms collecting personal information
(username, password, real name).

Evidence:
Exact link: https://t.co/jZA2WThz35
Register/Login buttons redirect to credential harvesting pages VirusTotal: Flagged as phishing
Screenshots attached

@namesilo

#Phishing #ThreatIntel

[Gouda @PaganiGouda]

Please suspend mb66ds[.]com (including api[.]mb66ds[.]com and www[.]mb66ds[.]com). It is being used as a dedicated AsyncRAT Command-and-Control server. The malware sample patch.exe (SHA256: 16c6d717f509de8601196e4a879aaab5b21f75319eb060279a38928164453229) has the domain hardcoded in its configuration. Full details have been emailed to [email protected].
Case ID: #840386.
#malwareamy #phising #malware
@NiceNIC_Global

[Gouda @PaganiGouda]

keonhacailabet[.]com is promoting unauthorized
gambling with login and registration buttons redirecting
users to phishing forms collecting personal information
(username, password, real name).

Evidence:
Exact link: https://t.co/jZA2WThz35
Register/Login buttons redirect to credential harvesting pages VirusTotal: Flagged as phishing
Screenshots attached

@namesilo
#Phishing #ThreatIntel

[Gouda @PaganiGouda]

@Netim_com hello @Netim_com please check for me my ticket NB108114, It has been 6 days and I still haven’t received any response

[Gouda @PaganiGouda]

@ajkhan_ @Namecheap Yes, Namecheap is all talk

[Gouda @PaganiGouda]

@spaceship @ICANDfinity @NamecheapCEO Hello @spaceship, has the domain name I reported been suspended?

[Gouda @PaganiGouda]

@Namecheap I want to find discount codes for .si domains.

[Gouda @PaganiGouda]

@Namecheap @Namecheap Thank you; please let me know when the results are available.

[Gouda @PaganiGouda]

@BitcoinAlphaX 64