Spam404

We help online companies with content monitoring, penetration testing and brand protection. We aim to make the internet a much safer place for everyone.

[Spam404 @Spam404]

@Namecheap Any update for this one? Domain remains actively used to target @TheSandboxGame users with malware.

[Spam404 @Spam404]

Fake beta webpage impersonating @TheSandboxGame, dropping malware via @Dropbox

Domain: sandboxbeta[.]cloud
Registrar: @Namecheap

Host: @eserver_eu (2.56.91.19)

Spammed via email, likely sourced from recently disclosed @OpenSea data breach.

@urlscanio: https://t.co/RoFlsXkJl8

[Spam404 @Spam404]

Fake NFT webpage impersonating @BoredApeYC, dropping malware via @Dropbox.

Domain: apesnoop[.]com
Registrar: @Namecheap

Hosting: @DDoSGUARD (217.114.42.175)

Spamvertised via ETH ERC-20 token airdrops: https://t.co/Rd3XkDJMye

@urlscanio: https://t.co/q55CbJYwNG

[Spam404 @Spam404]

Fake NFT mint webpage impersonating @OthersideMeta/@BoredApeYC in attempt to steal cryptocurrency.

Domain: bayc-otherside[.]art
Registrar: @Namecheap

Hosting: @Namecheap (198.54.116.96)

@urlscanio: https://t.co/zfmaiPCJpM

First seen: Jun 28th, 2022

[Spam404 @Spam404]

Fake NFT mint webpage impersonating @rollbitcom in attempt to steal cryptocurrency.

Domain: rollbit[.]mintnow[.]net
Registrar: @Namecheap

Hosting: @Cloudflare (104.21.85.9)

@urlscanio: https://t.co/dHurUgHnah

CC: @CryptoPhishing @CryptoScamDB

[Spam404 @Spam404]

Fake NFT mint webpage impersonating @metacard in attempt to steal cryptocurrency.

Domain: minting-metacard[.]io
Registrar: @Namecheap

Hosting: @Namecheap (162.213.255.42)

@urlscanio: https://t.co/wriWf7b5zv

First seen: Feb 12th, 2022

CC: @CryptoPhishing @CryptoScamDB

[Spam404 @Spam404]

@Namecheap @opensea @urlscanio @discord Here's a new one: mint-sea[.]digital

@urlscanio: https://t.co/UoB3ONq32u

[Spam404 @Spam404]

Fake NFT minting webpages impersonating @opensea in attempt to steal cryptocurrency.

Domain 1: mint-sea[.]art
Domain 2: opensa[.]casa
Registrar & Host: @Namecheap

@urlscanio scans:
https://t.co/pDqwmoX7to
https://t.co/O3jikYtSAO

Spread via @Discord. Kit first seen 12 days ago.

[Spam404 @Spam404]

@Namecheap @HAPEBEASTGANG @ContaboCom @urlscanio @CryptoPhishing @CryptoScamDB Very fast, thank you!

[Spam404 @Spam404]

Fake NFT minting webpage impersonating @HAPEBEASTGANG in attempt to steal cryptocurrency.

Domain: hapebeast[.]io
Registrar: @Namecheap
Hosting: @ContaboCom (167.86.72.233)

@urlscanio: https://t.co/bs2GLkX3Q3

First seen 29 days ago.

CC: @CryptoPhishing @CryptoScamDB

[Spam404 @Spam404]

@malwrhunterteam Got this one, thanks!

[Spam404 @Spam404]

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT Offline shortly, thanks for the tag!

[Spam404 @Spam404]

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT Nuked it, thanks!

[Spam404 @Spam404]

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT Thanks for the tag! This domain should stop resolving very shortly.

[Spam404 @Spam404]

@malwrhunterteam @VK_Intel @bryceabdo @JAMESWT_MHT Nuked this one, thanks for the tag!

[Spam404 @Spam404]

@STT60861270 @whitehoodie4 @SocEngineerHu @malwrhunterteam @Namecheap @PhishKitTracker Both nuked, thanks for the tag!

[Spam404 @Spam404]

@unmaskparasites @RealClever Nice find! Sent the S3 bucket to AWS, who are usually very responsive to abuse. The .ga domain should stop resolving very shortly.

[Spam404 @Spam404]

@illegalFawn @freenomofficial @mauriez @malwrhunterteam @JAMESWT_MHT Nuked it, thanks for the tag!

[Spam404 @Spam404]

@InfoSec_Paul_M @illegalFawn @sysgoblin @n0p1shing @JCyberSec_ @nullcookies Thanks Paul! Looks like a FP with paypal./com

[Spam404 @Spam404]

@InfoSec_Paul_M @illegalFawn @sysgoblin @n0p1shing @JCyberSec_ @nullcookies Nice list as always! Noticed a false positive: service./gov./uk