Luno crypto exchange phishing kit beb8d53

Recent Detections

• hxxps://lundevme[.]dt3svk49t5f2m[.]amplifyapp[.]com/

  urlscan.io
• hxxp://lundevme[.]dt3svk49t5f2m[.]amplifyapp[.]com/verification1...

  urlscan.io
• hxxp://lundevme[.]dt3svk49t5f2m[.]amplifyapp[.]com/emailverifica...

  urlscan.io
• hxxp://lundevme[.]dt3svk49t5f2m[.]amplifyapp[.]com/2-factor_veri...

  urlscan.io
• hxxp://lundevme[.]dt3svk49t5f2m[.]amplifyapp[.]com/2-factor_veri...

  urlscan.io
• hxxps://dymlu[.]nttrans[.]cc/1/1/1/1/1/index.htm

  urlscan.io
• hxxps://developlu[.]d2urtsqsb6eb1[.]amplifyapp[.]com/

  urlscan.io
• hxxps://developlu[.]d231qui3ljdjkx[.]amplifyapp[.]com/2-factor_v...

  urlscan.io
• hxxp://developlu[.]d231qui3ljdjkx[.]amplifyapp[.]com/verificatio...

  urlscan.io
• hxxp://developlu[.]d231qui3ljdjkx[.]amplifyapp[.]com/validating_...

  urlscan.io

IOK Rule (edit)

title: Luno crypto exchange phishing kit beb8d53
description: |
  Luno crypto exchange phishing kit that has a high entropy string set as the `origin-trial` value
references:
  - https://urlscan.io/search/#hash%3Abeb8d53d9303a2e0a48b25798b83c677de595397e0e82b06ca43b89ed503c845
  
detection:
  originTrialToken:
    html|contains: 'A7dYd5kJpPZNPkzPzk/uHFiBHh1Vy63H7igyI2Dq4m+1d0no9YKaNYQNfAFW3Us09f1k/SiOQW/LKTSjGuLAXg0AAAB+eyJvcmlnaW4iOiJodHRwczovL3RlYWRzLnR2OjQ0MyIsImZlYXR1cmUiOiJDb252ZXJzaW9uTWVhc3VyZW1lbnQiLCJleHBpcnkiOjE2NDMxNTUxOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9'
  condition: originTrialToken

tags:
  - target.luno