Luno crypto exchange phishing kit beb8d53

Luno crypto exchange phishing kit that has a high entropy string set as the origin-trial value

References

Recent Detections

  • hxxps://main[.]d18j5fne0zjp2l[.]amplifyapp[.]com/emailverificati...
  • hxxps://main[.]d18j5fne0zjp2l[.]amplifyapp[.]com/2-factor_verifi...
  • hxxps://main[.]d18j5fne0zjp2l[.]amplifyapp[.]com/2-factor_verifi...
  • hxxp://dental-perfection[.]co[.]uk/cgp/need22.php
  • hxxp://dental-perfection[.]co[.]uk/cgp/need2.php
  • hxxp://dental-perfection[.]co[.]uk/cgp/need1.php
  • hxxps://main[.]d18j5fne0zjp2l[.]amplifyapp[.]com/
  • hxxp://main[.]d2r8glnbbqpvhz[.]amplifyapp[.]com/2-factor_verific...
  • hxxp://main[.]d2r8glnbbqpvhz[.]amplifyapp[.]com/verification1.ht...
  • hxxp://main[.]d2r8glnbbqpvhz[.]amplifyapp[.]com/validating_pros....

IOK Rule (edit)

title: Luno crypto exchange phishing kit beb8d53
description: |
  Luno crypto exchange phishing kit that has a high entropy string set as the `origin-trial` value
references:
  - https://urlscan.io/search/#hash%3Abeb8d53d9303a2e0a48b25798b83c677de595397e0e82b06ca43b89ed503c845
  
detection:
  originTrialToken:
    html|contains: 'A7dYd5kJpPZNPkzPzk/uHFiBHh1Vy63H7igyI2Dq4m+1d0no9YKaNYQNfAFW3Us09f1k/SiOQW/LKTSjGuLAXg0AAAB+eyJvcmlnaW4iOiJodHRwczovL3RlYWRzLnR2OjQ0MyIsImZlYXR1cmUiOiJDb252ZXJzaW9uTWVhc3VyZW1lbnQiLCJleHBpcnkiOjE2NDMxNTUxOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9'
  condition: originTrialToken

tags:
  - target.luno