Wise Phishing Kit d777126

Wise phishing kit which uses the same sentry.io

API key across various domains.

References

Recent Detections

hxxps://wiinetrequire-b9ef8b[.]ingress-earth[.]ewp[.]live/wse/id...

urlscan.io
hxxps://mantawiiauthcns[.]blogspot[.]com/

urlscan.io
hxxp://taniwilyoconauth[.]blogspot[.]com

urlscan.io
hxxps://alawosconauth[.]blogspot[.]com/

urlscan.io
hxxps://winsconnrequi1[.]blogspot[.]com/

urlscan.io
hxxps://connwinsre4[.]blogspot[.]com/

urlscan.io
hxxps://welsmewisconn[.]blogspot[.]com/

urlscan.io

IOK Rule (edit)

title: Wise Phishing Kit d777126

description: |
    Wise phishing kit which uses the same sentry.io

    API key across various domains.

references:
    - https://urlscan.io/result/6d6dc13f-671c-4c1b-a58c-cc9470bcef2d
    - https://urlscan.io/result/c6a7e6a2-0b60-46ea-9741-ce53d816d729
    - https://urlscan.io/result/86f8b7e2-1484-407c-a7b7-93a497014505
    - https://urlscan.io/result/c2970a14-2b7a-449c-ade9-e4f6fa5c414d

detection:

    sentryAPICall:
      requests|contains: '?sentry_key=d777126e0316438b8a582a674f5ec311&sentry_version=7'
   
    condition: sentryAPICall

tags:
  - target.wise