#lookalike — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #lookalike, aggregated by home.social.
-
Anthropic Says It Discovered a Crispr-Like System. Now What?
-
Anthropic Says It Discovered a Crispr-Like System. Now What?
-
Anthropic Says It Discovered a Crispr-Like System. Now What?
-
Anthropic Says It Discovered a Crispr-Like System. Now What?
-
Quiz time: which of these domains is impersonating Apple?
quizearny[.]shop, rewardquiz[.]org look like generic quiz sites. applerewards[.]net is more obvious. All of them belong to a cluster serving identical Apple impersonation content, prompting victims to claim an Apple gift card reward by handing over their personal details. testar[.]ink, "to test", was the first to be created, nearly a month before the others went live, which may say something about how this campaign got started.
What makes this cluster more interesting is what happens after you click the "Claim Your Apple Reward" button on the initial page. Different locations, different device types, different destinations. Classic TDS.
This cluster is a good reminder that brand impersonation lives in the page content, not just the domain name. A quiz site with no Apple in its name can be just as dangerous as an obvious lookalike.
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #axur #lookalike #scam #tds
-
Quiz time: which of these domains is impersonating Apple?
quizearny[.]shop, rewardquiz[.]org look like generic quiz sites. applerewards[.]net is more obvious. All of them belong to a cluster serving identical Apple impersonation content, prompting victims to claim an Apple gift card reward by handing over their personal details. testar[.]ink, "to test", was the first to be created, nearly a month before the others went live, which may say something about how this campaign got started.
What makes this cluster more interesting is what happens after you click the "Claim Your Apple Reward" button on the initial page. Different locations, different device types, different destinations. Classic TDS.
This cluster is a good reminder that brand impersonation lives in the page content, not just the domain name. A quiz site with no Apple in its name can be just as dangerous as an obvious lookalike.
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #axur #lookalike #scam #tds
-
Quiz time: which of these domains is impersonating Apple?
quizearny[.]shop, rewardquiz[.]org look like generic quiz sites. applerewards[.]net is more obvious. All of them belong to a cluster serving identical Apple impersonation content, prompting victims to claim an Apple gift card reward by handing over their personal details. testar[.]ink, "to test", was the first to be created, nearly a month before the others went live, which may say something about how this campaign got started.
What makes this cluster more interesting is what happens after you click the "Claim Your Apple Reward" button on the initial page. Different locations, different device types, different destinations. Classic TDS.
This cluster is a good reminder that brand impersonation lives in the page content, not just the domain name. A quiz site with no Apple in its name can be just as dangerous as an obvious lookalike.
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #axur #lookalike #scam #tds
-
Quiz time: which of these domains is impersonating Apple?
quizearny[.]shop, rewardquiz[.]org look like generic quiz sites. applerewards[.]net is more obvious. All of them belong to a cluster serving identical Apple impersonation content, prompting victims to claim an Apple gift card reward by handing over their personal details. testar[.]ink, "to test", was the first to be created, nearly a month before the others went live, which may say something about how this campaign got started.
What makes this cluster more interesting is what happens after you click the "Claim Your Apple Reward" button on the initial page. Different locations, different device types, different destinations. Classic TDS.
This cluster is a good reminder that brand impersonation lives in the page content, not just the domain name. A quiz site with no Apple in its name can be just as dangerous as an obvious lookalike.
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #axur #lookalike #scam #tds
-
elvis has left the building - happy weekend
#photography #photo #person #car #ukulele #costume #cape #trees #neighborhood #sunglasses #elivis #lookalike
-
elvis has left the building - happy weekend
#photography #photo #person #car #ukulele #costume #cape #trees #neighborhood #sunglasses #elivis #lookalike
-
elvis has left the building - happy weekend
#photography #photo #person #car #ukulele #costume #cape #trees #neighborhood #sunglasses #elivis #lookalike
-
elvis has left the building - happy weekend
#photography #photo #person #car #ukulele #costume #cape #trees #neighborhood #sunglasses #elivis #lookalike
-
Celebrity lookalike generates media attention and fan debate
📰 Original title: Suri steps into the spotlight... Tom's girl makes stage debut treading the boards at the Fringe
🤖 IA: It's clickbait ⚠️
👥 Users: It's clickbait ⚠️View full AI summary https://en.killbait.com/celebrity-lookalike-generates-media-attention-and-fan-debate.html?utm_source=mastodon_world&utm_medium=social&utm_campaign=killbait_uk.mastodon_world
-
20 #CelebrityDoppelgangers collected by the 'Same De La Same' Instagram account: https://zorz.it/NARMy
#AušrysUptas #doppelgangers #celebrities #SameDeLaSame #LookAlike #LookLikeTwins #Instagram #ResembleCelebrities #gallery
-
20 #CelebrityDoppelgangers collected by the 'Same De La Same' Instagram account: https://zorz.it/NARMy
#AušrysUptas #doppelgangers #celebrities #SameDeLaSame #LookAlike #LookLikeTwins #Instagram #ResembleCelebrities #gallery
-
20 #CelebrityDoppelgangers collected by the 'Same De La Same' Instagram account: https://zorz.it/NARMy
#AušrysUptas #doppelgangers #celebrities #SameDeLaSame #LookAlike #LookLikeTwins #Instagram #ResembleCelebrities #gallery
-
20 #CelebrityDoppelgangers collected by the 'Same De La Same' Instagram account: https://zorz.it/NARMy
#AušrysUptas #doppelgangers #celebrities #SameDeLaSame #LookAlike #LookLikeTwins #Instagram #ResembleCelebrities #gallery
-
UK healthcare assistant jailed for helping woman enter Ireland on ‘lookalike’ passport
Natasha ReidSunday July 19, 2026 Dublin Airport passport control, where a woman presented a document with a photograph…
#Ireland #IE #Europe #Europa #EU #Assistant #enter #for #healthcare #helping #ireland #jailed #lookalike #ON #passport #UK #woman
https://www.europesays.com/3141422/ -
https://www.europesays.com/africa/311014/ Senator Methu’s lookalike sparks online buzz #JohnMethu #Kenya #KenyaNews #lookalike #OnlineBuzz #reactions #star #StarNews #StarNewsKenya #StarNewspaper #StarNewspaperKenya #TheStar #TheStarKenya #TheStarNewspaper
-
Having trouble finding a free 📺 streaming site for World Cup 🏟️ matches? This threat actor has you covered with thousands of websites for all 104 matches! ⚽
We've been tracking a likely Vietnam-based actor that mass purchases expired domains (we call these dropcatch) and repurposes their existing web traffic to funnel visitors into illegal sports streaming sites, and then straight into a betting platform the same actor operates. The domain portfolio is a graveyard of real internet history: 2026worldcupnorthamerica[.]com (once cited by the Dallas Morning News and the US Men's National Team Facebook fan page), childreninachangingclimate[.]org (formerly a children's aid program), thebreastcancercharities[.]org (formerly non-profit The Breast Cancer Charities of America), and a domain officially used by major US grocery store chains involved in a large proposed merger. Collectively, this actor has spent hundreds of thousands of dollars acquiring dropcatch domains alone — a strong signal that dropcatching is a genuinely effective vehicle for cyber fraud. Behind all of it sits a staggering tech stack operated by a single actor: 5,000+ domains, illegal streaming services, CDNs, TDSs, trackers, cloakers, betting platforms, and mobile apps. That's not a side hustle, that's an enterprise. 🏗️
While the platform largely targets Vietnamese-speaking users, as well as others in Asia and Oceania, the financial damage reaches much further. Sports authorities and broadcasters worldwide are 📉 losing revenue every time someone watches a live NBA 🏀 , MLB ⚾ :, esports 🎮 , poker 🃏 , or World Cup 🏆 match for free on one of these sites, and this actor has all of them covered.
Some examples from the domains we've uncovered so far:
:Dropcatch domains host or redirect to illegal streaming services
autoredistrict[.]org
childreninachangingclimate[.]org
2026worldcupnorthamerica[.]com
folsomprisonmuseum[.]org
allaboutbasketball[.]us
thebreastcancercharities[.]org:Fraudulent domains host or redirect to illegal streaming services
90phutaa[.]cc
90phutab[.]cc
90phutac[.]cc
xoilaczzzzw[.]tv
xoilaczzzzt[.]tv
xoilaczzzzh[.]tv:Lookalike domains used by the betting platforms
fifa001[.]com
fifa002[.]com
fifa02[.]com
worldcup00[.]com
worldcup000[.]com
worldcup02[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #dropcatch #malvertising #illegalstreaming #sportsbetting #domainabuse #vietnam #worldcup #asia #fifa #streaming #betting #2026worldcup #charities #nonprofit #lookalike #xoilac #90phut
-
Having trouble finding a free 📺 streaming site for World Cup 🏟️ matches? This threat actor has you covered with thousands of websites for all 104 matches! ⚽
We've been tracking a likely Vietnam-based actor that mass purchases expired domains (we call these dropcatch) and repurposes their existing web traffic to funnel visitors into illegal sports streaming sites, and then straight into a betting platform the same actor operates. The domain portfolio is a graveyard of real internet history: 2026worldcupnorthamerica[.]com (once cited by the Dallas Morning News and the US Men's National Team Facebook fan page), childreninachangingclimate[.]org (formerly a children's aid program), thebreastcancercharities[.]org (formerly non-profit The Breast Cancer Charities of America), and a domain officially used by major US grocery store chains involved in a large proposed merger. Collectively, this actor has spent hundreds of thousands of dollars acquiring dropcatch domains alone — a strong signal that dropcatching is a genuinely effective vehicle for cyber fraud. Behind all of it sits a staggering tech stack operated by a single actor: 5,000+ domains, illegal streaming services, CDNs, TDSs, trackers, cloakers, betting platforms, and mobile apps. That's not a side hustle, that's an enterprise. 🏗️
While the platform largely targets Vietnamese-speaking users, as well as others in Asia and Oceania, the financial damage reaches much further. Sports authorities and broadcasters worldwide are 📉 losing revenue every time someone watches a live NBA 🏀 , MLB ⚾ :, esports 🎮 , poker 🃏 , or World Cup 🏆 match for free on one of these sites, and this actor has all of them covered.
Some examples from the domains we've uncovered so far:
:Dropcatch domains host or redirect to illegal streaming services
autoredistrict[.]org
childreninachangingclimate[.]org
2026worldcupnorthamerica[.]com
folsomprisonmuseum[.]org
allaboutbasketball[.]us
thebreastcancercharities[.]org:Fraudulent domains host or redirect to illegal streaming services
90phutaa[.]cc
90phutab[.]cc
90phutac[.]cc
xoilaczzzzw[.]tv
xoilaczzzzt[.]tv
xoilaczzzzh[.]tv:Lookalike domains used by the betting platforms
fifa001[.]com
fifa002[.]com
fifa02[.]com
worldcup00[.]com
worldcup000[.]com
worldcup02[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #dropcatch #malvertising #illegalstreaming #sportsbetting #domainabuse #vietnam #worldcup #asia #fifa #streaming #betting #2026worldcup #charities #nonprofit #lookalike #xoilac #90phut
-
Having trouble finding a free 📺 streaming site for World Cup 🏟️ matches? This threat actor has you covered with thousands of websites for all 104 matches! ⚽
We've been tracking a likely Vietnam-based actor that mass purchases expired domains (we call these dropcatch) and repurposes their existing web traffic to funnel visitors into illegal sports streaming sites, and then straight into a betting platform the same actor operates. The domain portfolio is a graveyard of real internet history: 2026worldcupnorthamerica[.]com (once cited by the Dallas Morning News and the US Men's National Team Facebook fan page), childreninachangingclimate[.]org (formerly a children's aid program), thebreastcancercharities[.]org (formerly non-profit The Breast Cancer Charities of America), and a domain officially used by major US grocery store chains involved in a large proposed merger. Collectively, this actor has spent hundreds of thousands of dollars acquiring dropcatch domains alone — a strong signal that dropcatching is a genuinely effective vehicle for cyber fraud. Behind all of it sits a staggering tech stack operated by a single actor: 5,000+ domains, illegal streaming services, CDNs, TDSs, trackers, cloakers, betting platforms, and mobile apps. That's not a side hustle, that's an enterprise. 🏗️
While the platform largely targets Vietnamese-speaking users, as well as others in Asia and Oceania, the financial damage reaches much further. Sports authorities and broadcasters worldwide are 📉 losing revenue every time someone watches a live NBA 🏀 , MLB ⚾ :, esports 🎮 , poker 🃏 , or World Cup 🏆 match for free on one of these sites, and this actor has all of them covered.
Some examples from the domains we've uncovered so far:
:Dropcatch domains host or redirect to illegal streaming services
autoredistrict[.]org
childreninachangingclimate[.]org
2026worldcupnorthamerica[.]com
folsomprisonmuseum[.]org
allaboutbasketball[.]us
thebreastcancercharities[.]org:Fraudulent domains host or redirect to illegal streaming services
90phutaa[.]cc
90phutab[.]cc
90phutac[.]cc
xoilaczzzzw[.]tv
xoilaczzzzt[.]tv
xoilaczzzzh[.]tv:Lookalike domains used by the betting platforms
fifa001[.]com
fifa002[.]com
fifa02[.]com
worldcup00[.]com
worldcup000[.]com
worldcup02[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #dropcatch #malvertising #illegalstreaming #sportsbetting #domainabuse #vietnam #worldcup #asia #fifa #streaming #betting #2026worldcup #charities #nonprofit #lookalike #xoilac #90phut
-
Having trouble finding a free 📺 streaming site for World Cup 🏟️ matches? This threat actor has you covered with thousands of websites for all 104 matches! ⚽
We've been tracking a likely Vietnam-based actor that mass purchases expired domains (we call these dropcatch) and repurposes their existing web traffic to funnel visitors into illegal sports streaming sites, and then straight into a betting platform the same actor operates. The domain portfolio is a graveyard of real internet history: 2026worldcupnorthamerica[.]com (once cited by the Dallas Morning News and the US Men's National Team Facebook fan page), childreninachangingclimate[.]org (formerly a children's aid program), thebreastcancercharities[.]org (formerly non-profit The Breast Cancer Charities of America), and a domain officially used by major US grocery store chains involved in a large proposed merger. Collectively, this actor has spent hundreds of thousands of dollars acquiring dropcatch domains alone — a strong signal that dropcatching is a genuinely effective vehicle for cyber fraud. Behind all of it sits a staggering tech stack operated by a single actor: 5,000+ domains, illegal streaming services, CDNs, TDSs, trackers, cloakers, betting platforms, and mobile apps. That's not a side hustle, that's an enterprise. 🏗️
While the platform largely targets Vietnamese-speaking users, as well as others in Asia and Oceania, the financial damage reaches much further. Sports authorities and broadcasters worldwide are 📉 losing revenue every time someone watches a live NBA 🏀 , MLB ⚾ :, esports 🎮 , poker 🃏 , or World Cup 🏆 match for free on one of these sites, and this actor has all of them covered.
Some examples from the domains we've uncovered so far:
:Dropcatch domains host or redirect to illegal streaming services
autoredistrict[.]org
childreninachangingclimate[.]org
2026worldcupnorthamerica[.]com
folsomprisonmuseum[.]org
allaboutbasketball[.]us
thebreastcancercharities[.]org:Fraudulent domains host or redirect to illegal streaming services
90phutaa[.]cc
90phutab[.]cc
90phutac[.]cc
xoilaczzzzw[.]tv
xoilaczzzzt[.]tv
xoilaczzzzh[.]tv:Lookalike domains used by the betting platforms
fifa001[.]com
fifa002[.]com
fifa02[.]com
worldcup00[.]com
worldcup000[.]com
worldcup02[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #dropcatch #malvertising #illegalstreaming #sportsbetting #domainabuse #vietnam #worldcup #asia #fifa #streaming #betting #2026worldcup #charities #nonprofit #lookalike #xoilac #90phut
-
SABA-170: Akira Kanagawa’s Amateur Debut in Creampie POV
Explore SABA-170, where Akira Kanagawa delivers a raw amateur debut in a steamy creampie POV. Dive into the scene now and feel the intensity.
https://jav.do/videos/saba-170-saba-170-akira-kanagawas-amateur-debut-in-creampie-pov
-
NIRVANNA THE BAND THE SHOW THE LOOKALIKE CONTEST
In a corner of Waterloo Park on a windy and rainy May 3, 2026 afternoon, over two dozen people formed a semi-circle around a picnic table. Some came wearing various shades of brown and beige blazers, some dragging long extension cords behind them and one even had their own crocheted fedora. The plan: put on the best Nirvanna the Band the Show lookalike contest Waterloo Region has ever seen. […]
https://www.communityedition.ca/nirvanna-the-band-the-show-the-lookalike-contest/ -
𝗠𝗔𝗙𝗦-𝗸𝗶𝗷𝗸𝗲𝗿𝘀 𝘀𝗽𝗼𝘁𝘁𝗲𝗻 𝗹𝗼𝗼𝗸𝗮𝗹𝗶𝗸𝗲 𝘃𝗮𝗻 𝗞𝘆𝗹𝗲 𝗶𝗻 𝘀𝗲𝗿𝗶𝗲𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗴𝗲: '𝗗𝗲 𝘃𝗲𝗿𝗹𝗼𝗿𝗲𝗻 𝘇𝗼𝗼𝗻'
De deelname van Kyle aan 'Married at First Sight' houdt de gemoederen flink bezig op social media. Terwijl hij zelf nog zoekt naar zijn gevoelens voor Danique, zien kijkers op X vooral een opvallende gelijkenis met een wereldberoemd seriepersonage.
https://www.rtl.nl/boulevard/artikel/5596635/mafs-kijkers-vinden-look-van-kyle-seriepersonage
-
𝗠𝗔𝗙𝗦-𝗸𝗶𝗷𝗸𝗲𝗿𝘀 𝘀𝗽𝗼𝘁𝘁𝗲𝗻 𝗹𝗼𝗼𝗸𝗮𝗹𝗶𝗸𝗲 𝘃𝗮𝗻 𝗞𝘆𝗹𝗲 𝗶𝗻 𝘀𝗲𝗿𝗶𝗲𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗴𝗲: '𝗗𝗲 𝘃𝗲𝗿𝗹𝗼𝗿𝗲𝗻 𝘇𝗼𝗼𝗻'
De deelname van Kyle aan 'Married at First Sight' houdt de gemoederen flink bezig op social media. Terwijl hij zelf nog zoekt naar zijn gevoelens voor Danique, zien kijkers op X vooral een opvallende gelijkenis met een wereldberoemd seriepersonage.
https://www.rtl.nl/boulevard/artikel/5596635/mafs-kijkers-vinden-look-van-kyle-seriepersonage
-
𝗠𝗔𝗙𝗦-𝗸𝗶𝗷𝗸𝗲𝗿𝘀 𝘀𝗽𝗼𝘁𝘁𝗲𝗻 𝗹𝗼𝗼𝗸𝗮𝗹𝗶𝗸𝗲 𝘃𝗮𝗻 𝗞𝘆𝗹𝗲 𝗶𝗻 𝘀𝗲𝗿𝗶𝗲𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗴𝗲: '𝗗𝗲 𝘃𝗲𝗿𝗹𝗼𝗿𝗲𝗻 𝘇𝗼𝗼𝗻'
De deelname van Kyle aan 'Married at First Sight' houdt de gemoederen flink bezig op social media. Terwijl hij zelf nog zoekt naar zijn gevoelens voor Danique, zien kijkers op X vooral een opvallende gelijkenis met een wereldberoemd seriepersonage.
https://www.rtl.nl/boulevard/artikel/5596635/mafs-kijkers-vinden-look-van-kyle-seriepersonage
-
𝗠𝗔𝗙𝗦-𝗸𝗶𝗷𝗸𝗲𝗿𝘀 𝘀𝗽𝗼𝘁𝘁𝗲𝗻 𝗹𝗼𝗼𝗸𝗮𝗹𝗶𝗸𝗲 𝘃𝗮𝗻 𝗞𝘆𝗹𝗲 𝗶𝗻 𝘀𝗲𝗿𝗶𝗲𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗴𝗲: '𝗗𝗲 𝘃𝗲𝗿𝗹𝗼𝗿𝗲𝗻 𝘇𝗼𝗼𝗻'
De deelname van Kyle aan 'Married at First Sight' houdt de gemoederen flink bezig op social media. Terwijl hij zelf nog zoekt naar zijn gevoelens voor Danique, zien kijkers op X vooral een opvallende gelijkenis met een wereldberoemd seriepersonage.
https://www.rtl.nl/boulevard/artikel/5596635/mafs-kijkers-vinden-look-van-kyle-seriepersonage
-
Keanu Reeves Drops Bombshell About Jim Carrey #New #Face #Clone #LookAlike
#KeanuReeves #JimCarrey -
Am I wrong, or have I seen something very like this before? 🤔
I'm not convinced that buying one of these as a "companion" to your high-end iPhone or Pixel is a great selling point. If you've already splashed out 1,000 spondoolacks on your chosen flavour of smartphone, do you really want to hand over another 500? If you're an Apple fanboi, do you want to have an Android device as well? Dunno. Jus' sayin'. 🤷♂️
(Oh, and "communciation"? 😂)
-
Am I wrong, or have I seen something very like this before? 🤔
I'm not convinced that buying one of these as a "companion" to your high-end iPhone or Pixel is a great selling point. If you've already splashed out 1,000 spondoolacks on your chosen flavour of smartphone, do you really want to hand over another 500? If you're an Apple fanboi, do you want to have an Android device as well? Dunno. Jus' sayin'. 🤷♂️
(Oh, and "communciation"? 😂)
-
@theplaguedoc Next time you're in London, look out for the loyal DLR dogs bringing you a third rail so your train can stay powered.
-
@theplaguedoc Next time you're in London, look out for the loyal DLR dogs bringing you a third rail so your train can stay powered.
-
@theplaguedoc Next time you're in London, look out for the loyal DLR dogs bringing you a third rail so your train can stay powered.
-
@theplaguedoc Next time you're in London, look out for the loyal DLR dogs bringing you a third rail so your train can stay powered.
-
There is another Lizard on the radar! Looming Lizard is an actor creating hundreds of lookalike domains impersonating popular banks and telecommunication companies targeting Spanish speaking countries, such as Mexico. Not only they are lookalikes, but are also RDGAs (Registered DGAs), with new domains created on a daily basis. These are some of the entities they impersonate:
- Banks: Banorte, BBVA, Citi, HSBC, Itaú, Santander, Scotiabank
- Telecommunications: AT&T, BTC, Claro, Liberty, Movistar, Telcel, Tigo
- Others: post offices, department stores, energy companiesFor one of the lookalikes to Tigo (tigoppy[.]club), the actor was kind enough and offered the ability to trade our (fake) account points for nice prizes (wink wink). Sample of domains for each mentioned company:
- banortex[.]vip, banortepmex[.]store, banorteoi[.]icu, banorteoi[.]sbs, banortebc[.]top
- bbvamex[.]xin, bbvamex[.]xyz, bbvamxn[.]cyou, bbvamxn[.]store, bbvamxn[.]sbs
- citiprr[.]top, citipr[.]top, citipr[.]vip, citiipir[.]top, citiipir[.]vip
- mex-hsbc[.]xyz, mexhsbc[.]icu, mex-hsbc[.]icu, mex-hsbc[.]xin, mexhsbck[.]pro
- itauupy[.]top, ittau[.]top, itauupyi[.]top, itaui[.]cfd, itaupy[.]top
- santander-mex[.]xin, santandermox[.]vip, santander-mex[.]sbs, santander-mex[.]icu, santandermox[.]xyz
- scotiabank-mx.xyz, scotiabok[.]xyz, scotiiiai[.]vip, scotiabanukmx[.]sbs, scotiiiai[.]xin
- attmiex[.]pro, att-com-mx[.]top, attmmex[.]xyz, att-com-mx[.]xin, attmmex[.]vip
- btcbahamass[.]vip, btcbahamasni[.]vip, btcbahamasni[.]xin, btcbahamasi[.]top, btcbahamasni[.]top
- claroar[.]top, claroec[.]vip, clarosv[.]top, claropy[.]vip, clarolo[.]top
- liberty-cr[.]xyz, liberty-cr[.]vip, liberty-cr[.]icu, liberty-cr[.]xin, liberty-cr[.]cc
- movisstar[.]pro, movisstar[.]xyz, movistar-uy[.]xin, movisstar[.]sbs, movistarui[.]icu
- telcelsi[.]top, telcelt[.]bond, telcele[.]info, telceln[.]qpon, telcel0[.]online
- tiiigopy[.]xyz, tigosv[.]top, tigosv[.]cc, tigosvi[.]top, tigoipy[.]top
https://urlscan.io/result/375469cb-d1ac-4b91-8dbe-18c5f42d427d/
https://urlscan.io/result/019656a1-67b5-7007-acc9-8834551420f7/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infoblox #infobloxthreatintel #lookalike #phishing #rdga #scam -
There is another Lizard on the radar! Looming Lizard is an actor creating hundreds of lookalike domains impersonating popular banks and telecommunication companies targeting Spanish speaking countries, such as Mexico. Not only they are lookalikes, but are also RDGAs (Registered DGAs), with new domains created on a daily basis. These are some of the entities they impersonate:
- Banks: Banorte, BBVA, Citi, HSBC, Itaú, Santander, Scotiabank
- Telecommunications: AT&T, BTC, Claro, Liberty, Movistar, Telcel, Tigo
- Others: post offices, department stores, energy companiesFor one of the lookalikes to Tigo (tigoppy[.]club), the actor was kind enough and offered the ability to trade our (fake) account points for nice prizes (wink wink). Sample of domains for each mentioned company:
- banortex[.]vip, banortepmex[.]store, banorteoi[.]icu, banorteoi[.]sbs, banortebc[.]top
- bbvamex[.]xin, bbvamex[.]xyz, bbvamxn[.]cyou, bbvamxn[.]store, bbvamxn[.]sbs
- citiprr[.]top, citipr[.]top, citipr[.]vip, citiipir[.]top, citiipir[.]vip
- mex-hsbc[.]xyz, mexhsbc[.]icu, mex-hsbc[.]icu, mex-hsbc[.]xin, mexhsbck[.]pro
- itauupy[.]top, ittau[.]top, itauupyi[.]top, itaui[.]cfd, itaupy[.]top
- santander-mex[.]xin, santandermox[.]vip, santander-mex[.]sbs, santander-mex[.]icu, santandermox[.]xyz
- scotiabank-mx.xyz, scotiabok[.]xyz, scotiiiai[.]vip, scotiabanukmx[.]sbs, scotiiiai[.]xin
- attmiex[.]pro, att-com-mx[.]top, attmmex[.]xyz, att-com-mx[.]xin, attmmex[.]vip
- btcbahamass[.]vip, btcbahamasni[.]vip, btcbahamasni[.]xin, btcbahamasi[.]top, btcbahamasni[.]top
- claroar[.]top, claroec[.]vip, clarosv[.]top, claropy[.]vip, clarolo[.]top
- liberty-cr[.]xyz, liberty-cr[.]vip, liberty-cr[.]icu, liberty-cr[.]xin, liberty-cr[.]cc
- movisstar[.]pro, movisstar[.]xyz, movistar-uy[.]xin, movisstar[.]sbs, movistarui[.]icu
- telcelsi[.]top, telcelt[.]bond, telcele[.]info, telceln[.]qpon, telcel0[.]online
- tiiigopy[.]xyz, tigosv[.]top, tigosv[.]cc, tigosvi[.]top, tigoipy[.]top
https://urlscan.io/result/375469cb-d1ac-4b91-8dbe-18c5f42d427d/
https://urlscan.io/result/019656a1-67b5-7007-acc9-8834551420f7/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infoblox #infobloxthreatintel #lookalike #phishing #rdga #scam -
There is another Lizard on the radar! Looming Lizard is an actor creating hundreds of lookalike domains impersonating popular banks and telecommunication companies targeting Spanish speaking countries, such as Mexico. Not only they are lookalikes, but are also RDGAs (Registered DGAs), with new domains created on a daily basis. These are some of the entities they impersonate:
- Banks: Banorte, BBVA, Citi, HSBC, Itaú, Santander, Scotiabank
- Telecommunications: AT&T, BTC, Claro, Liberty, Movistar, Telcel, Tigo
- Others: post offices, department stores, energy companiesFor one of the lookalikes to Tigo (tigoppy[.]club), the actor was kind enough and offered the ability to trade our (fake) account points for nice prizes (wink wink). Sample of domains for each mentioned company:
- banortex[.]vip, banortepmex[.]store, banorteoi[.]icu, banorteoi[.]sbs, banortebc[.]top
- bbvamex[.]xin, bbvamex[.]xyz, bbvamxn[.]cyou, bbvamxn[.]store, bbvamxn[.]sbs
- citiprr[.]top, citipr[.]top, citipr[.]vip, citiipir[.]top, citiipir[.]vip
- mex-hsbc[.]xyz, mexhsbc[.]icu, mex-hsbc[.]icu, mex-hsbc[.]xin, mexhsbck[.]pro
- itauupy[.]top, ittau[.]top, itauupyi[.]top, itaui[.]cfd, itaupy[.]top
- santander-mex[.]xin, santandermox[.]vip, santander-mex[.]sbs, santander-mex[.]icu, santandermox[.]xyz
- scotiabank-mx.xyz, scotiabok[.]xyz, scotiiiai[.]vip, scotiabanukmx[.]sbs, scotiiiai[.]xin
- attmiex[.]pro, att-com-mx[.]top, attmmex[.]xyz, att-com-mx[.]xin, attmmex[.]vip
- btcbahamass[.]vip, btcbahamasni[.]vip, btcbahamasni[.]xin, btcbahamasi[.]top, btcbahamasni[.]top
- claroar[.]top, claroec[.]vip, clarosv[.]top, claropy[.]vip, clarolo[.]top
- liberty-cr[.]xyz, liberty-cr[.]vip, liberty-cr[.]icu, liberty-cr[.]xin, liberty-cr[.]cc
- movisstar[.]pro, movisstar[.]xyz, movistar-uy[.]xin, movisstar[.]sbs, movistarui[.]icu
- telcelsi[.]top, telcelt[.]bond, telcele[.]info, telceln[.]qpon, telcel0[.]online
- tiiigopy[.]xyz, tigosv[.]top, tigosv[.]cc, tigosvi[.]top, tigoipy[.]top
https://urlscan.io/result/375469cb-d1ac-4b91-8dbe-18c5f42d427d/
https://urlscan.io/result/019656a1-67b5-7007-acc9-8834551420f7/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infoblox #infobloxthreatintel #lookalike #phishing #rdga #scam -
There is another Lizard on the radar! Looming Lizard is an actor creating hundreds of lookalike domains impersonating popular banks and telecommunication companies targeting Spanish speaking countries, such as Mexico. Not only they are lookalikes, but are also RDGAs (Registered DGAs), with new domains created on a daily basis. These are some of the entities they impersonate:
- Banks: Banorte, BBVA, Citi, HSBC, Itaú, Santander, Scotiabank
- Telecommunications: AT&T, BTC, Claro, Liberty, Movistar, Telcel, Tigo
- Others: post offices, department stores, energy companiesFor one of the lookalikes to Tigo (tigoppy[.]club), the actor was kind enough and offered the ability to trade our (fake) account points for nice prizes (wink wink). Sample of domains for each mentioned company:
- banortex[.]vip, banortepmex[.]store, banorteoi[.]icu, banorteoi[.]sbs, banortebc[.]top
- bbvamex[.]xin, bbvamex[.]xyz, bbvamxn[.]cyou, bbvamxn[.]store, bbvamxn[.]sbs
- citiprr[.]top, citipr[.]top, citipr[.]vip, citiipir[.]top, citiipir[.]vip
- mex-hsbc[.]xyz, mexhsbc[.]icu, mex-hsbc[.]icu, mex-hsbc[.]xin, mexhsbck[.]pro
- itauupy[.]top, ittau[.]top, itauupyi[.]top, itaui[.]cfd, itaupy[.]top
- santander-mex[.]xin, santandermox[.]vip, santander-mex[.]sbs, santander-mex[.]icu, santandermox[.]xyz
- scotiabank-mx.xyz, scotiabok[.]xyz, scotiiiai[.]vip, scotiabanukmx[.]sbs, scotiiiai[.]xin
- attmiex[.]pro, att-com-mx[.]top, attmmex[.]xyz, att-com-mx[.]xin, attmmex[.]vip
- btcbahamass[.]vip, btcbahamasni[.]vip, btcbahamasni[.]xin, btcbahamasi[.]top, btcbahamasni[.]top
- claroar[.]top, claroec[.]vip, clarosv[.]top, claropy[.]vip, clarolo[.]top
- liberty-cr[.]xyz, liberty-cr[.]vip, liberty-cr[.]icu, liberty-cr[.]xin, liberty-cr[.]cc
- movisstar[.]pro, movisstar[.]xyz, movistar-uy[.]xin, movisstar[.]sbs, movistarui[.]icu
- telcelsi[.]top, telcelt[.]bond, telcele[.]info, telceln[.]qpon, telcel0[.]online
- tiiigopy[.]xyz, tigosv[.]top, tigosv[.]cc, tigosvi[.]top, tigoipy[.]top
https://urlscan.io/result/375469cb-d1ac-4b91-8dbe-18c5f42d427d/
https://urlscan.io/result/019656a1-67b5-7007-acc9-8834551420f7/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infoblox #infobloxthreatintel #lookalike #phishing #rdga #scam -
how accurate are these? 🤔(via jazmin.rodriguez416) #houston #texans #nfl #mlb #lookalike https://www.rawchili.com/4200070/ #Football #HoustonTexans #HoustonTexans #NFL
-
how accurate are these? 🤔(via jazmin.rodriguez416) #houston #texans #nfl #mlb #lookalike https://www.rawchili.com/4200070/ #Football #HoustonTexans #HoustonTexans #NFL
-
#monalisa #sophyridge #skynews #art #masterpiece #funny #smile #painting #lookalike #smiling #enigmatic #picture #pictures #leonardo #women #beauty
A slightly crazy post, but this photo turned up on my phone again. Sophy Ridge from Sky News and the Mona Lisa. It’s the smile that somehow links the pictures! -
#monalisa #sophyridge #skynews #art #masterpiece #funny #smile #painting #lookalike #smiling #enigmatic #picture #pictures #leonardo #women #beauty
A slightly crazy post, but this photo turned up on my phone again. Sophy Ridge from Sky News and the Mona Lisa. It’s the smile that somehow links the pictures! -
CW: Joke that can be misinterpreted as racist, but meant as humor. Please remember that different people enjoy different types of humor. Muting or blocking me saves time for everyone, including moderators. Have a great day. Love, Esmie.
A Chinese child asked his father:
"Why does the world say we all look alike?"
The father replied: "People have nothing better to say...
And besides, I'm your uncle, not your father."#ChineseJoke #LookAlike #FamilyHumor #DadJokes #CulturalHumor #LightHumor
-
CW: Joke that can be misinterpreted as racist, but meant as humor. Please remember that different people enjoy different types of humor. Muting or blocking me saves time for everyone, including moderators. Have a great day. Love, Esmie.
A Chinese child asked his father:
"Why does the world say we all look alike?"
The father replied: "People have nothing better to say...
And besides, I'm your uncle, not your father."#ChineseJoke #LookAlike #FamilyHumor #DadJokes #CulturalHumor #LightHumor
-
Immer wenn ich Herbert #Kickl in den Nachrichten sehe, denke ich, jetzt übernimmt Jens Söring die Macht in #Österreich 😅
-
Immer wenn ich Herbert #Kickl in den Nachrichten sehe, denke ich, jetzt übernimmt Jens Söring die Macht in #Österreich 😅
