#netcraft — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #netcraft, aggregated by home.social.
-
@publicvoit ist halt ein Werbetext der Firmen ansprechen soll. Ich hab #NextDNS und Browser Erweiterungen ( #uBlockOrigin, #Netcraft, etc.) für sowas.
Wichtig ist halt auch die Anwender entsprechend auf mögliche Betrugsversuche, #Phishing, #Malware-Attacken vorzubereiten.
-
Do you remember the false-positive flagging of our page about 2 weeks ago by #netcraft?
Well … we still got messages from people around the world, various networks or browsers, that having error messages we assume are related to that incident ("Sorry. We flagged your page accidentally" was there response back than). Most of the errors do not have a chance to report a false-positive or start a review. Also we are not getting provided with information so we can take action here. -
#Netcraft describes itself as "digital risk protection" and "Advanced Cybercrime Defense". Having been flagged by them 4 times now, and each time with an easily recognizable false positive (they also pinged our provider, which then threatened with actions – and added our domain to their blacklist right away!), I'm quite fed up with their seemingly incompetence: first shoot, then ask. All automated, obviously no humans involved on their end.
My experience so far: https://gitlab.com/-/snippets/4909577
(1/2)
-
New infosec products of the week: October 17, 2025 https://www.helpnetsecurity.com/2025/10/17/new-infosec-products-of-the-week-october-17-2025/ #PicusSecurity #Corelight #BitSight #Cayosoft #Netcraft #Blumira #News #Aura
-
Next week, I'm speaking at #Saintcon about #phishing, #smishing, #quishing (all the -ishings) and propose a broad-based possible solution that could end this problem forever. Nothing big.
If you're going to be there, you can find me in Track 2 at 2:30pm, or most of the rest of the time at the @SAINTCON @malwarevillage Community, where we will be hosting two of our contests (MARC I and BOMBE) and encouraging people to consider the field of malware analysis and threat research as a career.
We also will have minibadges, both at #MalwareVillage and at the #Netcraft booth. If you're a #minibadge fan/collector, you aren't going to want to miss out on the Netcraft minibadge, which is awesome. Just drop by the booth to get a kit to build one. Tell them Spike sent ya.
Until then, stay safe, and please tell everyone you know, don't click links to tax refunds or toll road fees you get on your phone.
/END
https://www.netcraft.com/blog/taxpayers-drivers-targeted-in-refund-and-road-toll-smishing-scams
-
And I just wanted to give a quick shoutout to our engineering team for noticing this bizarre trick that all of the #phishing pages do that we connect to this #LoggerEIO group.
The phishing kit in use has several pages that the victims are expected to click through. As one enters information onto the first page, then clicks a Continue button, the browser initiates a WebSocket connection with the server, and transmits the data inside of that WebSocket connection.
It isn't exactly encryption, but more obfuscation: The compression, while reversible, does have the effect of obfuscating the content of the exfiltrated data. That little bit of effort might prevent a Data Loss Prevention (DLP) tool from recognizing outbound sensitive data before it's too late.
And the reason we call them #LoggerEIO is because all of the sites that Netcraft connects to this campaign do this on the same URI string: The page makes a connection to the path /logger/?EIO=4&transport=websocket in its GET request - only when the victim sends the data.
/6
#smishing #phishing #NetcraftConfirmsIt #Netcraft #threatresearch #WebSocket
-
Germany was not the only non-US country represented in the #LoggerEIO #smishing attack (so far).
There was one version of a page claiming to be the Spanish highway authority, Dirección General del Tráfico (DGT), that warns you owe a 100 Euro fine (multa) for some kind of driving infraction you committed, that must be paid within 24 hours.
More recently, I spotted a flood of pages that claim to be from the UK government's Winter Fuel Payment program. The real program helps impoverished people not freeze to death in winter by subsidizing the high cost of heating. But this page simply wants your credit card to "test" charge your card for £1 on the promise that you'll get up to £300.
/5
#smishing #phishing #roadtoll #HighwayRobbery #WinterFuelPayment #UK #spain #espana #Netcraft #NetcraftConfirmsIt #NetcraftResearch #Germany
-
Having recently returned from a trip to #Germany, where I spoke at #VirusBulletin, I have become more familiar with the appearance of some German government operated websites.
The Bundeszentralamt für Steuern (or BZSt), Germany's federal tax authority, is also represented in these #TaxScam #phishing pages.
Bizarrely, #LoggerEIO have decided to clone the template of one of the US-themed versions of the #smishing page which prominently features a banner image of a US form #1040 #tax return, and the corner of a $20 bill, neither of which (I suspect) the #BZSt use for tax filing in that country.
Whoopsie! Or, as my German friends might say, Hoppla!
/4
-
In this #scam, the #smishing message informs you that you are owed a reimbursement or refund on overpaid state taxes. The #LoggerEIO group seems to have latched on to the idea of using individual states as the lure, rather than the federal #IRS, which is an interesting choice.
In the pages I looked at, the following states were represented with custom #phishing pages that use the same stylesheet, color scheme, and logos of the state tax agency they're impersonating.
Targeted states include Alabama, California, Connecticut, Delaware, Florida, Maryland, Massachusetts, Michigan, Minnesota, Montana, New Jersey, New York, Ohio, Texas, Tennessee, Washington, and Wisconsin.
/3
#smishing #netcraft #NetcraftConfirmsIt #taxrefund #taxrefundscam
-
First of all, this seems to be part of a much wider #smishing campaign that people are more familiar with: Fake road toll collection #scams
These have been a nuisance all year, and some of the sites hosting the same #phishing kit appear to be using that same ruse, simultaneously with the new one.
Did you get a message telling you that you owe $6.99 (or $6.69 - nice) in tolls? Probably part of this larger network of scammers.
Note how they have expanded to a variety of different locales: the City of Los Angeles, Seattle, Columbus (Ohio), and even the Canadian province of Ontario are all reflected, as well as the E-ZPass and SunPass multi-state toll payment systems, which together cover most of the US states that operate toll roads.
/2
#phishing #fraud #roadtoll #tollscams #netcraft #NetcraftConfirmsIt #EZPass #SunPass
-
Happy Thursday! I'm celebrating the publication of my first blog post at @Netcraft as Principal Threat Researcher with a story about...#smishing for tax refunds.
Since the beginning of last month, a threat actor we're calling #LoggerEIO began registering domains for use in #phishing attacks.
They're now up to more than 850 domains registered, with thousands of websites in use (using a variety of subdomains) that dangle the prospect of a refund of state income tax overpayments as a lure.
Here's a quick 🧵 about it.
https://www.netcraft.com/blog/taxpayers-drivers-targeted-in-refund-and-road-toll-smishing-scams
-
Netcraft launches Phone Scam Disruption to stop brand impersonation calls and texts https://www.helpnetsecurity.com/2025/10/15/netcraft-phone-scam-disruption/ #Industrynews #Netcraft
-
Scammers Steal $1 Million in Crypto Using Fake Delta and AMC Sites https://hackread.com/scammers-steal-crypto-using-fake-delta-and-amc-sites/ #BrandImpersonation #ScamsandFraud #Cybersecurity #Brandjacking #Blockchain #Security #Netcraft #TaskScam #Crypto #Fraud
-
Scammers Steal $1 Million in Crypto Using Fake Delta and AMC Sites – Source:hackread.com https://ciso2ciso.com/scammers-steal-1-million-in-crypto-using-fake-delta-and-amc-sites-sourcehackread-com/ #1CyberSecurityNewsPost #BrandImpersonation #CyberSecurityNews #cybersecurity #ScamsandFraud #Brandjacking #Blockchain #Hackread #Netcraft #security #TaskScam #Crypto #Fraud
-
You can’t trust AI chatbots not to serve you phishing pages, malicious downloads, or bad code https://www.helpnetsecurity.com/2025/07/03/you-cant-trust-ai-chatbots-not-to-serve-you-phishing-pages-malicious-downloads-or-bad-code/ #Artificialintelligence #Don'tmiss #cyberrisk #Hotstuff #Netcraft #phishing #malware #News #LLMs
-
DuckDuckGo’s Scam Blocker now blocks more types of scams https://www.helpnetsecurity.com/2025/06/20/duckduckgo-scam-blocker-update/ #DuckDuckGo #Netcraft #software #privacy #News
-
Chinese Phishing Service Haozi Resurfaces, Fueling Criminal Profits https://hackread.com/chinese-phishing-service-haozi-criminal-profits/ #Cybersecurity #CyberAttack #CyberCrime #Security #Netcraft #Tether #China #Fraud #Haozi #Scam #USDT
-
Chinese Phishing Service Haozi Resurfaces, Fueling Criminal Profits – Source:hackread.com https://ciso2ciso.com/chinese-phishing-service-haozi-resurfaces-fueling-criminal-profits-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttack #CyberCrime #Hackread #Netcraft #security #Tether #China #Fraud #Haozi #Scam #USDT
-
It would be interesting to see the spread of HTTP 451 Unavailable For Legal Reasons by country over time. I've pinged #netcraft to ask if they can add a tally for this code.
-
Darcula allows tech-illiterate crooks to create, deploy DIY phishing kits targeting any brand https://www.helpnetsecurity.com/2025/02/20/darcula-allows-tech-illiterate-crooks-to-create-deploy-diy-phishing-kits-targeting-any-brand/ #digitalwallet #paymentcards #SecAlliance #cybercrime #Don'tmiss #Hotstuff #Netcraft #phishing #News
-
Black Friday shoppers targeted with thousands of fraudulent online stores https://www.helpnetsecurity.com/2024/11/26/black-friday-fake-fraudulent-online-stores/ #onlineshopping #Don'tmiss #Hotstuff #consumer #holidays #Netcraft #retail #fraud #News
-
Tiens, Netcraft a intercepté et analysé les techniques d'opération des cybercriminels spécialisés dans l'arnaque au QR code, une méthode ayant sévi aussi en Suisse romande à la fin juin / debout juillet dans le parking où des autocollants ont été placés frauduleusement.
⬇️
"Faux code QR dans les parkings: l'arnaque touche tout le canton"
👇
https://www.20min.ch/fr/story/vaud-faux-code-qr-dans-les-parkings-larnaque-touche-tout-le-canton-103145802Il est fort probable qu'il s'agisse du même groupe (roumain selon la langue du code analysé par Netcraft) ayant opéré au Royaume-Uni (et en France) au même moment, et de la même campagne, au vu de la période et des découvertes de Netcraft.
Ils ont probablement recruté de la "main-d'œuvre" locale pour coller les autocollants en UK , Suisse et France..., en ciblant les parkings en se basant simplement sur la distribution géographique des parking utilisant la solution PayByPhone en Europe.
👀
"The phishing websites contain internationalization files for English, French, German, Italian, and Romansh (spoken in Switzerland), indicating that this attack is being deployed on a trans-European scale. This backs up news reports from both Switzerland and France where have been found linking to the same phishing websites "
"Les sites de phishing contiennent des fichiers d'internationalisation pour l'anglais, le français, l'allemand, l'italien et le romanche (NDR 😳) (langue parlée en Suisse), ce qui indique que cette attaque est déployée à l'échelle transeuropéenne. Cela confirme les rapports d'information provenant de la Suisse et de la France qui ont été trouvés en lien avec les mêmes sites d'hameçonnage."
Analyse complète de Netcraft
⬇️
"Problems in the Parking Lot: Threat Actors Use IRL Quishing to Target Travelers"
👇
https://www.netcraft.com/blog/irl-quishing-scams-target-travelers/Selon le timing rapporté par Netcraft :
- 19 juin : début de l'arnaque, les premiers sites de phishing apparaissent mais sont rapidement mis hors ligne après une semaine.
- 28 juin : réapparition de l'arnaque avec un nouveau nom de domaine.
- 2 juillet : enregistrement de deux nouveaux domaines redirigeant vers les sites initiaux.
- 27 juillet : alternance continue de sites mis en ligne puis hors ligne.
- Début août : de nouveaux domaines sont enregistrés régulièrement, certains ne restant en ligne que brièvement.
- Mi-août : tous les sites de phishing connus sont désactivés, l'acteur malveillant enregistre de nouveaux domaines avec des variations (comme parkbyphone au lieu de paybp), ces sites ne restent en ligne que quelques jours.
- Fin août et au-delà : le même schéma persiste avec l'utilisation de nouveaux TLDs pour éviter la détection (comme .live et .online), chaque site ne restant actif que quelques jours.
Pendant cette période (du 19 juin au 23 août) les chercheurs de Netcraft ont trouvé que 10 000 utilisateurs ont accédé à ces sites malveillants entre le 19 juin et le 23 août, parmi lesquels beaucoup pourraient être des victimes ayant scanné les faux QR codes. Sur l’un des sites, 2 199 soumissions de formulaires ont été enregistrées, impliquant potentiellement des détails de carte de paiement.
Détails techniques observées pour les domaines frauduleux:
Enregistrés via NameSilo
Using .info, .click, .live, .online, and .site TLDs
Protected with Cloudflare (NDR of course, toujours présents dans ces phishings 🤬) -
To no one's surprise, the plot is another hockey stick
Scam Sites at Scale: LLMs Fueling a GenAI Criminal Revolution | #Netcraft
https://www.netcraft.com/blog/llms-fueling-gen-ai-criminal-revolution/ -
Netcraft Announces New AI-Powered Innovations to Disrupt and Expose Criminal Financial Infrastructure – Source: www.darkreading.com https://ciso2ciso.com/netcraft-announces-new-ai-powered-innovations-to-disrupt-and-expose-criminal-financial-infrastructure-source-www-darkreading-com/ #rssfeedpostgeneratorecho #DarkReadingSecurity #CyberSecurityNews #DARKReading #announces #Netcraft
-
Dracula Phishing Platform Targets Organizations Worldwide – Source: securityboulevard.com https://ciso2ciso.com/dracula-phishing-platform-targets-organizations-worldwide-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #CybersecurityNews #SecurityAwareness #SecurityBoulevard #cybercriminals #Cybersecurity #CyberThreats #onlinesafety #imessage #Netcraft #Careers #SBNNews #Apple
-
Fake Online Stores See A 135% Spike As Black Friday And Holiday Shopping Approaches | #Netcraft
https://www.netcraft.com/blog/fake-online-stores-see-black-friday-spike/