#subdomains — Public Fediverse posts

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

Threat actors are leveraging shared infrastructure together with subdomain abuse to control and serve hundreds of malicious websites with minimal management.

This week we were investigating a cluster of crypto brand lookalike domains.Through subdomain abuse – often powered by wildcard DNS configurations – just 34 registered domains expand to over 500 scam sites.

Investigating website content across that cluster allowed us to find several additional clusters running the same playbook. Thousands of domains on them.

This initial cluster impersonated dozens of brands — Binance, Coinbase, Kraken, KuCoin, Bybit, Bitmart. Several of these sites push fake app downloads, making malware delivery and crypto wallet theft a likely component of the broader operation.

A sample of the domains associated:

cryptocoinsx[.]cfd
bmarkit[.]com
zznyusbsgo.bitmart[.]pw
4pzyy6n7log71mm0.bitmarts[.]cc
5etxkk2aeh8jfgl0.bitstamptc[.]com

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #Phishing #Scams #malware #crypto #lookalikes #subdomains #iocs

So many web apps I have installed. 😄

#SelfHosting #YunoHost #Docker #WebApps #ITStudent #DigitalAutonomy #TechStack #Subdomains #Linux #OpenSource #KalvinBase #Nulu #Memos #OpenGist #Invidious #Redlib #Zusam #TechLife #SystemAdmin #IT

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

Are you allowed to be proud when your work is included in SecLists? 🥲

#SecLists #pentesting #RedTeam #BugBounty #wordlist #DNS #subdomains #hacking #recon

Are you allowed to be proud when your work is included in SecLists? 🥲

#SecLists #pentesting #RedTeam #BugBounty #wordlist #DNS #subdomains #hacking #recon

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking

I recently made a highly efficient subdomain discovery wordlist by scanning the entire IPv4 space for SSL certs.

I've written a full article on the project, which is, in fact, my first public InfoSec article ever!

I would love to hear what you think!

You can read it here:
https://n0kovo.github.io/posts/subdomain-enumeration-creating-a-highly-efficient-wordlist-by-scanning-the-entire-internet/

(boosts and shares highly appreciated ❤️)

#infosec #writeup #redteam #pentesting #recon #reconnaissance #enumeration #subdomain #subdomains #wordlist #masscan #osint #bugbounty #bughunter #hacking