ITWhale (@whale_it) profile picture

ITWhale

@whale_it

Report phishing / malware sites to the public to get them taken down. Sites are found by a bot but posted here by a human.

Joined October 2019
  • Tweets1.1K
  • Following19
  • Followers424
847Media
Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)Photo by ITWhale (@whale_it)
#phishing Office 365 Phishing Page Hosted by @Cloudflare @CloudflareAbuse //pub-2cef879ebcad40cd8c2aa23a37faed46.r2.dev/kklopsd.html
Image from ITWhale (@whale_it)
1
241
Actually the office phishing page is on //wingspanaloppers.com/lortfg/ Hosted by SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY) IP: 111.90.149.198 (Malaysia)
1
167
🤷‍♂️ Not sure what to do with my time.
Image from ITWhale (@whale_it)
Replying to @phishing
@Phishing Hiding behind @CloudflareAbuse @Cloudflare //msrsuvo.com/ //link-sparkassen-de-2021.xyz //kalendar.zn.ua/ //www.de-pplvalidierungsprozess2345.xyz/ //de-pplvalidierungsprozess234523456.xyz //de-2021-sparka-sicherheit-zum-login.xyz //spknet-digi-24.xyz
Image from ITWhale (@whale_it)
Image from ITWhale (@whale_it)
1
//production.microsoftpassword-update0009-hfhfhf-draspy-rice-57e5.s-hiestand.workers.dev/ //production.outlook-office365-commicrosoftpasswordupdate-storage-tooth-d3eb.s-hiestand.workers.dev/ //www.2021-spark-sicherheiten-login.xyz
2
#Phishing Multiple Phishing sites Hiding behind @CloudflareAbuse @Cloudflare //sky-login-mobile.com/ //icy-mud-45aa.admin6854.workers.dev/ //ancient-lab-15b5.rhn21600.workers.dev/ //plain-bird-ee0e.jim-isaac10001.workers.dev/ //old-snow-2858.ar3a3fraq3.workers.dev/
Image from ITWhale (@whale_it)
Image from ITWhale (@whale_it)
Image from ITWhale (@whale_it)
1
1
#Phishing PayPal URL: //payplsupport6476839130.info IP: 45.8.224.179 Hosted by @hostedby20i Domain registrar: @Namecheap
Image from ITWhale (@whale_it)
2
2
4
Image from ITWhale (@whale_it)
2
#Phishing Targeting UPS URL: mypoparcel-redelivery[.]com Hiding behind @CloudflareAbuse @CloudflareHelp Domain Reg:1API GmbH
Image from ITWhale (@whale_it)
1
#Phishing Lloyds Bank URL: //secureloginlloyds[.]com Hiding behind @CloudflareAbuse @Cloudflare 104.21.47.221 Domain Reg: 1API GmbH
Image from ITWhale (@whale_it)
1
2
3
Reported 6 Days ago? Still online. Are you going remove this site? @CloudflareAbuse @CloudflareHelp
#phishing Monzo Bank URL: //login-secureapp.com URL: //monzo-login.com Hosted by PLI-AS, PA @PrivateLayer IP: 179.43.140.186 Domain Registration: ERANET
Image from ITWhale (@whale_it)
1
2
2
For Info @bradleyjkemp
1
1
Anyone know what the .openpublishing.build.ps1 is for on MicrosoftDocs GitHub repos as they no longer have access/manage that blob storage. //opbuildstorageprod.blob.core.windows.net github.com/MicrosoftDocs/mic…
GitHub - MicrosoftDocs/microsoft-365-docs: This repo is used to host the source for the Microsoft...

GitHub - MicrosoftDocs/microsoft-365-docs: This repo is used to host the source for the Microsoft...

This repo is used to host the source for the Microsoft 365 documentation on https://docs.microsoft.com. - MicrosoftDocs/microsoft-365-docs

github.com
1
1
Something is definitely trying to connect to the blob storage.
Image from ITWhale (@whale_it)
Image from ITWhale (@whale_it)
#Phishing Office 365 URL: //writview.ga/XcNwvFtzu0rHQ2iGm7ZO9JKsBWlqkDj5gnoY4TRIb8VSU6peAxMa3hLCE1yf.php IP is 162.241.126.156 Hosted by UNIFIEDLAYER @bluehostsupport @bluehost
Image from ITWhale (@whale_it)
2
1
1
I think most of these freenom domains on this IP are pointing to office phishing sites. They all have redirects to //office.com //loginmicrosoftonlinecomcomonauthorize.xyz/ //writview.ga/ //abbalid.ga/ //eyerclod.ga/
#Phishing Office 365 URL: //www.radiooslatinos.pt/player/journal/IK/[email protected] Hosted by @Hetzner_Online
Image from ITWhale (@whale_it)
4
#Phishing Office 365 URL: //easytocanada.com/nq?target=dGVzdEBleGFtcGxlLmNvbQ== Hosted by UNIFIEDLAYER @bluehost @bluehostsupport Domain registrar: FastDomain Inc.
Image from ITWhale (@whale_it)
1
1
3
Site suspended 👍
Image from ITWhale (@whale_it)
1
Postoffice phishing site URL: //postoffice-redelivery.delivery Hosted by @Namecheap IP is 162.213.251.147
Image from ITWhale (@whale_it)
1
Load more