Spear Phishing against Painter Decorators

This article is a work in progress, some back in a day or so please.

Unusual one this… a painter decorator friend has been plagued by various attempts at phishing his e-mail logins over the past few months. Each time I’ve got to investigating it the “bad page” in the email link has been removed.

Today I got to one early enough to research it while the site was still active.

It starts with a full e-mail conversation that looks like a client interested in the decorators service:

decorating spear phishing

The decorator responds… and then gets a reply with a supposed link to a design or work order.

This link is the phishing page.

https://zakutasinbola.info/3r69mo/bahubali.php?id=00XXX8XX

With what looks potentially like a unique id for the phishing attempt.

If the victim clicks the link they are presented with the phishing page prompting them to select their chosen login method:

decorating spear phishing page.png

decorating gmail phsihing example.png

And, if they fall for it, the deed is done.

However.. the person behind it didn’t do a good job of hiding who they are. The website is hosted in Russia but the domain involved with the one I investigated:

zakutasinbola.info

Registered by Saim Raza. They are, for other scams, using the email addresses “fu.d.too.l786@gmail.com”, “fu.d.tool7.86@gmail.com”, “fudtoo.l786@gmail.com”,  “fudtool786@gmail.com”, “fudtools@gmail.com”, “fud.tools@gmail.com”, “saim.raza1338@gmail.com” and “saim.raza.133.8@gmail.com” mainly using the telephone number “923241237632”.

Supposedly living in Lahore 31050 Pakistan possibly with family Rizwan, Werwer Shahzaf and Noman.. just going by a Google for the telephone number. These associations may be inaccurate.

This information sent me onto a trove of other likely phishing or malicious domains!

1869744.com
1online-activation.com
1online-activation.org
1online-reactivation.com
1online-reactivation.net
1support-technique.com
1support-technique.net
1support-technique.org
2online-activation.net
3lacmebatdone.com
9khlaovk9x.com
abhampashan.info
abhiayegawo.com
abihanirocker.com
abisuries.com
abnamro-alert.com
aboukangaz.com
abtokisikaypas.com
abtosabkadata.com
acc-bmo1-login.com
acced-desjard1-log.com
accesshelp-user.com
access-verificatiion.com
accountvalidation-services.com
accountverifynow.com
acc-secrue1.com
achasbc.com
achesbc.com
achievethem.com
achkomachko.info
achsbclog.com
acibrand.com
acoracide.com
acrotellfi.info
actidomainso.com
actuallz.tk
additiontechna.com
addonsproducts.com
adobefileshareingz.com
adobesauce.com
adobesprotct.com
adverstime.com
advisableserver.com
afabumtunpo.com
affilateservice.com
afinitycreditunion.com
agarishisabko.com
agihaitumer.info
ahlebateloop.com
ahmythsecur.com
ainakhiyand.info
aitumer.info
ajabnatyrisht.com
akhrihabhaeabm.info
alfaisalaih.com
aliancefunding.com
alibabahugia.com
alibabatred.com
alibabbaz.com
alimoladomnok.com
allgoodforno.com
allvegetablessupply.com
allvehiclepartssupply.com
almostweek.com
alorsdance.com
amdgfxclouss.info
americanhsbc.com
ameserve.com
andrjakarbol.com
angrezimain.info
anydasky.com
araboiluae.com
arabooilandgas.com
armoremsid.info
arrriyadh.com
asratgolikaw.com
assleticket.com
atbonline1.com
atharakatha.com
atratevalues.com
audia3i.com
authentisigs.pw
autonawab.com
awargithirehb.com
awaznechay.info
awlatreayhan.com
ayekhudafindorw.com
ayenetflizoa.com
ayhayu.com
azghorerinium.com
bachkrahna.com
bachpansay.com
badlakaralo.com
badnamzmana.com
badshahme.com
bakhshnanhi.com
banapastol.com
bancontact-pay.com
bandroxoma.com
bandroxxxoma.com
banigalaa.com
banking-securities.com
bankingwellssecurelogin.com
bankwithinvestec.com
banoteraswaer.com
barishkapani.info
barlessi.com
basecloudessd.com
basecoinsc.info
beacbuch.com
begumkapyar.com
beparmaishq.com
bercylesfund.com
bhagareyhum.com
bhagnews.com
bhamanihai.com
bhatiyarestor.com
bheeganimco.com
bholarecord.info
bhosabhraha.com
bilidablongra.info
bimardimagka.com
bizwalfes.com
bloshazalima.com
blueblasit.com
bm1o-sigin-logn.com
bmo1-log1n-sec.com
bmo1-mobile-online.com
bmoacaaac.com
bmo-mobile-online-update-now.com
boandamerica.com
boanewban.com
bohaytayae.com
bondpatipai.info
btanaphragr.com
btc-bh.com
bundoarvalves.com
c1bc-acc-login1.com
cablesayget.com
cakewalababa.com
camilacbila.com
canadagovcare.com
canadamobilityrefund.com
canadarevenewfix.com
canadepovd.com
cancel-subscriptionis-apple.com
canperforma.com
caranhweliyan.com
centerwaysi.com
ceo-mail.ml
chabhisovi.com
chaeslik.com
chalochalainmi.com
chalochaleinisb.com
chandmardawa.com
changigalcyar.info
chanjrandalo.com
charsetut.com
chasbardaoz.com
chaskaylartiker.info
chichongshpang.info
chintatachitata.com
chloachahuwa.com
ch-main.com
chotigandwa.com
chuthaidared.com
chutkijotum.com
citibanksibiu.com
cliendvds.com
client-collectonline.com
clnase.com
cloudcoinsc.info
cloudeprotine.com
cloudeto1mail.info
cloudevelly.info
cloud-flowss.com
cloudossione.com
clouds-server.com
codeteachna.com
cofepelayray.com
cofnirmyou.com
coinsservice.com
collect8-collect8.com
com-bz.com
come-live.tk
comensmentop.com
comiservices.com
com-v51.com
conservasprotomar.com
couptechna.com
courierd.com
courierinfos.com
courierworldson.com
credkarioy.com
cunionsuisse.com
customdnss.com
daikhnobay.info
daikhobatsunlo.com
dancealors.com
danifoss.com
dantkadard.com
dashehraeve.com
datacloude.com
datacloudeservicee.com
datanbdways.com
dataplues.com
dateshubs.com
dawatkahi.info
dc-dc7dbd92dde2.botfactorl.com
ddropss.com
deachun.com
debiaserver.com
decusigns.com
dedicatepanel.com
deesqual.com
dekhopaejan.com
delightelevat.com
deltareconz.com
demandertoola.com
demdproducts.com
des1j-accd-sign1.com
desjardins-accesd.com
desjardin-yes.com
dhamkarahe.com
dhishomang.com
dhishunmaka.com
dhokanfoot.com
dholaverayp.com
dhonbadhs.com
dhonblogs.com
dhyandiyakro.com
dilkochuraua.com
dilkortkabad.com
dillnaijanda.com
dilrubahase.com
dimpidadu.com
dinjonzbrand.com
dipb-ae.com
directbfund.com
dirpicture.com
discoveircc.com
discoverrflow.com
disputespaypal.com
dmamastklan.com
dmarc2hmt.info
dmarcserver.com
dobeint.com
docsendfiles.com
docs-filesharingpdf.com
documents-ppdf.com
domai-server.com
domcredits.com
donmains1.com
donotifes.com
dontlesroots.com
doriyanbolaygin.info
dosearrch.com
dosuitrahgye.com
dragproducts.com
dramaloirs.com
dramebazlondi.com
dreamjeerock.com
drlveoneofflce.info
droply.tk
dropmyui.com
dropvalues.com
dubaiover.com
duehelps.com
dueldomains.com
duetotaltech.com
dukhdardhis.com
easyonline-authentification.com
edertopcoma.com
edocument-online.com
egisteruy.com
ehelpsolve.com
eithescrop.com
elhoncho.com
elightelevat.com
email-automotors.com
emt-login-secure.com
emtmobilebrefunddeposit.com
emtmobilebrefunddeposits.com
emtmobiledeposit.com
emtmobilerefunddeposit.com
endonapriv.com
esihra.com
esolutionsx.com
esolvesi.com
essageply.com
etranfermobilerbadas.com
etranfermobileregozer.com
etransfer-interaconline-mobiledeposit879.com
etransfermobilityrefund.com
etransfertml.com
ewholefam.com
excelmanuals.com
exisauto.com
exisinthopes.com
existicpan.com
exitignloop.com
exitinopls.com
exitloops.com
exitngsings.com
exitomains.com
expisolution.com
extinful.com
faceboksigns.com
fash2v.com
feroiz.com
ferozpuraroad.com
feroztechn.com
ferxz.com
fidilitbonimoer.info
fido-canada-ref73639.com
fidodolarsppay.com
fidodollarslivecash.com
fidolivepay.com
filedocfex.com
filmdekhkeaye.com
financialadvisershub.com
findatroperz.com
fivvercredits.com
fleblesnames.com
flowisbest.com
forjustuplaoadd.com
fr-ca-9235.com
ftp.minukiptatera.com
fudsupport.com
gadiraphondi.com
gainmorethan.com
galaxyinvi.com
galibhiparh.com
galsecurs.com
galwaysi.com
gandabacha.com
ganduamira.com
gatajyemeran.com
geoinews.com
gesvaluesni.com
get-cryptostorm.com
getearns.com
gettradlight.com
getupandcboz.com
gharkafasana.com
gholaptrend.com
giftilicard.com
gigafasts.com
gigalinknetworks.com
gigalinkz.com
gistraproduct.com
gistugestio.com
global-entropy.com
global-query.com
gonagos.com
gonglupkay.info
gotabelomerz.com
grabupon.com
grapminrig.info
gualitynet.net
guardedcourierervices.com
gujjartele.com
gumsastele.info
h1p519atv.com
hadiqalokiope.info
hadiqokyav.com
hadseyes.com
hajikobulao.com
hallmania.com
hamzalinks.com
hanmenechaly.com
hargharbcha.com
hasclams.com
haseenpehlu.com
hashzyadahon.com
hasilorlahaslop.info
hasrtenbetab.info
hathbhinhimilaya.info
havetoback.com
hbarcclayss.com
healcra.com
hearinhavaco.com
heartofdiamondz.com
hedsquick.com
heismonefud.com
helodocus.com
helprofte.com
helptohelps.com
hemn-group.com
hibuhazard.com
hilomatyarasy.com
hipnotizedo.com
hipolos.com
hisramnobita.com
hmainconabo.com
hmaranwapho.info
hmzakinonuc.info
hndsecures.com
hojayegasab.com
holahathrakho.com
homeisproducts.com
homesidi.com
honeylofar.com
hope-good.com
hopeishope.com
hoplikes.com
hoslazulman.com
hosspices.com
hostlyk.com
host-menow.com
hostnim.com
housekep.info
hoyslenow.com
hsbc1-login-acc1.com
hsbcbenkz.com
hsbcprivateclientbankingonline.com
hsbcprivatefunds.com
hsbcredit1.com
hsbeecden.com
hsbseedot.com
hudokan.com
humnemana.info
hundabotbura.com
hundandadena.com
huwaytujuda.com
icesmitha.info
icloud-findme.info
icqonlinex.com
idharsaywahan.com
ihaitumer.info
ijachakalz.com
ikperdesidille.com
iktaramend.com
ilaechiwalichue.info
ilahisabka.com
ileshare-access.com
ileshare-securityaccess.com
imdeecol.com
inajokarthay.info
inasertibola.com
inerels.com
info1securessl.com
infobellsa.com
infoiservices.com
infordaynae.com
informations-support.com
informors.com
infosecure1sslo.com
inlowsse.info
inmomnazol.com
inquitity.com
inquritu.com
interac-etransfer-deposit-mobile879.com
interac-etransfer-mobile-deposit.com
interac-mobility.com
interaconline-etransfer-payment.com
interaconline-e-transfer-payment.com
interaconline-etransfer-telusmobility.com
interacs-access.com
interactbrand.com
interact-etransfert.com
international-card-services.com
internationtse.info
interponery.com
inthaeguzara.com
intwranstse.info
invalitrust.com
investec-bank.com
ishantgomal.com
ishqw.com
isqkibarish.info
istingcustom.com
isupport-technique.com
itnakuchyad.com
itumerihar.info
iweter3.com
ixups.com
izharkarna.com
jabkaygalatha.com
jaduterimzar.info
jaibwichonki.info
jamnoshkaro.info
janchurwa.com
janusinger.com
jariyanphrend.com
jasaykotesa.com
jaydadan.info
jeechotajana.com
jeenasikhaya.com
jehlamrover.com
jenailagayco.com
jeols.com
jidudilagi.com
jihidden.com
jimanicooz.com
jioniainbol.com
jiskajobhimal.com
jlebionwalasa.com
jobhishomw.com
joystickpo.com
jumangiback.com
jusaykangroz.com
kabhitoanaydo.com
kadorattmhari.com
kafiarsahuwa.com
kahanhogaja.com
kahanjyedil.com
kahchukayjo.com
kaisadijaray.com
kajlaraykaj.com
kalakurta.info
kaleencoridor.com
kalichran.com
kalimatarepor.com
kalkacomsatun.info
kalvmarchlac.com
kamnaikarda.info
kamralamba.com
kamwaliteszio.info
kancharust.com
kangnapawan.com
kanjaconma.com
kashifpackages.com
katepeterso.com
kerinoohchaedi.com
khabardarozma.com
khailoparnot.com
khairsanwala.com
khalikardain.com
khanbahadur.com
khulabilochra.com
khusbrats.com
khushboterin.info
khzanabox.com
kihalchalwa.info
kikrijanaopae.com
kilookpongaz.com
kinarakashi.info
kinarakashib.com
kinarakashido.com
kinasonarab.com
kinayjanabae.com
kindeljeep.com
kingsmentire.com
kinshaprera.com
kisikabhidy.com
kislihazsay.com
kitaynadarok.com
kitnasedhasa.com
kitnaydoorthay.info
klejabahraya.com
knetflixc.com
koehalnihaja.info
koformat.com
kotagekrican.com
koyetagladiater.info
krantiayegi.info
krantikobra.com
krishnacotlak.com
krishnacottag.com
krisnatoken.com
krizmaalover.com
krmowaretedc.com
kurikandijuti.com
kurimukargai.com
kurkurayoop.com
kurvars.com
kvmkvms.com
kwilliamz.com
kyatredypop.com
lakhakaidea.com
lakhpatibabo.com
lambogiboma.info
lathapyahosi.info
lathapyathya.info
lawfiirm.com
laykaruthunga.com
lbventure.co
lbventure.xyz
lcloudsecurity-lcloud.com
ledaysonya.com
legionhostes.com
lemorestorez.com
lenadensi.com
letmedothatz.com
letmesolvy.com
le-trasfer.com
lifetereyard.com
likedatbimp.com
limberconmerz.com
limcaopener.com
limecamelzre.com
linkineds.com
locatsigns.com
lockdevelop.com
locked-verify.com
lockwebs.com
logipanelsecu.com
loiesfnons.info
lokiorminthol.com
longtermzjerf.com
lookijump.com
lookpanels.com
lostofvlue.com
loyaltyindna.com
lsmeets.com
ls-pdf.com
lsrepu.com
lsuggestion.com
luckipanel.com
lwazmaatkesay.com
maapkainterv.com
maclearacuri.com
maedekolam.com
mahindrazoo.com
mahnors.com
mail.lbventure.xyz
mailbox201708.com
mailinfoe.com
mainkhlsep.info
mainybtayatha.com
maklawaayaha.com
maklawatola.com
managoseason.com
manicakolam.info
maphasyaajsae.com
maqsoid.com
marathikaraja.com
marceyonme.com
marchukaykd.com
marketer2017.com
maskvoter.com
maslayhotay.com
matchisues.com
maxprogs.com
maybank2online.com
medawindow.com
mehnatlarko.info
mehrunnisama.com
meradeejayla.com
merakyakaam.com
merakyakasor.com
merishradhcov.com
merizindagis.com
microsoftox365online.com
mightytex12.com
mightytex23.com
milaysedil.com
milletsupplysco.com
mincertinker.com
mindeze.info
minukiptatera.com
minutaytinu.com
missselfs.com
mmadaygo.com
mobile-clientservices.com
mobile-gouv.com
mobile-secureupdate.com
mobilityrefundbyetransfer.com
mobilityrefundetransferr.com
mobilityrefundetransferrm.com
mobilityrefundetransferrz.com
molbipolazm.com
monesyses.info
moqamoqas.com
moqapanelz.com
morzindgikay.com
motupalo.com
mrestse.info
mrlogisticse.com
msftservers.com
musheerkhas.com
musicoffmode.com
myaccountsecurity1.com
myclient1secure.com
myclient2.com
myclientsecure1.com
myhsbconlines.com
myvibomaniom.info
mzerstee.com
naimmataka.com
najaizsanband.com
nakoidarmyan.info
nameinfida.com
narmsabistar.com
navayansonya.com
navyfederalnewban.com
navyverifycation.com
nawesajanbna.com
nbdwayscloude.com
ndagihaitumer.info
neilbuild.com
neonsigin.com
netflexnew.com
newprotiles.com
newsafar.com
newsmocha.com
ngixnameserver.com
niesubjects.com
nigahaintaer.com
nikalyahasay.com
nikasaprobz.com
nilopamazop.com
nimlocos.com
ninahosts.com
nismjhtypagb.com
nityfederal.com
njrenewsi.com
noblesupports.com
nohidepors.com
nomeciforiou.com
nomiase.com
nomitits.com
nonehues.com
noneisuee.info
noneseudds.com
nooresaba.com
nopsis-serve.com
nosuperse.com
notifefocus.com
notiflax.com
notihiilo.com
nounemarocsealsales.com
nowexploies.com
nowlars.com
ns1.guideprods.com
ns1.ponamkiraat.com
ns2.area8475.pw
ns2.guideprods.com
ns2.ponamkiraat.com
nullserviy.com
nwboswali.com
offerid42426035.com
offerupmine.com
office3650-docsfilesharing.com
officejayakr.com
officelapls.com
officesupportapp.com
oinopoperz.com
okolaszinda.com
oldcustumz.com
omeriwajhasy.com
omlaorlasoray.com
onanukahota.com
onebreakmove.com
onedrivedomainsecurelogin.com
onedrivefileshare.com
onedrivefile-share.com
onedriveinc.info
one-driveinc.info
onedriveloginsecure.com
onedriveportal.com
onedriverv.com
onedrlveofflce.info
ongertelles.com
onlinecase321.com
online-check-id20012-apple.com
online-hsbcgoodwill.com
onlinelloydscredit.com
onlinemobileetransfercaf4gd7k.com
onlinemobilerefundbank.com
onlinemobility1.com
online-reactivation.org
onlines-access.com
online-servcenter.com
onlineservicessupport.com
online-signinvalidation.com
online-support-id0283423.com
online-support-idus90012-apple.com
online-support-idus900133-apple.com
onlinesypoi.com
opaeplastakc.info
opeecentrel.com
operatrezher.com
opooworld.com
orangesinfo.com
ordarls.com
ordarshope.com
orderthem.com
organixation.com
orpaonthay.com
ortokoecharabhi.info
osmkhanatha.info
otghumabola.info
otumerihar.info
oyeteranam.com
packiserver.com
palkainjhuki.com
panchhogye.com
pandaybaaz.com
pankhaniche.info
pankhaychalo.info
pastols.com
payment-booking-id.com
payment-intl.com
pdf-guard.com
pdfsauce.com
perlogsudhar.info
personalsupdates.com
pesamachine.info
phadlorecord.info
phirodhondtaa.com
pholsotkhaty.com
picasuminion.com
piddusyapa.com
pikachobana.com
pindoratests.com
pindropiz.com
pinsisures.com
plosecure.com
pluseoneserver.info
poilovers.com
polkacrezma.com
poltergiestz.com
polyonkalor.com
ponamkiraat.com
positiverootz.com
poxibiglez.com
premaconbaro.info
premiumrootz.com
pricewayi.com
primaxx.tk
priproneeded.com
privacy12.com
proddise.com
promteez.ga
propage12.com
prothidetion.com
pushusrexo.com
qabopertoz.com
qlandrkitean.info
quickbook-intuit.com
quickeinterac.com
rabakasicza.com
radiascosterz.com
radikarorzim.com
rakhpocket.com
ranglayadil.com
rashidmrayga.com
ratanlambyn.com
rebaonrli.com
receivesalies.com
reconnectsi.com
recoveproducts.com
redeoncloude.info
redirectisp.com
redirectjsp.com
ref11869.com
regrastamaz.com
regulaconovo.com
reidentifylogon.com
reminderteel.com
remitciti.com
remotrdcloude.info
replacingme.com
resortzmimba.com
retfopionex.com
rewals.com
ridertermzare.com
rishtaoplaman.com
rizlaphokayga.com
rizvialabyan.com
robanidarudar.com
robhrotport.com
rogers-acc1-login.com
rogerssetup.com
ronachahonto.info
rotikhalomini.info
rotipaygaiae.com
rowseproducts.com
rozphnekrna.com
rscotech.com
rushitums.com
rustampalwan.com
sabkikhairho.com
sadetinsoo.info
sahibokashma.com
sajantumsay.com
samartileryz.com
samokasangha.com
sandlinaina.com
sangyag.com
saninops.com
saphoness.com
sardariwala.info
sarikalnobay.info
sariraatjgaye.com
sariratbighne.info
saygeebusiness.com
sbcsr-us.com
scemehous.com
schohead.com
scoiservice.com
scoti1bnk-acclogin.com
secafters.com
secubmo.com
secure-active.ml
securebm21.com
secure-documents-uploads.com
secured-onlinex.com
secured-sec1chase.com
secureinfopage.com
secure-interca-seclink.com
securemyrbc.com
secure-onlinesignin.com
securesslinfo.com
secure-tangerine-enligne1.com
securetrans-interca5x7b3-en-seclink.com
secureyoues.com
securitiy-alerts.net
security-ac1c-log.com
security-acc-signin.com
secursonline.com
sedhisabacha.com
sendpicd.com
sertaaryou.com
serverstechna.com
serviceasi.com
setuoee.info
setupeat.com
setuprogers.com
severdatalinkin.com
shabnamkitarah.info
shaggygroup.com
shailatech.com
shakalakavoo.com
shakemilaha.com
shalldeprotine.com
shantipriyaz.com
sharacorepoz.com
sharamnhiati.info
sharedcont.com
sharmelabegum.info
sharmilamera.com
sharmproducts.com
shazilobiakyu.info
shdeerteslop.com
shedaksaeho.com
sheelakonabta.com
sherloperzinda.com
sheronmazy.com
shimlkapark.com
shimltaghtiran.com
shosuggest.com
showshowto.com
shuglalaomani.info
signsbaba.com
signspanel.com
simsombaz.com
sisfodacomana.info
sitehomeapsx.com
sixstringsw.com
slamzcoffins.com
smithsofts.com
smjhmainaya.com
smtpian.com
snbprivate.com
snthostis.com
sofazindabad.com
sohaibphansgya.com
sojabadi.com
sojaephruthk.com
soli892.com
solominesi.com
solovon.com
solubuzi.com
solusif.com
somethbrand.com
soniabchajo.com
soolitaytangya.com
spectrocoinss.com
ssdneting.com
sslbankingsecure.com
sslcertificats.com
sslinfosecured.com
standardbank-offshore.com
statsupfeeds.com
stopharras.com
storefrontzy.com
successfullyplans.com
successfulwebsx.com
sugarishell.com
sugestclient.com
suggesshop.com
suggessings.com
suggestsupdes.com
suggestupdtes.com
sugiturgent.com
sugneshost.com
sug-servers.com
sugs-server.com
sugtechupd.com
sultanbadcha.com
sunblust.com
sunrisepetorleum.com
suntrustfixa.com
superhinds.com
suporttechniques.com
supports-techniques.com
support-techniique.com
supporttechniqueaccounts.com
support-technique-canada.com
surioo.com
suspencekhan.com
suugestbuz.com
swalonkjwab.com
swissentrance.com
systemmyacount.com
tafredomanio.com
tagimertigoz.info
taintedrootz.com
takderkushae.com
talismjinder.com
tanuklaverop.com
taxtubein.info
teamsupporttechnique.com
team-technicail.com
teamtechnicals.com
technicalasupport.com
technical-teams.com
techniical-suppiort.com
tehrmtech.com
ter3rgcq.com
teramashup.com
terameranata.com
teraordars.com
teressanilam.com
teriferdonalo.com
terimerikahanii.com
teripalken.info
teritobegum.com
termiatorss.com
tertoizertvo.com
textflav.com
tgousanstse.info
thakkaybae.com
theghostwolf.com
thelengendd.com
thindachaha.info
thorasakhee.com
thugthief.com
tikkie-pay.com
timeisgoing.com
timenhihe.info
timestampsi.com
timhopes.info
tinkytanko.com
tinydocu.com
tiredofimpaiti.com
titokimaa.info
tmharakool.com
tmverifyonline.com
todocoleccions.com
tohaknhiwowa.com
tokhaybewja.com
toltahoes.info
tombraiderxz.com
tongacodex.com
topfob.com
toplpgroup.com
totalunpress.com
totalupdtech.com
trackfooz.com
tradeinfotechna.com
tradesminds.com
trafrproducts.com
tragiops.com
trandolz.tk
transcozomb.com
transfoffer.com
transprivpro.com
trasugestions.com
travelmarka.com
trboozlinkan.com
tredmilozona.com
trestaropriy.com
trivboonerz.com
trollkazima.com
trustbuildss.com
trustworthz.com
tuhibtadaymol.com
tujomeranam.com
tukounnai.com
tumeraheloch.com
tumerizerihar.info
tumharitarf.info
tumnatum.com
tunebaznaiana.com
turnachakwali.com
tusubkuchpawa.com
uberfath.com
ubersayjatatgo.info
ugestinfoes.com
uiicodes.com
uioplo.com
ujrachmanha.com
ulokapatha.info
uminerponam.com
ummerihar.info
umnalalobae.com
unemydemoz.com
unleashlimits.com
updaiting.com
updaitings.com
updateaccounts-verifications.com
updateacct.com
updatefilesin.com
updtechsnow.com
up-to-date-reri.com
uptoworkonline.com
uraibarusting.com
urlextrcts.com
urmilapooz.com
urmilaterisaki.com
user-access.org
usgranttreasury.com
usiunlited.com
usmainhunoperaz.com
ustadnutang.com
ustadpakragia.com
v2secure.com
v53i.com
vahelsign.com
vahkeioanku.com
valueofsuggestion.com
veilig-bankieren.com
velibathisan.info
verification-canada.com
verification-gouv.com
verification-secu.com
verifyamzn.com
vibusniess.com
viewdreamis.com
visehandlinf.com
vivahsajnaka.com
vividerenaz.com
vkpardanday.com
vootgen.com
vutml.com
vvebconnect.com
waatve.com
wachniyan.info
wadaraha.info
wadrekabeta.com
wahshiraees.com
waitisgood.com
wakhraswaig.info
wavesfateh.com
wavestomer.com
webadmin-mail-update.com
web-aolmail.com
webapp-mpp2.com
webmaster-service-update.com
webmobile-services.com
web-mobileservices.com
webshomes.com
welcomebrothe.com
well-quicktrans.com
wellsfargosecurelogin.com
welsfargodirectlink.com
wesolutionis.com
whitesecuredatas.com
whitespageis.com
wholefamoies.com
wickesunye.com
widgertropers.com
wiis3.com
wikjandaygwah.com
wincheaps.com
wishohadadi.com
wordspoo.com
worldcoueriservices.com
worldcourieriservice.com
worldcourieriservices.com
worldcouriersservice.com
worlddiplomaticcourier.com
worldpost-courier.com
worldwideexpresscargo.com
wrapitwellz.com
ww-etsy.com
www.armoremsid.info
www.chaskaylartiker.info
www.chichongshpang.info
www.cofepelayray.com
www.koyetagladiater.info
www.lambogiboma.info
www.myvibomaniom.info
www.onedriveinc.info
www.tagimertigoz.info
www-clhase.com
www-squareup.com
xelamar.com
xerolimited.com
yanderoosa.com
yarkoota.com
yarmangyasi.info
ychbmr7sk.com
yelodomain.com
yeropvinalert.com
yertomilano.com
yeubiope.com
yogartmoniak.info
youthwinger.com
yumlsi.com
zafarbularha.com
zamanjalis.com
zartashakona.com
zarurtsyza.com
zenderjalakota.info
zengolese.com
zindagikayala.com
zkatokamnoba.com

This article is a work in progress, some back in a day or so please. (Note to author: This is also at the top of the page!).

This entry was posted in Uncategorized. Bookmark the permalink.

2 Responses to Spear Phishing against Painter Decorators

  1. Adam says:

    Hey there, I work in an architecture office and got a similar email from one of our consultants (geotechnical engineer) posing as an invoice. The phishing website used on our document was “trustworthz.com” and your blog here seems to be the only location on the internet that has documented it as a malicious site. So thank you for your diligent digging on this!

  2. Daronwolff says:

    Awesome thanks.
    Recently I received phishing like this.
    I was able to download part of the source code used for the Fake Landing page

    I found more info in this tweet

Comment on this topic

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s