Ian Campbell on Nostr: Another I've started watching, given how many related scams and compromises have ...
Another I've started watching, given how many related scams and compromises have popped up, is domains with "onboarding" in them.
net-onboarding-login[.]com looks shady enough on its own, but then pDNS picks up its subdomain: bjtstamp[,]net-onboarding-login[.]com
which is a typosquat impersonation of cryptocurrency exchange bitstamp[.]net
Published at
2025-01-13 15:28:33Event JSON
{
"id": "350f5e3015df6fcbb9bed561eed0a7f92486631c25cbec57028adcd7d5eae4df",
"pubkey": "a516f2358a20a90c560bed25b34fb39ee5bd12a7187837df8c96a19e0070ce6d",
"created_at": 1736782113,
"kind": 1,
"tags": [
[
"e",
"e482a845f404a6f30d2ef58c0cf240fec8ef37075834003209256e4ec7ae2727",
"wss://relay.mostr.pub",
"reply"
],
[
"proxy",
"https://masto.deoan.org/users/neurovagrant/statuses/113821752559042280",
"activitypub"
]
],
"content": "Another I've started watching, given how many related scams and compromises have popped up, is domains with \"onboarding\" in them.\n\nnet-onboarding-login[.]com looks shady enough on its own, but then pDNS picks up its subdomain: bjtstamp[,]net-onboarding-login[.]com\n\nwhich is a typosquat impersonation of cryptocurrency exchange bitstamp[.]net",
"sig": "eb853998b85a345d970c63f9c06b55f6cec3a1aa6e95c2c1459bbce8e58fc64c61b7fc75beceef7986149901a08a7e460f4b674da3eb03eca67a0065688733e6"
}
