Democratizing Threat Intelligence
Joined August 2025
- Tweets136
- Following0
- Followers107
- Likes106
Webamon retweeted
A Webamon Content search added 9,275 additional domains scanned since 1st October, including 7.442 named-brand domains with no “toto” in the name.
Domain strings provide the seed. Page content expands.
The @webamon_search query:
intel.webamon.com/search?luc…
🚨 Indonesian Gambling Domain Cluster 🚨
Identified 6,303 domains registered since October 1, 2026, many hosting Indonesian language Toto/Togel, slot, and betting related websites or redirecting to gambling sites.
URL:
99totoapp[.]com
agustoto[.]vip
Top registrars:
- Namecheap: 3,025
- Dominet: 1,297
- GoDaddy: 499
- Dynadot: 367
- Spaceship: 180
Some websites also promote APK downloads, raising additional security concerns.
Full domain list and IOCs will be shared on GitHub. (link is in comment)
#ThreatIntelligence #OSINT #Gambling #Indonesia @500mk500 @skocherhan @ex_raritas @AaronCTI @0x534c @rushibmehta @KirkDerpca @douglasmun
Webamon retweeted
87 sites. Random domains. iPhone and Nespresso phishing offers leading into subscription traps.
This is exactly why we built @webamon_search to find what a page contains, not just what its domain is called.
Brand impersonation and abuse rarely arrive with a helpful label.
intel.webamon.com/search?luc…
Webamon retweeted
Fake trading and VPN apps were changing their install commands depending on the visitor's operating system.
That is the bit I find interesting. @webamon_search can find the behaviour beneath the branding, even when the next site appears on a random domain with a different brand.
intel.webamon.com/search?luc…
#ThreatIntel #ThreatHunting
Webamon retweeted
Webamon found 23 domains this week using fake “Just a moment…” ClickFix-style pages to push clipboard-code instructions.
The domains are disposable, but the page behaviour is an ongoing problem. Finding it across random corners of the web is exactly the problem @webamon_search is built to solve.
intel.webamon.com/search?luc…
Webamon retweeted
@_CPResearch_ supplied the September seed:
blog.checkpoint.com/security…
@webamon_search found the earlier July captures with this console query:
page_title:"Boost your Mac using the terminal"
intel.webamon.com/search?luc…
Happy Hunting!
6 domains. One kit. A live operator on the other end.
Today’s Webamon daily hunt: Coinbase “Verify Identity” pages on numbered lookalike domains that hold the victim on a fake support chat while an operator pushes screens to them in real time. The kit’s backend asks for seed phrases and passwords and can hand the victim a fresh “vault” seed. 6 domains share a single fingerprint since May, 5 still live today, none flagged malicious.
Standing query for anyone on Webamon:
fingerprint.links:d8e4bcf3e3f8ac1b87df0f67c1d2358f9e7405bc5e36c2aa47f47ac341214eda
#threatintel #phishing #crypto
Webamon retweeted
Added to a WhatsApp group without asking. Received Evri-themed phishing.
Two @webamon_search pivots: matching favicon and page_title:evri.
Useful leads, and a sign of ongoing impersonation and brand abuse of Evri.
intel.webamon.com/report/f03…
Webamon retweeted
Two possible findings from @webamon_search that may be related: hydra3[.]xyz/login (captured 6 October) and cracksword[.]com/login (9 October).
Each displayed a different product name, but retained the same description and console-title suffix found in the source.
intel.webamon.com
