Research Center

Blood and Honor is a well-known right wing extremist (RWE) group that originated from the U.K. founded in 1987. They began spreading their messages through music that supported their political ideology.¹

WhoisXML API security researcher Dancho Danchev used various OSINT tools to help law enforcement agents track the group members’ digital footprints. His investigation revealed:

Anything sold on the market, especially necessities, are fair game to phishers as campaign hooks. And that’s just what we saw happening with an ongoing phishing campaign targeting German car dealership companies.¹

Online shoppers have always been prone to cybercrime, such as financial scams, hacking, and credential theft. Domains and subdomains are common vehicles for these criminal activities, but more compelling are those that imitate major e-commerce sites.

Cobalt Mirage, a well-known APT group, recently took a page out of cybercriminals’ modus operandi—using ransomware—to go after targets earlier this month.¹ So far, only 11 domains and two IP addresses have been publicized as indicators of compromise (IoCs).²

Meta’s infringement and cybersquatting case against Namecheap was dismissed¹ last 25 April 2022 following a settlement². While the details of the settlement were private, the registrar ended up transferring 61 domains to Meta. 

In line with this, WhoisXML API researchers decided to monitor the cybersquatting activity related to three Meta applications covered in the dismissed case—Facebook, Instagram, and WhatsApp. Our findings include:

Phishing-as-a-service (PaaS) solutions like the recently discovered Frappo,¹ make brand impersonation campaigns easy to instigate and automate. Among those targeted by the new toolkit were large companies in the financial, e-commerce, and entertainment sectors, namely, Amazon, ATB Financial, Bank of Montreal (BMO), Bank of America (BOA), Chase, CIBC, Citibank, Citizens Bank, Costco, Desjardins, M&T Bank, Netflix, Royal Bank of Canada (RBC), Rogers, Scotia Bank, Tangerine Bank, TD Canada Trust, Uber, and Wells Fargo.

It’s no longer unusual for cybercriminals to go after cryptocurrency owners. We’ve seen scams targeting Bitcoin¹ and Ethereum² owners before. This time, they’re going after Cardano coin owners³ with a supposed giveaway promo.

In addition to cryptocurrency wallets and non-fungible token (NFT) companies, malicious actors recently targeted decentralized financial (DeFi) platforms. They got away with US$90 million.¹ One way some NFT companies may be addressing the threat is by defensive domain registration.²