Caught several phishing campaigns yesterday and ended up staying up till 5am triaging and analyzing detections.
By the end of it, I’d sent 27 reports to hosting providers, registrars, Google, and the affected brands.
Some of what I found:
- An internet banking clone harvesting account numbers and passwords. I was the first to detect it and scan it publicly.
- Multiple “free data/win rewards” scams tied to the same brand, with one collecting victims’ banking details. One hid its page behind scrambled code, which I decoded and sent to the host after they initially couldn’t identify anything malicious.
-Two fake banking/investment sites, among others.
Most reports have been acknowledged, and two sites have already been suspended.
It was a nerve-wracking night, but seeing the reports turn into action made every minute worth it. : )
Update on this 👇
Since then it's caught and reported real phishing:
• a scam campaign imitating a Nigerian brand: taken down by the registry ~18h after my report
• a fake bank page that captured victims' faces: found and scanned before anyone else had, offline within 5h of reporting
• a bank sign-in clone: reported 3 days ago, still up. Waiting on the host
Detection is half the job. Getting pages down is the other half.
I'm genuinely excited about this one, and I can't wait to share what I've built in due time 🫶🏽