You are viewing a single comment's thread from:
RE: That Phishing Link in Your Comments Is Newer Than You Think
Los dominios clon tipo steewit.com o steemil.com siguen siendo el patrón más efectivo porque el usuario lee la URL después de haber hecho clic, no antes. Lo de Inferno Drainer con más de 16.000 dominios confirma que el negocio no es el phishing en sí sino la rotación de infraestructura barata. ¿Tenés data de si en Steem hay algún registro público de cuántos de esos dominios siguen activos hoy?
Good question. As far as I know there isn't a public, up-to-date registry just for Steem. The most serious attempt was PlentyOfPhish by @guiltyparties, a manually maintained list on GitHub (gryter/plentyofphish), but lists like that go stale fast, exactly because of the rotation you mentioned.
I ran a quick DNS check on the three clones from the post:
That's why modern feeds don't store just the domain, but also first_seen, last_seen and the pivots (registrant, NS, MX). If steemlt.com shows up tomorrow using the same nameservers as a known clone, it gets flagged even before anyone reports it.
If you want to dig into real data, the WhoisFreaks Threat Intelligence Feed has a free sample you can download without an account. It covers phishing, malware and spam domains, with confidence scores and first/last seen dates for each one (whoisfreaks.com/products/threat-intelligence-feed). The feed docs explain the full record schema (whoisfreaks.com/documentation/threat-intelligence-feed). There's also a Newly Registered Domains feed, which is handy for catching new lookalikes like steem*.com the day they're registered.
Fully agree on reading the URL after the click. That's why a bookmark or typing the address yourself is still the best defense for regular users.