Catching a Rookie Mistake in a Facebook Phish
ID: 7025ed0d-63dd-59d3-85de-111555a4c63a
STIX ID: report--7025ed0d-63dd-59d3-85de-111555a4c63a
Feed Name: WatchGuard Secplicity Blog
Threat Score
WatchGuard DNSWatch analysts triaged a Facebook-themed phishing page hosted on s3.us-west-1.wasabisys.com that coerced victims with a verification banner and submitted credentials via POST to https://lsdd.host/mango.php. Source inspection and DNS queries revealed the attacker left an SPF record pointing to 94.242.61.15 (allegedly in Moscow), providing actionable indicators and attribution leads.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.