Walmartmoneycard bank phishing scams

Phishing Campaign
1

been following these guys for a while.
all the websites are hosted on nicenic.net
and they seem to known for allowing phishing contents.
you can submit abuse report countless times but domain will always stay up.
will appreciate if someone could look into this.

here are the details.

adcopy:

newad-fake
newad-fake419×422 48.1 KB

name and origin country on ad:

name-location
name-location356×669 58.7 KB

landing page with fake form (they mimic the same form used by walmart to trick users):

form
form351×680 54.8 KB

Domain is currently live.
US proxy.
Mobile device.

Just search register walmartmoneycard and the ad will show up.

1 Like
2

domain has been live from last 2 months.
i have contacted icann and they have failed to take any actions.
I have reported the domain to every av i could and the domain is still.

Whats really funny is I even reported the domain to walmart on X and they never took any actions.
So im out of all options and leaving this here.

Pitch in if you can do something about it.

I can list every domain these guys have used in the past.
most of those domains are suspended now but not anymore.
nicenic does not take any actions.
I have talked to people on telegram and forums and nicenic is used to host drainers, rats, botnets, malwares of all type.

1 Like
3

Hi Minger

Would you have by any chances copied the tracking URL of the sponsored ad on google? If you have please do Drop it as a reply.

1 Like
4

https://www.google.com/aclk?sa=l&ai=DChsSEwjX25vgpZOKAxXkKkQIHRWNLy4YACICCAQQABoCZHo&co=1&ase=2&gclid=EAIaIQobChMI19ub4KWTigMV5CpECB0VjS8uEAMYASAAEgLoR_D_BwE&sig=AOD64_10GYK7zJqQ5MhgdoBR2G6QwDY0Xw&q&nis=4&adurl&ved=2ahUKEwjLpJfgpZOKAxXXHEQIHR4jJQM4ChDRDHoECDAQAQ

ad is currently live.

1 Like
5

That’s great find @minger ! Is that the same bad actor group targeting Walmart only? Or they are also going after similar retail brands?

Curious to know how you found them?

@zero @vikasjha @nyuuzyou @CyberKnight15 check this out!

6

just walmart.
walmart seems to ignore most of the abuse reports probably thats why.

I was contacted by someone on another forum, they saw my previous thread about greendot bank.

And registrar is pretty solid who ignores dmca and has a reputation among scammers for best offshore hosting.