CryptoINT_Researcher

1/3 🚨 Newly registered phishing domain impersonating @binance Vault: 🌐 Domain: liveness-binance[.]com 📅 Registered: 12 October The site serves a single-page application built to harvest credentials and siphon crypto assets. Technical breakdown 👇 @BinanceHelpDesk

🚨 Phishing & Web3 Alert: EIP-2612 USDT Drainer on Arbitrum One usdtverify[.]online Phishing lure masquerading as an official "USDT Verification" page. The campaign leverages off-chain EIP-712 Permit signatures to steal funds gas-free without an upfront on-chain approve() alert

1/7 🧵 Fake @Ledger Proposal Drops ScreenConnect via DocuSign Decoy A Web3 phish on ledgerproporsal[.]com lures targets with a fake proposal. Runs a real DocuSign installer as a decoy while silently installing weaponized ScreenConnect RMM backdoor. 👇 @Ledger_Support

🚨 SCAM ALERT: XRPL wallet drainer targeting @XamanWallet • Domain: ledger-allocation[.]app • Lure: Spoofed "Xaman Airdrop / XRPL Allocation" • Vector: Malicious Web3 modal targeting Xaman, WalletConnect, Ledger, Crossmark Triggers malicious signing payloads to drain assets

The scam flow: Prompts hardware selection (Nano, Flex, Stax) Simulates a failed connection Triggers "Use alternative method" Prompts manual entry of 12, 18, or 24-word recovery phrases

🚨 SCAM ALERT: Campaign impersonating @Ledger_Support with a fake "2026 Exploit" advisory claiming $150M in losses. • exploits2026-ledger[.]app Lure: Claims older @Ledger devices have weak-entropy seeds via a fake MicroPython/Yasmarang bug to push a "risk scan."

🚨 SCAM ALERT: XRPL rewards/loyalty campaign pushing wallet drainers: • badge-xrp[.]com • xrp-badge[.]com • xrp-loyalty[.]com -> loyalty-xrpl[.]com • xrpl[.]im • xrpl-dex[.]com • xrp-scans[.]com "Connect Wallet" prompts malicious signing requests to drain funds.

🚨 SCAM ALERT: Fake RLUSD reward sites targeting XRPL users with wallet drainers: • crossmarklabs[.]com (impersonating @crossmarkio) • honeyclusterx[.]com (impersonating @HoneyclusterX) "Claim Allocation" prompts a malicious wallet connect modal to drain funds.

Related domain: profilehub-coinbase[.]com Backend Portuguese C2 panel ("Painel de cartões"): • Endpoints: POST /c collector & /health route • Artifacts: Parsers for Brazillian cards (Elo, Hipercard, Aura) • Actor: Likely Brazilian cybercrime group adapting carding tools

🚨 Phishing Alert: @CoinbaseSupport Lure New gated phishing campaign targeting @coinbase users: • userhub-coinbase[.]com • Lure: Fake support ticket / 6-digit "Case ID" via SMS/email • Kit: Next.js RSC with fingerprinting & bot gating #ThreatIntel #Phishing #Coinbase