I blogged about this earlier this year - I think they reached out to me as part of my crate work and tried to get me to download a booby-trapped repo with a remote shell.

Insidious attack, it felt very real, they had a compelling fake network of sites and companies

▲

deltoidmaximus a day ago | parent | next [-]

There was a DND episode about fake online schools run from overseas springing up to soak up US college grant money that was being given out. The schools were built well enough to fool some one not that interested into thinking they were a real (but probably kind of crappy) school and had actual online classrooms with minimal assignments. Every time the government got wise to one they'd just shut it down and spin up a new school with new materials to stay ahead.

IIRC this before AI so I expect this kind of thing to accelerate since it should be a lot easier to spin up a whole fake narrative for some one to investigate. And since so many real companies are now using AI generated websites with AI generated images or even conducting early interviews with AI recruiter avatars recognizing AI generated sites won't even be an actual tell.

The age of per person bespoke scams for increasingly small potential payoffs is upon us.

▲

bebopfunk a day ago | parent | prev [-]

Do you have a link? I’d be curious to read it

▲

jsploit a day ago | parent [-]

https://grack.com/blog/2026/06/25/dissecting-a-failed-nation...

	▲	walrus01 a day ago \| parent [-]
		I think the lack of actual building suite/street address in the email signature in the very first email would have immediately made me extremely suspicious. That's about as good as "Totally real business address, trust me bro, Singapore". Also some kind of company main phone number in an email sig is a thing I'm expecting, even if it almost certainly goes to an IVR system, or the email sig doesn't have an extension number in it. But if a person is reaching out to me with a hand crafted email I'm also going to consider them a bit more suspiciously if there's no phone contact in the email sig. Further, .xyz or similar as a company domain name is pretty damn suspicious when, for example, luaventures.net isn't taken as a domain name. 99% of the time when I see .xyz it's spam/scam/phishing disposable domains. ---------------- edit: looks like the website still exists: https://www.luaventures.xyz/ (open in sandbox, do not download anything, caution, etc!) Googling luaventures.xyz turns up all sorts of weird things. The C2 IP mentioned in the writeup appears to be a /24 of some small hosting company in the UAE. inetnum: 89.124.107.0 - 89.124.107.255 netname: VDSINA country: NL geofeed: https://vdsina.com/geofeed_as216071.csv geoloc: 52.309711 4.935438 admin-c: SK15998-RIPE tech-c: SK15998-RIPE status: ASSIGNED PA mnt-by: servers-tech-mnt created: 2025-11-12T07:06:42Z last-modified: 2025-11-12T07:06:42Z source: RIPE role: SERVERS TECH FZCO address: UNITED ARAB EMIRATES address: Dubai address: 336469 address: Ifza Business Park DDP, Building 1, office number 36298-001 nic-hdl: SK15998-RIPE mnt-by: lir-ae-servers-tech-1-MNT created: 2023-10-25T09:55:18Z last-modified: 2024-07-10T12:05:37Z source: RIPE # Filtered % Information related to '89.124.107.0/24AS216071' route: 89.124.107.0/24 origin: AS216071 mnt-by: servers-tech-mnt created: 2025-11-12T07:08:49Z last-modified: 2025-11-12T07:08:49Z source: RIPE