Investigation: Active "steemit.network" Phishing Campaign Targetting Steem Users.

So, earlier today, I was alerted to an active phishing campaign targeting Steemit users by the wonderful @mars9 in this post. I might be currently on my holidays, but people like me who work in computer security never really take a fucking break.

Now, in their post, they redacted some details. I don't do redaction. So I decided, despite it being my holiday, to do some quick and dirty investigation of this phishing campaign. Outlined below is what happened. This post will be screenshot heavy, as it is kind of a visual walkthrough of how I did a quick investigation of this whole thing.

The "Deceptive Comment"

So, from mars9's posting, I quickly located the deceptive comment in question, which I have added a screenshot of below. As you can see, it contains a bit.ly link, which is our first point of investigation.

Analytics Pages are Useful.

So, a bit.ly link. There is a neat trick where we can check its analytics by appending a "+" to the end of the URL, so we do that... At this time, the link has had 40 "clicks".

Following the Phish...

Our next trick, is using the command line utility "curl" to request the bit.ly link and see where it is taking us. For now, I don't want to hit the phishing URL in a browser at all.

Further Down the Rabbit Hole...

So, we are being redirected to something called "steemit.network". This seems like a good lead, lets follow this trail onward... By opening it in the Tor Browser for safety. I did not want to open this in a browser with any active login sessions as a precaution!

So, we see it is a... Open directory with one link, to an "indexxxxx.php" script. Lets click it!

The Phishing Page

I really, really regret not grabbing the HTML source of the page while I had the chance. You will see why this is not possible in a few minutes ;)

The page is pretty clever - it mimics the Steemit interface pretty well, and people are used to having to login again when their session times out. Quite evil, really!

The DNS Story

So I decided the logical next step would be to use the PassiveTotal service to dig up Whois data and other DNS data on this threat actor. The following screenshots tell that story.

And here we have OSINT data of "places this link/site was posted to"... It seems our phishing person was quite active.

We also were able to determine that the phishing page was hosted on THC-Servers. So...

The Happy Ending

I quickly got in touch with the THC-Servers abuse team. They responded incredibly quickly and terminated the site and its user, eradicating the threat. A happy ending for all involved!

Lessons Learned

Fucking asshole criminals are targeting Steem users. Be vigilant, be wary, and if you see anything, feel free to drop me a line or tip me off and I will look into it. Also, THC-Servers are very good at responding to abuse complaints!