@AaronCTI

Co-Founder @webamon_search, Founder @PIntelligenceUK, Training @kasescenarios, #MontyTheCyberCorgi. Webinars/Exec @OSINT_Community, Creator of the OSINT Portal

 United Kingdom
linktr.ee/aaroncti
Joined September 2016
  • Tweets2.2K
  • Following1.2K
  • Followers2.3K
454Media
Now that my book #CyberThreatIntelligence is out, if you're so inclined here's an Amazon affiliate link for purchase: amazon.com/gp/product/B09C7V… - Any and all reviews gratefully received!
4
3
2
29
Trying to cancel your antivirus subscription? This Avast-branded page led to a form asking for card number, expiry, CVV and address. The screenshot shows the cancellation page; the card fields are in its stored form. intel.webamon.com/search?luc… 1/6
1
1
76
more replies
Want to see how Webamon could look at brand abuse, impersonation and malicious campaigns for you? Check us out at intel.webamon.com

Webamon

Campaign Tracking & Threat Intel Search Platform

intel.webamon.com
1
18
May be useful to @G9Agent @JimBrowning11 @Kitboga @ScammerPayback @trilogymediainc and friends
1
18
Aaron Roberts retweeted
Webamon
@webamon_search10h
Happy Hunting
1
26
I’m usually more interested in what sits underneath a page than the name stuck on the front of it. This AI trading template appeared across 612 domains in five days. _pf_hp and /core/submit.php kept showing up as the names and languages changed. Want to threat hunt it? intel.webamon.com/search?luc…
2
7
325
Webamon found 23 domains this week using fake “Just a moment…” ClickFix-style pages to push clipboard-code instructions. The domains are disposable, but the page behaviour is an ongoing problem. Finding it across random corners of the web is exactly the problem @webamon_search is built to solve. intel.webamon.com/search?luc…
1
4
156
Aaron Roberts retweeted
Calgie
@christiancalgieOct 24
Online safety update: you can’t find out about the Jackdaw decision if you’re under the age of 18
49
238
35
1,598
67,388
Aaron Roberts retweeted
Aaron Roberts
@AaronCTIOct 24
Fake trading and VPN apps were changing their install commands depending on the visitor's operating system. That is the bit I find interesting. @webamon_search can find the behaviour beneath the branding, even when the next site appears on a random domain with a different brand. intel.webamon.com/search?luc… #ThreatIntel #ThreatHunting
3
4
223
Fake trading and VPN apps were changing their install commands depending on the visitor's operating system. That is the bit I find interesting. @webamon_search can find the behaviour beneath the branding, even when the next site appears on a random domain with a different brand. intel.webamon.com/search?luc… #ThreatIntel #ThreatHunting
3
4
223
87 sites. Random domains. iPhone and Nespresso phishing offers leading into subscription traps. This is exactly why we built @webamon_search to find what a page contains, not just what its domain is called. Brand impersonation and abuse rarely arrive with a helpful label. intel.webamon.com/search?luc…
1
4
185
A Webamon Content search added 9,275 additional domains scanned since 1st October, including 7.442 named-brand domains with no “toto” in the name. Domain strings provide the seed. Page content expands. The @webamon_search query: intel.webamon.com/search?luc…
Anurag
@MalwarehunterrOct 23
🚨 Indonesian Gambling Domain Cluster 🚨 Identified 6,303 domains registered since October 1, 2026, many hosting Indonesian language Toto/Togel, slot, and betting related websites or redirecting to gambling sites. URL: 99totoapp[.]com agustoto[.]vip Top registrars: - Namecheap: 3,025 - Dominet: 1,297 - GoDaddy: 499 - Dynadot: 367 - Spaceship: 180 Some websites also promote APK downloads, raising additional security concerns. Full domain list and IOCs will be shared on GitHub. (link is in comment) #ThreatIntelligence #OSINT #Gambling #Indonesia @500mk500 @skocherhan @ex_raritas @AaronCTI @0x534c @rushibmehta @KirkDerpca @douglasmun
1
3
6
210
Aaron Roberts retweeted
Aaron Roberts
@AaronCTIOct 22
Within a day of the PHP2Shell fixes, Webamon scans found 30+ themed sites: checkers, analysis pages, upsells, a joke and three domains offering a $99 patch if you gave them “a way into your hosting”. A pattern worth watching... 🧵(1/7)
1
2
4
141
Within a day of the PHP2Shell fixes, Webamon scans found 30+ themed sites: checkers, analysis pages, upsells, a joke and three domains offering a $99 patch if you gave them “a way into your hosting”. A pattern worth watching... 🧵(1/7)
1
2
4
141
more replies
The hunt moved through page titles, CVE mentions, new registrations and repeated sales copy. Then phpinfo() pages supplied version and configuration details. Webamon lets you search what the pages say, not just what the domains are called. (6/7)
1
22
Explore the findings: PHP2Shell titles: intel.webamon.com/search?luc… Exposed phpinfo(): intel.webamon.com/search?luc… If you like this, then check out @webamon_search and see how we track villains across the web.
1
18
Load more