Login pages loading from thum.io

22 Aug, 2023
10 weeks ago

A tactic used by phishing sites targeting corporate email accounts, is to load a screenshot of the email domain to use as a background.

thum.io is one service used by phishers for this purpose. Because this service requires an API key, you can use the API key to cluster phishing sites by threat actor: https://image.thum.io/get/auth/

Activity

Matching hosts (daily)
matches.json

Filters

Matches

Hosts seen matching this rule

Filters , active

title: Login pages loading from thum.io
description: |
  A tactic used by phishing sites targeting corporate email accounts,
  is to load a screenshot of the email domain to use as a background.

  [thum.io](https://thum.io) is one service used by phishers for this purpose.
  Because this service requires an API key, you can use the API key to cluster phishing sites
  by threat actor: https://image.thum.io/get/auth/<api key>
level: potentially_malicious

detection:
  selection:
    title|contains:
      - Login
      - Authentication
    requests|startswith: https://image.thum.io/

  condition: selection