Our dark web monitoring team in iZOOlogic has recently discovered that the popular cybercriminal underground marketplace, Hydra Market, has released an extensive database list of all known active phishing sites.
Based on our team’s latest findings, the published list was categorised into three parts, including “Active Phishing List,” “Active Phishing List (NOW),” and “Active Phishing List (TODAY).”
Furthermore, the discovered phishing database list presents numerous popular domains, websites, and brands that threat actors abuse to conduct their phishing campaigns against millions of targeted companies and individuals worldwide.
Hydra Marketplace’s mods empower the published phishing database list.
We have also found that the published phishing database list was powered by mods of the criminal marketplace, Hydra, which makes it a dynamic tool that routinely updates itself to avoid duplicates and avoid listing inactive phishing sites.
Our researchers note that the intent of this phishing database list is still unknown, although we believe that it aims to provide aid to hackers in baiting out their victims’ information via well-engineered social engineering tactics. On the other hand, cybersecurity researchers could also use the published list to help companies and individuals against threats of active phishing campaigns.
Upon further investigation, our researchers also found a few links on the published list visible on other cybercriminal underground forums. These findings could imply that several threat groups have been aggressively working to propagate phishing attacks using the sites listed on the published database.
Our dark web experts are uncertain whether the Hydra Market’s operators are developing related projects. However, we will remain on the lookout for developments about this discovery, including knowing the purpose of why the notorious underground marketplace has published the list for public view.
As phishing campaigns remain an active operation for threat actors in the cybercriminal landscape, companies and individuals are advised to be wary about receiving phishing attempts, whether directed through email, text messages, or phone calls.
