Update coinbase-recovery-phrase-phishing.yml

phish-report · Mar 10, 2024 · 0c7a76a · 0c7a76a
1 parent 4f0733c
commit 0c7a76a
Showing 1 changed file with 7 additions and 7 deletions.
diff --git a/indicators/coinbase-recovery-phrase-phishing.yml b/indicators/coinbase-recovery-phrase-phishing.yml
@@ -1,18 +1,18 @@
-title: Coinbase Recovery Phrase Phishing
-description: Detects Coinbase recovery phrase scam websites.
+title: Coinbase Phishing zG3nVT0g
+description: Detects Coinbase recovery phrase scam websites. Often hosted on Glitch (https://glitch.com/).
 
 references:
     - https://urlscan.io/result/68d77307-6932-4eae-b7b0-ca8157b2a50f/
     - https://urlscan.io/result/bdf5c218-896f-4e17-b5ef-2b67f80041e2/
     - https://urlscan.io/result/4a5ee737-6cf8-4028-9bfc-4e93afbe6627/
 
 detection:
-  imagefile:
+  imageFile:
     # This image file is used on a lot of Coinbase scams in their forms.
-    html|contains: 'https://i.postimg.cc/zG3nVT0g/cb675.png2'
+    html|contains: 'https://i.postimg.cc/zG3nVT0g/cb675.png'
 
-  condition: imagefile
+  condition: imageFile
 
 tags:
-    - Coinbase Phishing
-    - Crypto Scams
+    - target.coinbase
+    - cryptocurrency