nequi2

README

Phishing sites impersonating Nequi (alternative 2)

Will only be listed here DNS A records, sorted by IP:

prpulsorpreeaprobado.website. 1800 IN   A       92.113.18.232
aprobados-neq.site.     1800    IN      A       147.79.84.90
activatupropulsor.store. 60     IN      A       191.96.144.162
propulsorpreaprobado.website. 1800 IN   A       194.164.64.208
propulsores-aprobados.website. 1800 IN  A       194.164.64.208

The entrypoint of the scam page is https://LISTED_DOMAIN/agil.html or ended in activa.php or in personas.php

Mirrors down

The following domains used to have the same scam structure:

• activatupropulsor.store
• pree-populsorwebside.online
• pree-propulsoraprobado.website
• preaprobado.site
• propulsores-aprobados.website
• propulsorpreaprobado.website
• prospereee.website
• prospereeee.website