nequi3

README

Phishing sites impersonating Nequi (alternative 3)

Will only be listed here DNS A records, sorted by IP:

prestadecision.com.     14400   IN      A       162.241.2.172
propuladmin.com.        14400   IN      A       162.241.2.172
ahorrosnq.com.          14400   IN      A       162.241.60.20
neqpropulsaya.com.      14400   IN      A       162.241.60.255
tucredirapido.com.      14400   IN      A       162.241.61.78
impulsadorahorros.com.  14400   IN      A       162.241.203.120
creatusahorros.com.     14400   IN      A       162.241.203.121

It is required to use DevTools with Android/iPhone emulation. Once ready, the entrypoint of the scam is https://LISTED_DOMAIN/bdigital/inicio.php.

Mirrors down

The following domain used to had the same scam structure:

• impulsadorahorros.com
• presneqpro.shop
• prestadecision.com
• propuladmin.com
• tucredirapido.com