{ "Event": { "analysis": "1", "date": "2026-07-15", "extends_uuid": "", "info": "[Threat Intel] Fake crypto scams try to piggyback off SpaceX IPO", "protected": false, "publish_timestamp": "1784553517", "published": true, "threat_level_id": "3", "timestamp": "1784553516", "uuid": "099128c6-3add-4d07-ae09-898ec42e1a69", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#1a0065", "local": false, "name": "rectifyq:topic=\"crypto-related\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784170840", "to_ids": false, "type": "link", "uuid": "4776f8e1-b62f-4155-8dbe-5f00c8498bd6", "value": "https://www.netcraft.com/blog/fake-tax-forms-spacex-ipo-offer", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784170840", "to_ids": false, "type": "text", "uuid": "134b64a9-9b66-41eb-bece-9fff0510052d", "value": "Scammers are exploiting public interest in the SpaceX IPO through fraudulent investment portals impersonating SpaceX, Elon Musk, and major financial brands including Fidelity and Robinhood. The campaign uses themed domains to lure victims into fake onboarding processes that mimic legitimate investment procedures, including W-8BEN tax forms for non-U.S. investors. Victims are asked to select investment tiers and ultimately directed to deposit funds via cryptocurrency wallets for Bitcoin, Ethereum, and USDT. The operation mirrors techniques used by threat actor TA2730 but focuses on direct cryptocurrency theft rather than credential harvesting. One Bitcoin wallet associated with the campaign received approximately $8,700. The infrastructure includes randomized domains and SpaceX-themed domains designed to appear legitimate during the investment process." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784170840", "to_ids": false, "type": "text", "uuid": "8d20fdf6-daea-4aee-a5fa-2a58d5499525", "value": "Name: Fake crypto scams try to piggyback off SpaceX IPO\nAuthor: AlienVault\nAdversary: TA2730\nTags: [\"spacex ipo\", \"phishing campaign\", \"fake portals\", \"brand impersonation\", \"investment fraud\", \"cryptocurrency theft\", \"financial scam\", \"w-8ben forms\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: [\"Finance\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784170840", "to_ids": false, "type": "threat-actor", "uuid": "e62ff798-d29f-4baf-b87c-3804a209deca", "value": "TA2730" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464644", "to_ids": true, "type": "domain", "uuid": "6b5d14e3-456a-41ed-9cea-3dcd8ad8ca85", "value": "8fv4dxp7lx035f8ylk7.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464665", "to_ids": true, "type": "domain", "uuid": "f9d5914a-62f7-4a61-af86-466de7ad43a0", "value": "467jtzbkqcfl22t9hxh.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464686", "to_ids": true, "type": "domain", "uuid": "873086ee-f987-4ad1-b21c-04b4c941a736", "value": "ddgaoylh4h420fvm7o5.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464707", "to_ids": true, "type": "domain", "uuid": "0ef9e34e-802e-4065-9a04-3e34f038c70b", "value": "u7aq3ocwrexd70ulpdj.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464728", "to_ids": true, "type": "domain", "uuid": "f9a80c49-3fa4-43e0-a5f8-2871fe0e115c", "value": "zavpejjyz432d577l2e.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464750", "to_ids": true, "type": "domain", "uuid": "be275569-4284-474a-b0a6-cabc947ad4de", "value": "cd7yt860whhm7g7ylj8.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464771", "to_ids": true, "type": "domain", "uuid": "fe3dfe70-e5f1-40d2-ba36-f6895a49ba48", "value": "g8iqelymkc4eya9zs49.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464792", "to_ids": true, "type": "domain", "uuid": "049de72e-abc0-4140-957a-7d41e411dcd2", "value": "hy0zu0fuf7rc2ou5aje.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464814", "to_ids": true, "type": "domain", "uuid": "70dce5de-b887-45df-9662-a6f6d4556518", "value": "k1rg2oz4zpzw91pdx90.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464835", "to_ids": true, "type": "domain", "uuid": "b62a7104-e62e-4901-b054-1c4273457a17", "value": "ogqw9cpz7t7et3j1rur.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464856", "to_ids": true, "type": "domain", "uuid": "e29b070b-a140-4bb2-946b-a04b9bea9313", "value": "adanispacex.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464877", "to_ids": true, "type": "domain", "uuid": "8d765139-3cf9-4c10-ae71-cf71d7059931", "value": "fidelityspacex.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464898", "to_ids": true, "type": "domain", "uuid": "e332e472-299c-49ea-8e5d-461da49cf1e6", "value": "fidelityspacexipo.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464920", "to_ids": true, "type": "domain", "uuid": "029b4061-a260-406f-bb81-a2a35e43a8b8", "value": "muskspacexipo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464942", "to_ids": true, "type": "domain", "uuid": "e709b75b-e545-4a06-8887-4a73b555036d", "value": "muskspacexipo.vip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464963", "to_ids": true, "type": "domain", "uuid": "fe716ead-c5be-4eb1-b0dd-abacb884b630", "value": "robinhoodspacex.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784464984", "to_ids": true, "type": "domain", "uuid": "409e43da-e2a5-45b5-bf92-a269f4d17e44", "value": "spacexshares.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784465005", "to_ids": true, "type": "hostname", "uuid": "e4fa71b1-0ca7-44b2-a51b-6efecad00737", "value": "mail.musksapcex.space", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Financial fraud", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784451146", "to_ids": true, "type": "btc", "uuid": "ce74da30-4c7d-4961-bd41-728dd7aa001a", "value": "bc1q3ad4npa6qqxrcdrgd2gmmgttsakq9635q6uz50" } ] } }