When you click on the phishing URL in the phishing email received by SMS on your Android OS smartpho ...
show moreWhen you click on the phishing URL in the phishing email received by SMS on your Android OS smartphone,
the malware's chrome.apk file is downloaded.
Phishing URL:
http://zniph.com/
http://gp.zniph.com/
http://y.zniph.com/
<Evidence>
・Twitter
https://twitter.com/NaomiSuzuki_/status/1585471143791984640
・Urlscan
https://urlscan.io/result/63e603e0-00d7-4787-ad06-4dc59e0d6b88/
https://urlscan.io/result/776b96c8-8fce-45b1-927a-f34003a4c160/
https://urlscan.io/result/6e10a3eb-28a5-4f3e-bdb4-ab4888f3e363/
・VirusTotal
https://www.virustotal.com/gui/ip-address/91.204.227.21/relations
show less
When the phishing URL is accessed on an Android smartphone,
a malware file named "chrome.apk" is d ...
show moreWhen the phishing URL is accessed on an Android smartphone,
a malware file named "chrome.apk" is downloaded.
<Phishing URL>
http:///wsznx.com/
http://xo.wsznx.com/
http://ya.wsznx.com/
http://r2.wsznx.com/
http://w.wsznx.com/
http://3d.wsznx.com/
http://9.wsznx.com/
http://e.gdupe.com/
<Evidence>
・VirusTotal
https://www.virustotal.com/gui/ip-address/91.204.227.21/relations
・Twitter
https://twitter.com/NaomiSuzuki_/status/1585108382230654977
show less
The IP Address(91.204.227.21) has been active since Febuary 11, 2022.
It seems that the domain, or ...
show moreThe IP Address(91.204.227.21) has been active since Febuary 11, 2022.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
You can access the phishing site only from your smartphone.
Phishing URL:
http://twtku.axsux.com/grdertggde/
http://wpold.axsux.com/grdertggde/
http://pakoe.axsux.com/grdertggde/
・Virus Total
https://www.virustotal.com/gui/ip-address/91.204.227.21/relations
・Urlscan
https://urlscan.io/result/51897498-aca0-4554-b282-204ee1577ab4/
https://urlscan.io/result/03ae5ee9-cdce-4d7e-82aa-c8e5f96dd3f6/
https://urlscan.io/result/b632ad44-00fc-4362-9b89-27d2a8dcea38/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://www.post.japanpost.jp/index.htmlSite owner:
Japan Post Co., Ltd.
show less
Phishing mail is distributed from SMS. From Febuary 11, 2022,
phishing URLs linked to IP address: 9 ...
show morePhishing mail is distributed from SMS. From Febuary 11, 2022,
phishing URLs linked to IP address: 91.204.227.21
can be accessed only by smartphones.
Phishing URL:
http://kosjg.yqzmx.com/grdertggde/
http://wtdum.tqqew.com/grdertggde/
http://dqhxa.axsux.com/grdertggde/
http://tqaxp.ytvcw.com/grdertggde/
・Virus Total
https://www.virustotal.com/gui/ip-address/91.204.227.21/relations
https://www.virustotal.com/gui/domain/tqaxp.ytvcw.com/relations
https://www.virustotal.com/gui/domain/kosjg.yqzmx.com/relations
・Urlscan
https://urlscan.io/result/6bba448e-3c0d-4008-a207-47b96e8dd46f/
https://urlscan.io/result/6b48ebb2-c8bd-4873-86b5-7edfe000048b/
Below are images of legitimate sites used
by phishing crime groups when accessing with Android OS.
https://www.post.japanpost.jp/index.html
Website owner:
Japan Post Co., Ltd.
show less
Since Febuary 11, 2022, the phishing site is currently operating at
IP address: 91.204.227.21.
You ...
show moreSince Febuary 11, 2022, the phishing site is currently operating at
IP address: 91.204.227.21.
You can also access the phishing URL only from your smartphone.
Phishing URL:
http://kfrcn.yqzmx.com/grdertggde/
http://kfcn.yqzmx.com/grdertggde/
http://alxvc.yqzmx.com/grdertggde/
http://omejo.yqzmx.com/grdertggde/
The following security sites are evidence of phishing sites.
・Virus Total
https://www.virustotal.com/gui/ip-address/91.204.227.21/relations
https://www.virustotal.com/gui/domain/kfcn.yqzmx.com/relations
https://www.virustotal.com/gui/domain/kfrcn.yqzmx.com/relations
・Urlscan
https://urlscan.io/result/c247cf0d-fadb-45cf-9f1d-28973bec2701/
https://urlscan.io/result/710de960-db06-41c5-84c7-7f4daddba0ce/
https://urlscan.io/result/3dbdf75a-eb77-4acb-bfa0-ba3f4f39190d/
Image of legitimate site used for phishing site:
https://www.post.japanpost.jp/index.html
Site owner:
Japan Post Co., Ltd.
show less
Phishing
Email Spam
Showing 1 to
15
of 15 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩