A malware file (chrome.apk) is downloaded.
<Phishing URL>
http://qsxym.com/
http://5xd.qsxym.co ...
show moreA malware file (chrome.apk) is downloaded.
<Phishing URL>
http://qsxym.com/
http://5xd.qsxym.com/
http://mrdzv.com/
http://5u4.mrdzv.com/
<Evidence>
・Twitter
https://twitter.com/NaomiSuzuki_/status/1588006920212058112
https://twitter.com/NaomiSuzuki_/status/1587647479109259264
show less
The IP Address(91.204.227.22) has been active since February 15, 2022.
It seems that the domain, or ...
show moreThe IP Address(91.204.227.22) has been active since February 15, 2022.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
You can access the phishing site only from your smartphone.
Phishing URL:
http://waucd.znyrn.com/grdertggde/
・Virus Total
https://www.virustotal.com/gui/ip-address/91.204.227.22/relations
https://www.virustotal.com/gui/domain/waucd.znyrn.com/relations
・Urlscan
https://urlscan.io/result/caed2ed4-48d0-427f-a54c-9d3658148c51/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://www.post.japanpost.jp/index.htmlSite owner:
Japan Post Co., Ltd.
show less
The IP Address(91.204.227.22) has been active since Febuary 15, 2022.
It seems that the domain, or ...
show moreThe IP Address(91.204.227.22) has been active since Febuary 15, 2022.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
You can access the phishing site only from your smartphone.
Phishing URL:
http://ayros.znyrn.com/grdertggde/
http://advsp.znyrn.com/grdertggde/
・Virus Total
https://www.virustotal.com/gui/ip-address/91.204.227.22/relations
https://www.virustotal.com/gui/domain/ayros.znyrn.com/relations
https://www.virustotal.com/gui/domain/advsp.znyrn.com/relations
・Urlscan
https://urlscan.io/result/32495851-9d74-4d6c-9baf-0a4f199f1f50/
https://urlscan.io/result/67803cff-cbdc-4810-8833-b4f98629dc2e/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://www.post.japanpost.jp/index.htmlSite owner:
Japan Post Co., Ltd.
show less
Phishing mail is distributed from SMS. From February 12, 2022,
phishing URLs linked to IP address: ...
show morePhishing mail is distributed from SMS. From February 12, 2022,
phishing URLs linked to IP address: 91.204.227.22
can be accessed only by smartphones.
Phishing URL:
http://danqb.znyrn.com/grdertggde/
http://orrvy.znyrn.com/grdertggde/
・Virus Total
https://www.virustotal.com/gui/ip-address/91.204.227.22/relations
https://www.virustotal.com/gui/domain/danqb.znyrn.com/relations
https://www.virustotal.com/gui/domain/orrvy.znyrn.com/relations
・Urlscan
https://urlscan.io/result/15253a62-eca9-4f1e-9cb0-fe51b8a32e57/
https://urlscan.io/result/0c7cbbde-1218-4b0b-ad90-f5d506abc05d/
Below are images of legitimate sites used
by phishing crime groups when accessing with Android OS.
https://www.post.japanpost.jp/index.html
Website owner:
Japan Post Co., Ltd.
show less
Since May 2, 2021, the phishing site is currently operating at
IP address: 91.204.227.22.
You can ...
show moreSince May 2, 2021, the phishing site is currently operating at
IP address: 91.204.227.22.
You can also access the phishing URL only from your smartphone.
Phishing URL:
http://kj.94909kj.com/grdertggde/
The following security sites are evidence of phishing sites.
・Virus Total
https://www.virustotal.com/gui/ip-address/91.204.227.22/relations
https://www.virustotal.com/gui/domain/kj.94909kj.com/relations
・Urlscan
https://urlscan.io/result/44bf235c-7dec-49e7-886a-cb982983f82e/
Image of legitimate site used for phishing site:
https://www.post.japanpost.jp/index.html
Site owner:
Japan Post Co., Ltd.
show less
Phishing
Email Spam
Anonymous
From SMSising,It looks like fake Japan post site.
Phishing
Showing 1 to
10
of 10 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩