Rewterz Threat Alert – Verified Phishing URLs

Severity

Medium

Analysis Summary

Phishing is the fraudulent attempt to obtain sensitive information or data, such as usernames, passwords and credit card details. This is done by disguising oneself as trustworthy communication to obtain information which can be used against the user. Phishing activities are almost ongoing across the world and is the most common source of attack used against the victims to lure them to click on the malicious attachments. The URLs, email subjects, filenames are made in such manner where the user would feel the domain is legitimate and has no hesitation clicking on the attachment. This would lead the victim to land on the phishing page where the threat actor would gather the information and later on use against the victim.

Impact

• Credential theft
• Exposure of sensitive data 

Indicators of Compromise

URL

• http[:]//www[.]unitus[.]mk[.]ua/sites/default/files/ctools/ams/cms/index/www/customer_center/customerIDPP00C297/login[.]php
• http[:]//unitus[.]mk[.]ua/sites/default/files/ctools/ams/cms/index/www/customer_center/customerIDPP00C719/login[.]php
• http[:]//piovecosmetics[.]com/connexion/orange[.]login[.]php/%7Cxwawalzffthzmmbpqmsdjxrrywg-dot-polishedshore-301017[.]uk[.]r[.]appspot[.]comx%20
• https[:]//www[.]techycons[.]com/servicemms/-orange/
• http[:]//www[.]3ct-dz[.]com/servicemms/-orange/
• https[:]//msuccessplanet[.]com/?c55d686be5fa7ec871b6fc3c841e665b
• http[:]//orange-offre[.]mobile-forfait[.]client[.]travelforever[.]co[.]uk/?ensWER
• https[:]//msuccessplanet[.]com/?5857dd714a4a790860167dba3f36a4b1
• https[:]//ppohsdoog[.]com/visitor_fr/index_2_d[.]php?device_name=Desktop&browser_name=Firefox&language=frFR&city=Paris&clickid=1dcfebza137k2f45&campaign=508&user_id=1&clickcost=0&lander=555&time=1611305159&browser_version=78&device_model=Desktop&device_brand=Desktop&resolution=800×600&os_name=Windows&os_version=10&country=France&country_code=FR&isp=Orange&ip=80[.]12[.]67[.]55&user_agent=Mozilla/5[.]0%20(Windows%20NT%2010[.]0;%20Win64;%20×64;%20rv[:]78[.]0)%20Gecko/20100101%20Firefox/78[.]0&lpkey=169711f4309454b959&target=org&device=DESKTOP&uclick=fnydh99r&uclickhash=fnydh99r-bza137k2-ft6o-bz0-37bl-m7u3-uouq-9c5a71
• https[:]//ppohsdoog[.]com/visitor_fr/index_2_d[.]php?device_name=Desktop&browser_name=Firefox&language=frFR&city=Paris&clickid=626b3bza2uqqebb6&campaign=508&user_id=1&clickcost=0&lander=555&time=1611311367&browser_version=78&device_model=Desktop&device_brand=Desktop&resolution=800×600&os_name=Windows&os_version=10&country=France&country_code=FR&isp=Orange&ip=80[.]12[.]67[.]55&user_agent=Mozilla/5[.]0%20(Windows%20NT%2010[.]0;%20Win64;%20×64;%20rv[:]78[.]0)%20Gecko/20100101%20Firefox/78[.]0&lpkey=169d113131c416e467&target=org&device=DESKTOP&uclick=fnydh99r&uclickhash=fnydh99r-bza2uqqe-ft6o-bz0-37bl-m7gmuouq-293c45
• https[:]//msuccessplanet[.]com/?af3bd18d63821dc5b9c1fbb71aa7538c

Remediation

• Block all threat indicators at your respective controls. 
• Always be suspicious about emails sent by unknown senders. 
• Never click on links/attachments sent by unknown senders.