Spam e-mail is blasted from statement-ozrfpsqaktfvrovzk-update-pabpvigkontkymrezgjw-ys@wordsofzye.org.
Some e-mail headers
Phishing page
Hyperlink in e-mail:
https://lnkd.in/gUtuT_Tu?signature=newsletter&trackingid=FhAIfHDsUG3hSvrDXUeaPIKcsBoJXhaWhttps://lnkd.in/gUtuT_Tu?signature=newsletter&trackingid=yy97JIBHBln5DkdvdktyfEFrIHTzc5yD
Yesterday leads to domain https://us-itsign.news-updateaps-amzn-xbejoz.com.
Today the shortened link leads to https://sign.confirm-newspaypl-ksvel.top/.
(I didn’t keep the full URL in my records)
Phishing page screenshot
Admin panel
Configured receiving e-mail
Protection
Attacker e-mail
E-mail password is the same as admin dashboard password 4 months ago, but now it is changed. I will not disclose the password as the admin dashboard contains sensitive info.
Attacker’s received e-mails sample
Other details
Some configurations have been changed to prevent the phishing page from currently working.
