The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.
Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.
Key facts
- 194,345 FQDNs across 136,933 root domains tied to the campaign since Jan 2024
- Targets hit since April 2024; expanded from tolls/mail to banking, crypto, healthcare
- Thousands of domains churned weekly via Hong Kong registrar and US cloud hosting
- Messages shift from email-to-SMS to phone numbers, including +63 and +1 senders
- Scale and infrastructure indicate a large phishing-as-a-service (PhaaS) operation
- Products
- Advanced URL Filtering
- Threat actors
- Smishing Triad
- Victims
- U.S. residents
- Organizations
- Unit 42Palo Alto NetworksDominet (HK) Limited
- Countries
- United StatesChinaHong Kong
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | com-chargedae.world | ass.com-statementzz[.]world e-zpass.com-emea[.]top pikepass.com-chargedae[.]world e-zpass.com-etcoz[.]win e-zpassny.com-kien[.]top e-zpassn |
| domain | com-emea.top | sny.com-pvbfd[.]win e-zpass.com-statementzz[.]world e-zpass.com-emea[.]top pikepass.com-chargedae[.]world e-zpass.com-etcoz[.]win e- |
| domain | com-etcha.win | [.]com dhl.de-yiore[.]store usps.com-posewxts[.]top e-zpass.com-etcha[.]win usps.com-isjjz[.]top flde-lity.com-jw[.]icu e-zpass.com-t |
| domain | com-etcoz.win | zpass.com-emea[.]top pikepass.com-chargedae[.]world e-zpass.com-etcoz[.]win e-zpassny.com-kien[.]top e-zpassny.com-xxai[.]vip sunpass |
| domain | com-hbg.vip | n e-zpassny.com-kien[.]top e-zpassny.com-xxai[.]vip sunpass.com-hbg[.]vip usps.com-hzasr[.]bid e-zpassny.gov-tosz[.]live michigan.g |
| domain | com-hzasr.bid | n[.]top e-zpassny.com-xxai[.]vip sunpass.com-hbg[.]vip usps.com-hzasr[.]bid e-zpassny.gov-tosz[.]live michigan.gov-imky[.]win e-zpass |
| domain | com-isjjz.top | ]store usps.com-posewxts[.]top e-zpass.com-etcha[.]win usps.com-isjjz[.]top flde-lity.com-jw[.]icu e-zpass.com-tollbiler[.]icu e-zpas |
| domain | com-jw.icu | ]top e-zpass.com-etcha[.]win usps.com-isjjz[.]top flde-lity.com-jw[.]icu e-zpass.com-tollbiler[.]icu e-zpassny.com-pvbfd[.]win e-z |
| domain | com-kien.top | ass.com-chargedae[.]world e-zpass.com-etcoz[.]win e-zpassny.com-kien[.]top e-zpassny.com-xxai[.]vip sunpass.com-hbg[.]vip usps.com-h |
| domain | com-lg.icu | tors of Compromise icloud.com-remove-device[.]top flde-lity.com-lg[.]icu michigan.gov-etczhh[.]cc utah.gov-etcfr[.]win irs.gov-tax |
| domain | com-pay.online | -etcfr[.]win irs.gov-tax[.]cfd irs.org.gov-tax[.]icu anpost.com-pay[.]online kveesh6.il-363[.]com dhl.de-yiore[.]store usps.com-posewx |
| domain | com-posewxts.top | pay[.]online kveesh6.il-363[.]com dhl.de-yiore[.]store usps.com-posewxts[.]top e-zpass.com-etcha[.]win usps.com-isjjz[.]top flde-lity.co |
| domain | com-pvbfd.win | lde-lity.com-jw[.]icu e-zpass.com-tollbiler[.]icu e-zpassny.com-pvbfd[.]win e-zpass.com-statementzz[.]world e-zpass.com-emea[.]top pi |
| domain | com-remove-device.top | the Cyber Threat Alliance . Indicators of Compromise icloud.com-remove-device[.]top flde-lity.com-lg[.]icu michigan.gov-etczhh[.]cc utah.gov- |
| domain | com-statementzz.world | zpass.com-tollbiler[.]icu e-zpassny.com-pvbfd[.]win e-zpass.com-statementzz[.]world e-zpass.com-emea[.]top pikepass.com-chargedae[.]world e-z |
| domain | com-tollbiler.icu | a[.]win usps.com-isjjz[.]top flde-lity.com-jw[.]icu e-zpass.com-tollbiler[.]icu e-zpassny.com-pvbfd[.]win e-zpass.com-statementzz[.]world |
| domain | com-xxai.vip | e-zpass.com-etcoz[.]win e-zpassny.com-kien[.]top e-zpassny.com-xxai[.]vip sunpass.com-hbg[.]vip usps.com-hzasr[.]bid e-zpassny.gov- |
| domain | co-ykk.vip | ]live irs.gov-addpayment[.]info irs.gov-mo[.]net israeipost.co-ykk[.]vip canpost.id-89b98[.]com anpost.id-39732[.]info Additional |
| domain | de-yiore.store | -tax[.]icu anpost.com-pay[.]online kveesh6.il-363[.]com dhl.de-yiore[.]store usps.com-posewxts[.]top e-zpass.com-etcha[.]win usps.com- |
| domain | gov-addpayment.info | ictims. For instance, a casual inspection of the domain irs.gov-addpayment[.]info could trick people into thinking they are navigating to i |
| domain | gov-etcfr.win | [.]top flde-lity.com-lg[.]icu michigan.gov-etczhh[.]cc utah.gov-etcfr[.]win irs.gov-tax[.]cfd irs.org.gov-tax[.]icu anpost.com-pay[.] |
| domain | gov-etczhh.cc | oud.com-remove-device[.]top flde-lity.com-lg[.]icu michigan.gov-etczhh[.]cc utah.gov-etcfr[.]win irs.gov-tax[.]cfd irs.org.gov-tax[.] |
| domain | gov-hzwy.live | xin ezpass.org-pvwh[.]xin ezpassnj.gov-mhmt[.]xin e-zpassny.gov-hzwy[.]live irs.gov-addpayment[.]info irs.gov-mo[.]net israeipost.co- |
| domain | gov-imky.win | vip usps.com-hzasr[.]bid e-zpassny.gov-tosz[.]live michigan.gov-imky[.]win e-zpass.org-yga[.]xin e-zpass.org-qac[.]xin ezpass.org-pv |
| domain | gov-mhmt.xin | [.]xin e-zpass.org-qac[.]xin ezpass.org-pvwh[.]xin ezpassnj.gov-mhmt[.]xin e-zpassny.gov-hzwy[.]live irs.gov-addpayment[.]info irs.g |
| domain | gov-mo.net | xin e-zpassny.gov-hzwy[.]live irs.gov-addpayment[.]info irs.gov-mo[.]net israeipost.co-ykk[.]vip canpost.id-89b98[.]com anpost.id- |
| domain | gov-tax.cfd | -lg[.]icu michigan.gov-etczhh[.]cc utah.gov-etcfr[.]win irs.gov-tax[.]cfd irs.org.gov-tax[.]icu anpost.com-pay[.]online kveesh6.il- |
| domain | gov-tax.icu | -etczhh[.]cc utah.gov-etcfr[.]win irs.gov-tax[.]cfd irs.org.gov-tax[.]icu anpost.com-pay[.]online kveesh6.il-363[.]com dhl.de-yiore |
| domain | gov-tosz.live | [.]vip sunpass.com-hbg[.]vip usps.com-hzasr[.]bid e-zpassny.gov-tosz[.]live michigan.gov-imky[.]win e-zpass.org-yga[.]xin e-zpass.org |
| domain | id-39732.info | .]net israeipost.co-ykk[.]vip canpost.id-89b98[.]com anpost.id-39732[.]info Additional Resources Internet Crime Complaint Center (IC3 |
| domain | id-89b98.com | ent[.]info irs.gov-mo[.]net israeipost.co-ykk[.]vip canpost.id-89b98[.]com anpost.id-39732[.]info Additional Resources Internet Crim |
| domain | il-363.com | .]cfd irs.org.gov-tax[.]icu anpost.com-pay[.]online kveesh6.il-363[.]com dhl.de-yiore[.]store usps.com-posewxts[.]top e-zpass.com- |
| domain | irs.gov | nfo could trick people into thinking they are navigating to irs[.]gov . Figure 3 shows the most popular prefixes of domain name |
| domain | org-pvwh.xin | ky[.]win e-zpass.org-yga[.]xin e-zpass.org-qac[.]xin ezpass.org-pvwh[.]xin ezpassnj.gov-mhmt[.]xin e-zpassny.gov-hzwy[.]live irs.gov |
| domain | org-qac.xin | ]live michigan.gov-imky[.]win e-zpass.org-yga[.]xin e-zpass.org-qac[.]xin ezpass.org-pvwh[.]xin ezpassnj.gov-mhmt[.]xin e-zpassny.g |
| domain | org-yga.xin | d e-zpassny.gov-tosz[.]live michigan.gov-imky[.]win e-zpass.org-yga[.]xin e-zpass.org-qac[.]xin ezpass.org-pvwh[.]xin ezpassnj.gov- |
From the original article
12 min read at unit42.paloaltonetworks.com
We are attributing an ongoing smishing (phishing via text message) campaign of fraudulent toll violation and package misdelivery notices to a group widely known as the Smishing Triad. Our analysis indicates this campaign is a significantly more extensive and complex threat than previously reported. Attackers have impersonated international services across a wide array of critical sectors.
unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.