#Phishing #Campaign

#Phishing #Campaign

IoC:

Spam Check page , if you change the domain or email it will redirect into Google.com

https://www.hedenstedevents[.]dk/robotcheck?e=emailaddress

Authentication page / Phishing page:

https://microsoftonline[.]msvoice[.]online/
https://login-live.msvoice[.]online

Passive DNS we see that more domains were hosted on the same IP: IP: 23.94.104.20

krd9m9j2eziqg84.msvoice.online
0wl6vlpnfp3j5i2.msvoice.online
loyv9hnd5jvlcmr.msvoice.online
www.msvoice.online
aslep2i8e3rfnla.msvoice.online
7dbt66nv6bva7ky.msvoice.online
7w60swcmzfv6m9p.msvoice.online
jxqa6jljbvf3fuj.msvoice.online
microsoftonline.msvoice.online
stage.msvoiceonline.club
citrix.msvoiceonline.club
shop.msvoiceonline.club
support.msvoiceonline.club
820okr5gkqt527s.msvoiceonline.club
6ptcn3v9le2332q.msvoiceonline.club
vvllzsar771rcld.msvoiceonline.club
w9matagavrx1twy.msvoiceonline.club
zbkofnoqjtoik50.msvoiceonline.club
6yf4n3fzpg654e9.msvoiceonline.club
xofwwshtc0obsv2.msvoiceonline.club
kf7gpqsv71dzogp.msvoiceonline.club
login-live.msvoiceonline.club
microsoftonline.msvoiceonline.club
67qxv5kevfipsle.msvoiceonline.club
11jzsjf8vd7rrtz.msvoiceonline.club
www.msvoiceonline.club
msvoice.online
msvoiceonline.club
en.fi.mk
jnliandong.com