Phishing JP-POST www.wodeaini.com

Sat Jun 22 14:33:04 JST 2019

#Phishing Alert ⚠️
hxxps://www\.wodeaini\.com/
IP: 154.221.31.15 (AS133115 Kwaifong Group Limited, HK)
https://urlscan.io/result/9f8827d1-9a62-451a-aca4-bf1a423e35d6/
brand: #JapanPost #日本郵便

IoC:
百度统计代码(Baidu tracking):
<script src="https://hm.baidu.com/hm.js?b47a5da10e6305ded05c5f36104a3165"></script>

Env:
nginx
ThinkPHP V5.1.35 LTS
PHP/7.0.33
ThinkCMF https://www.thinkcmf.com/ https://github.com/thinkcmf/thinkcmf
DocumentRoot: /www/wwwroot/web/public/

* ThinkCMF
/demo/
/themes/default/manifest.json
** Admin Panel (but, not configured…)
/themes/admin_simpleboot3/admin/login.html

EndPoint:
/api.php