GreenSpot-Linked Phishing Infrastructure Spoofs 163.com to Steal Credentials
Summary
Hunt.io researchers linked suspected GreenSpot infrastructure to spoofed 163.com login and attachment-download pages. Some pages captured submitted credentials; the researchers found no evidence of credential exfiltration from one separate login-page cluster.
Key points
- Researchers identified lookalike domains impersonating NetEase’s 163.com email service, including one hosting a spoofed login page.
- A separate cluster of fake large-attachment download pages prompted users to enter 163.com credentials to access benign decoy files.
- In the download-page flow, a second login attempt sent credentials to login.js, which saved them through a PHP script.
- The researchers linked the infrastructure to GreenSpot based on hosting and domain patterns and overlap with public reporting; attribution is presented as a strong suggestion, not confirmation.
- The article reports no evidence that credentials were exfiltrated from the spoofed login-page cluster, though its script could be modified.
- The investigation identifies suspicious domains, IP addresses, certificate patterns, and unusual HTTP behavior as indicators for monitoring.
- Recommended defenses include enabling multi-factor authentication, monitoring networks, and keeping threat intelligence current.
Article Details
- Attack Vectors
- Spoofed domains and login pages impersonated 163.com to collect user credentials.
- Fake large-attachment download pages prompted visitors to enter 163.com credentials; phishing emails were considered a likely distribution method.
- A POST request to login.js on the second credential-submission attempt sent entered credentials for capture by saveData.php.
- Defensive Notes
- Enable multi-factor authentication.
- Monitor for irregular domain registrations, certificate anomalies, and unusual HTTP responses.
- Strengthen network monitoring and keep threat-intelligence feeds current.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chamber[.]icu | Download page hosting a purported housing-allocation spreadsheet. |
| DOMAIN | l2024163[.]com | Malicious download page hosting a purported maritime administrative guide. |
| DOMAIN | mail[.]eco163[.]com | Spoofed 163.com domain hosting a suspicious login page. |
| DOMAIN | mail[.]ll63[.]net | Suspicious domain identified as part of the credential-phishing infrastructure. |
| DOMAIN | superset[.]greeninvietnam[.]org[.]vn | Download page hosting a purported inspections document. |
| IPV4 | 139[.]162[.]62[.]21 | Threat infrastructure IP hosting the spoofed mail domains mail[.]ll63[.]net and mail[.]eco163[.]com. |
| IPV4 | 152[.]32[.]138[.]108 | IP hosting an open directory associated with the identified threat infrastructure. |
| IPV4 | 198[.]13[.]56[.]201 | Threat infrastructure IP hosting the download page at chamber[.]icu. |
| IPV4 | 207[.]148[.]124[.]130 | Threat infrastructure IP hosting the download page at superset[.]greeninvietnam[.]org[.]vn. |
| IPV4 | 45[.]76[.]180[.]253 | Threat infrastructure IP hosting the malicious download page at l2024163[.]com. |
MITRE ATT&CK
Threat Actors
Vendors
Products
Countries
Chinadata theft operations, the group targets government, academic, and military-related entities primarily in China through phishing campaigns.Singaporell63[.]netQuerying the IP in Hunt shows the server is hosted on the Akamai Connected Cloud network in Singapore, with ports 22 and 80 open. Of note, port 80 responds with a non-standard HTTP status code of 588. WhileTaiwanby Antiy Labs in 2018, the GreenSpot Advanced Persistent Threat (APT) group is believed to operate from Taiwan and has been active since at least 2007. Known for data theft operations, the group targets government,
Industries
Academicand has been active since at least 2007. Known for data theft operations, the group targets government, academic, and military-related entities primarily in China through phishing campaigns.Governmentfrom Taiwan and has been active since at least 2007. Known for data theft operations, the group targets government, academic, and military-related entities primarily in China through phishing campaigns.Militaryactive since at least 2007. Known for data theft operations, the group targets government, academic, and military-related entities primarily in China through phishing campaigns.