Phishers Hide Scam Links With IPv6-Mapped IPv4 URLs in Free Toothbrush Emails
Summary
Phishers impersonating UnitedHealthcare use a free Oral-B iO toothbrush lure and IPv6-mapped IPv4 URLs to direct recipients to pages likely harvesting personal and card data. They previously used Azure Blob Storage links.
Key points
- Phishing emails impersonate UnitedHealthcare and offer a free Oral-B iO toothbrush to entice recipients to click.
- The campaign has shifted from Microsoft Azure Blob Storage links to obfuscated IPv6-mapped IPv4 URLs.
- The example URL http://[::ffff:5111:8e14]/ encodes the IPv4 address 81.17.142.20.
- The fast-rotating landing pages are likely intended to collect personal information and payment-card details under the guise of eligibility checks or shipping fees.
- The article lists 81.17.142.40, 15.204.145.84, redirectingherenow[.]com, and redirectofferid[.]pro as campaign indicators.
- People who submitted card details are advised to contact their bank, cancel the card, dispute unauthorized charges, change linked passwords, and scan their device.
Article Details
- Event Type
- Phishing campaign impersonating United Healthcare and using obfuscated IPv6-mapped IPv4 links
- Impact
- The landing pages are likely designed to collect personally identifiable information and payment-card data by posing as eligibility confirmation or a shipping-fee payment. Stolen card data may be used quickly for unauthorized charges.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | redirectingherenow[.]com | Malicious redirector domain identified as tied to the phishing campaign. |
| DOMAIN | redirectofferid[.]pro | Malicious redirector domain identified as tied to the phishing campaign. |
| IPV4 | 15[.]204[.]145[.]84 | IP address identified as hosting phishing or landing pages tied to the campaign. |
| IPV4 | 81[.]17[.]142[.]20 | IPv4 address encoded in the campaign's obfuscated IPv6-mapped URL. |
| IPV4 | 81[.]17[.]142[.]40 | IP address identified as hosting phishing or landing pages tied to the campaign. |
| URL | hxxp[:]//[::ffff:81[.]17[.]142[.]20]/ | Obfuscated link used in the phishing campaign to direct recipients to a landing page. |