Phishing Campaigns Impersonate Canadian Government Services, Canada Post and Air Canada
Summary
CloudSEK links PayTool-style traffic-fine scams with phishing impersonating Canadian tax, postal and airline services. The campaigns use SMS, malicious ads and typosquatted domains to steal personal and payment data, with kits also advertised on underground forums.
Key points
- More than 70 domains impersonating a federal-style Canadian traffic-ticket portal reportedly resolved to one IP; related infrastructure hosted province-specific payment phishing sites.
- Scams use urgent SMS messages or malicious ads and fake validation steps before directing victims to payment pages designed to collect personal and financial information.
- The activity extends beyond traffic fines to Canada Post redelivery lures and Air Canada booking typosquats, which may exploit mistyped addresses or malicious search ads.
- CloudSEK observed a forum seller advertising an Ontario driver’s-license phishing kit targeting personal details, Interac credentials and payment-card data; the seller could not substantiate claims about data handling.
- The report recommends monitoring lookalike domains, blocking suspicious infrastructure, takedown efforts and advising users to reach services through official bookmarked sites.
Article Details
- Attack Vectors
- SMS phishing and malicious advertisements impersonate Canadian government services, postal delivery, and airlines.
- Phishing sites use fake validation forms to solicit ticket numbers, booking references, or account identifiers before presenting fraudulent payment gateways that collect personal and financial data.
- Typosquatted domains and SEO poisoning direct users to Air Canada impersonation pages.
- Phishing kits advertised on underground forums target Ontario driver's license renewals, banking credentials, payment data, and other personal information.
- Defensive Notes
- Monitor for typosquatting and keyword-based domains and initiate rapid takedowns.
- Use DNS and web-gateway controls to block newly registered suspicious domains and known PayTool-related IP ranges.
- Warn users that government agencies and airlines do not request payments or sensitive data through SMS links.
- Use threat intelligence to detect shared hosting patterns, matching favicons, and reused page titles.
- Encourage users to access services through bookmarked official portals rather than links in messages or advertisements.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | a25pont-laval[.]com | Domain impersonating a toll-bridge payment service. |
| DOMAIN | ab-speed[.]com | Listed as a domain indicator associated with traffic-fine phishing. |
| DOMAIN | air-canaada-booking[.]com | Typosquatted domain impersonating Air Canada booking services. |
| DOMAIN | aircanda-booking[.]com | Typosquatted domain impersonating Air Canada booking services. |
| DOMAIN | airscanada-booking[.]com | Typosquatted domain impersonating Air Canada booking services. |
| DOMAIN | amende-enligne-qc[.]com | Phishing domain associated with Quebec fine-payment impersonation. |
| DOMAIN | bc-account[.]com | Listed as a domain indicator associated with the campaign. |
| DOMAIN | bc-infraction[.]com | Phishing domain impersonating British Columbia traffic-infraction services. |
| DOMAIN | handlingparcel[.]info | Domain associated with parcel-delivery phishing. |
| DOMAIN | handlingpostecan1[.]com | Domain associated with Canada Post parcel-delivery phishing. |
| DOMAIN | handlingxpress[.]info | Domain associated with parcel-delivery phishing. |
| DOMAIN | justice-ticket-portal[.]com | Listed as a domain indicator associated with the traffic-ticket phishing activity. |
| DOMAIN | my-traffic-citation[.]com | Domain associated with traffic-citation phishing. |
| DOMAIN | my-traffic-citations[.]com | Domain associated with traffic-citation phishing. |
| DOMAIN | my-traffic-offence[.]com | Domain associated with traffic-offence phishing. |
| DOMAIN | my-traffic-ticket-portal[.]com | Domain associated with the fake traffic-ticket portal. |
| DOMAIN | my-traffic-tickets-portal[.]com | Domain associated with the fake traffic-ticket portal. |
| DOMAIN | my-traffic-violation[.]com | Domain associated with traffic-violation phishing. |
| DOMAIN | my-traffic-violations[.]com | Domain associated with traffic-violation phishing. |
| DOMAIN | my-traffics-citation[.]com | Domain associated with traffic-citation phishing. |
| DOMAIN | my-traffics-citations[.]com | Domain associated with traffic-citation phishing. |
| DOMAIN | ontario-paytool-2025[.]com | Phishing domain associated with Ontario PayTool-themed scams. |
| DOMAIN | ontarioticketpay[.]live | Phishing domain impersonating Ontario ticket-payment services. |
| DOMAIN | overdueticketinfraction[.]info | Generic fallback domain associated with traffic-ticket phishing. |
| DOMAIN | parking-fines[.]com | Listed as a domain indicator associated with parking-fine phishing. |
| DOMAIN | parking-portal[.]live | Generic fallback domain associated with traffic-fine phishing. |
| DOMAIN | paybc-portal[.]live | Phishing domain impersonating PayBC. |
| DOMAIN | paybconline-ticket[.]live | Listed as a domain indicator associated with PayBC-themed phishing. |
| DOMAIN | paytoll-canada[.]com | Listed as a domain indicator associated with Canadian toll-payment phishing. |
| DOMAIN | paytool-ab-2025[.]com | Phishing domain associated with Alberta PayTool-themed scams. |
| DOMAIN | paytool-bc-2025[.]com | Phishing domain impersonating a British Columbia traffic-fine payment service. |
| DOMAIN | postcan-track-elment[.]live | Domain associated with Canada Post parcel-delivery phishing. |
| DOMAIN | quickplate-check[.]com | Listed as a domain indicator associated with the traffic-ticket fraud campaign. |
| DOMAIN | redeliverparcel[.]info | Domain associated with parcel-redelivery phishing. |
| DOMAIN | search-portal-ticket[.]com | Domain associated with the fake Traffic Ticket Search Portal. |
| DOMAIN | search-ticket-portal[.]com | Domain associated with the fake Traffic Ticket Search Portal. |
| DOMAIN | serviceab-ticket[.]live | Listed as a domain indicator associated with Alberta ticket-payment phishing. |
| DOMAIN | serviceon-ticket[.]live | Phishing domain impersonating ServiceOntario. |
| DOMAIN | speedfines[.]com | Listed as a domain indicator associated with traffic-fine phishing. |
| DOMAIN | ticket-portal-infraction[.]com | Domain associated with the fake traffic-infraction search portal. |
| DOMAIN | ticket-portal-infractions[.]com | Domain associated with the fake traffic-infraction search portal. |
| DOMAIN | ticket-portal-search[.]com | Domain associated with the fake Traffic Ticket Search Portal. |
| DOMAIN | ticket-portal-violation[.]com | Domain associated with the fake traffic-violation search portal. |
| DOMAIN | ticket-portal-violations[.]com | Domain associated with the fake traffic-violation search portal. |
| DOMAIN | ticket-search-portal[.]com | Domain associated with the fake Traffic Ticket Search Portal. |
| DOMAIN | ticket-search-violation[.]com | Domain associated with the fake traffic-violation search portal. |
| DOMAIN | ticket-search-violations[.]com | Domain associated with the fake traffic-violation search portal. |
| DOMAIN | unpaid-ticket-ca[.]live | Listed as a domain indicator associated with Canadian ticket-payment phishing. |
| DOMAIN | vancouver-infraction[.]com | Listed as a domain indicator associated with traffic-infraction phishing. |
| DOMAIN | ville-montreal-pay[.]com | Phishing domain impersonating Montreal payment services. |
| DOMAIN | ville-montreal-ticket[.]live | Listed as a domain indicator associated with Montreal ticket-payment phishing. |
| HOSTNAME | canpost[.]handlingparcel[.]info | Canada Post-impersonation hostname associated with parcel-delivery phishing. |
| HOSTNAME | capost[.]handlingxpress[.]info | Canada Post-impersonation hostname associated with parcel-delivery phishing. |
| HOSTNAME | capost[.]redeliverparcel[.]info | Canada Post-impersonation hostname associated with parcel-redelivery phishing. |
| HOSTNAME | www[.]handlingpostecan1[.]com | Listed hostname associated with Canada Post parcel-delivery phishing. |
| IPV4 | 15[.]156[.]206[.]92 | Listed in the article's IP-address indicators. |
| IPV4 | 15[.]223[.]72[.]181 | Listed in the article's IP-address indicators. |
| IPV4 | 162[.]243[.]100[.]252 | IP whose domain relationships were linked to generic traffic-infraction phishing domains. |
| IPV4 | 192[.]109[.]138[.]183 | Listed in the article's IP-address indicators. |
| IPV4 | 198[.]23[.]156[.]130 | IP resolving for more than 70 websites impersonating Canada.ca traffic-ticket services. |
| IPV4 | 209[.]141[.]50[.]110 | Listed in the article's IP-address indicators. |
| IPV4 | 3[.]96[.]139[.]96 | Listed in the article's IP-address indicators. |
| IPV4 | 3[.]97[.]15[.]116 | Listed in the article's IP-address indicators. |
| IPV4 | 3[.]97[.]9[.]55 | Listed in the article's IP-address indicators. |
| IPV4 | 3[.]99[.]171[.]190 | Listed in the article's IP-address indicators. |
| IPV4 | 35[.]182[.]194[.]55 | Listed in the article's IP-address indicators. |
| IPV4 | 35[.]183[.]132[.]238 | Listed in the article's IP-address indicators. |
| IPV4 | 35[.]183[.]85[.]238 | Listed in the article's IP-address indicators. |
| IPV4 | 45[.]156[.]87[.]131 | IP in the infrastructure block hosting payment phishing kits. |
| IPV4 | 45[.]156[.]87[.]143 | IP in the infrastructure block hosting payment phishing kits. |
| IPV4 | 45[.]156[.]87[.]145 | Phishing infrastructure IP described as a central node for provincial phishing domains. |
| IPV4 | 45[.]156[.]87[.]213 | IP in the infrastructure block hosting payment phishing kits. |
| IPV4 | 99[.]79[.]60[.]130 | Listed in the article's IP-address indicators. |
MITRE ATT&CK
Countries
Australiaplatforms, webmail providers, government services, and e-commerce brands majorly targeting UK, Canada, Australia and United States.CanadaIn parallel, additional infrastructure was observed impersonating Canada Revenue Agency (CRA), Air Canada, and Canada Post, indicating a broader fraud operation that reuses common design patterns. Furthermore, theUnited KingdomUnited Statesproviders, government services, and e-commerce brands majorly targeting UK, Canada, Australia and United States.
Industries
AirlinesSector Diversification: Expanded attack surface through diversification into multiple sectors (government services, postal delivery, and airlines), which increases overall fraud exposure.Financial ServicesGovernmentto exploit this dependency by deploying highly convincing impersonation campaigns that mimic trusted government bodies and national brands. CloudSEK discovered multiple interconnected fraud clusters that abuse