Hunt.io Traces Smishing Campaign Targeting Services in 19 Countries
Summary
Hunt.io traced a multi-country smishing campaign using 1,628 URLs to impersonate government, postal, telecom, and other services. Fake payment pages harvest card details; shared page fingerprints link the infrastructure.
Key points
- Hunt.io identified 1,628 campaign-linked URLs targeting organizations and services across 19 countries in Europe, the Americas, and the Caucasus.
- Lures impersonate government payment and traffic-fine portals, delivery services, telecoms, and other brands.
- The phishing flow collects vehicle-registration details, invents fines or payment demands, then harvests cardholder names, card numbers, expiration dates, and CVVs.
- Researchers linked the pages using a shared 128-character metadata identifier and matching JavaScript assets; the operation used two distinct phishing templates.
- The mapped infrastructure included 32 backend IP addresses across Tencent Cloud, Alibaba Cloud, Cloudflare, and ALEXHOST.
- The campaign was still active at the time of analysis; Hunt.io recommends monitoring the shared identifier and typosquatted domains, and warns users not to follow payment demands sent by SMS.
Article Details
- Attack Vectors
- Fraudulent SMS messages direct recipients to phishing sites impersonating government payment portals, road-police services, parcel-delivery companies, telecommunications providers, and other services.
- The Romanian traffic-fine site requests a vehicle registration number, displays a fabricated fine with an urgent payment deadline, and collects the cardholder name, card number, expiration date, and CVV.
- After card submission, a fake loading screen creates the appearance of payment processing while, according to the investigation, the card details are transmitted to attacker infrastructure.
- The operators use lookalike and typosquatted domains. Most identified sites use a shared Vue.js phishing template; one Romanian toll-payment site uses a different, Bootstrap-based template.
- Defensive Notes
- Check the full URL against the service's official domain before entering information; copied branding and SSL-related claims do not establish legitimacy.
- Treat SMS payment demands for fines or tolls that link to a website as suspicious. GhiÈeul.ro states that it does not announce payment obligations by SMS or email.
- Security teams can search page HTML for the 128-character metadata identifier documented in the article to find sites in the reported cluster.
- Organizations whose brands are impersonated should monitor lookalike domain registrations, including registrations under .lat, .shop, .cyou, .bond, .sbs, and .cfd.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dpd-lv[.]top | Phishing domain using DPD delivery branding in the Latvia-targeted examples. |
| DOMAIN | dpd[.]ie-com[.]vip | Phishing domain impersonating DPD delivery service in Ireland. |
| DOMAIN | dpde[.]lat | Phishing domain using DPD delivery branding in the Latvia-targeted examples. |
| DOMAIN | dpdlv[.]bond | Phishing domain using DPD delivery branding in the Latvia-targeted examples. |
| DOMAIN | dsvag[.]sbs | DSV-branded delivery or logistics phishing domain in the English-language examples. |
| DOMAIN | dsvav[.]cfd | DSV-branded delivery or logistics phishing domain in the English-language examples. |
| DOMAIN | dsvcv[.]cfd | DSV-branded delivery or logistics phishing domain in the English-language examples. |
| DOMAIN | dsvxk[.]cyou | DSV-branded delivery or logistics phishing domain in the English-language examples. |
| DOMAIN | e-csddlv[.]top | Phishing domain impersonating Latvian road-traffic services. |
| DOMAIN | fanveris[.]cyou | Phishing domain listed among the Spain-targeted campaign examples. |
| DOMAIN | gobal-store-hub[.]shop | Domain listed as part of the campaign's generic e-commerce phishing examples. |
| DOMAIN | gov-si[.]cam | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | gov-si[.]qpon | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | gov-si[.]sbs | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | gov-si[.]xin | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | gove[.]lat | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | govh[.]lat | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | govj[.]lat | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | govk[.]lat | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | govl[.]lat | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | govo[.]lat | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | govsi[.]bar | Phishing domain impersonating Slovenia's e-Uprava. |
| DOMAIN | mvr-gov-mk[.]cyou | Phishing domain impersonating North Macedonia's MVR. |
| DOMAIN | mvr[.]lat | Phishing domain impersonating Bulgarian MVR traffic-fine services. |
| DOMAIN | mvrbg[.]ink | Phishing domain impersonating Bulgarian MVR traffic-fine services. |
| DOMAIN | mvrbg[.]life | Phishing domain impersonating Bulgarian MVR traffic-fine services. |
| DOMAIN | mvrbg[.]sbs | Phishing domain impersonating Bulgarian MVR traffic-fine services. |
| DOMAIN | mvrcc[.]lat | Phishing domain impersonating Bulgarian MVR traffic-fine services. |
| DOMAIN | mvri[.]lat | Phishing domain impersonating Bulgarian MVR traffic-fine services. |
| DOMAIN | mvrx[.]lat | Phishing domain impersonating Bulgarian MVR traffic-fine services. |
| DOMAIN | roadpolice-am[.]icu | Phishing domain impersonating Armenian Road Police services. |
| DOMAIN | roadpolice-am[.]shop | Phishing domain impersonating Armenian Road Police services. |
| DOMAIN | roadspolice[.]lat | Phishing domain impersonating Armenian Road Police services. |
| DOMAIN | seur-bcdef[.]cc | Phishing domain impersonating SEUR. |
| DOMAIN | seur-cztwp[.]club | Phishing domain impersonating SEUR. |
| DOMAIN | seur-fghij[.]org | Phishing domain impersonating SEUR. |
| DOMAIN | seur-fqlap[.]cyou | Phishing domain impersonating SEUR. |
| DOMAIN | seur-hijkl[.]cc | Phishing domain impersonating SEUR. |
| DOMAIN | seur-hxrz[.]org | Phishing domain impersonating SEUR. |
| DOMAIN | seur-jwqec[.]link | Phishing domain impersonating SEUR. |
| DOMAIN | seur-rmvxq[.]club | Phishing domain impersonating Spanish parcel-delivery service SEUR. |
| DOMAIN | seur-rxkmd[.]cyou | Phishing domain impersonating SEUR. |
| DOMAIN | seur-yzabc[.]com | Phishing domain impersonating SEUR. |
| DOMAIN | seur-zkryw[.]cloud | Phishing domain impersonating SEUR. |
| DOMAIN | tesco-redeem-check[.]bond | Phishing domain impersonating Tesco rewards in the United Kingdom. |
| DOMAIN | vodafaone[.]shop | Phishing domain impersonating Vodafone in Albania. |
| DOMAIN | worldmartonline[.]com | Domain listed as part of the campaign's generic e-commerce phishing examples. |
| HOSTNAME | e-uprava[.]gov-si[.]shop | Phishing hostname impersonating Slovenia's e-Uprava. |
| HOSTNAME | e[.]csdd[.]govlv[.]cam | Phishing hostname impersonating Latvian road-traffic services. |
| HOSTNAME | hoiatustrahv[.]politsei[.]gov-ee[.]bond | Phishing hostname impersonating Estonian road-traffic or police services. |
| HOSTNAME | mvr[.]govmk[.]cam | Phishing hostname impersonating North Macedonia's MVR. |
| HOSTNAME | mvr[.]govmk[.]one | Phishing hostname impersonating North Macedonia's MVR. |
| HOSTNAME | sumin[.]lrv-lt[.]shop | Phishing hostname impersonating Lithuanian government services. |
| IPV4 | 43[.]153[.]72[.]244 | Tencent Cloud server in Santa Clara identified as hosting 72 domains in the reported infrastructure. |
| IPV4 | 43[.]157[.]122[.]50 | Tencent Cloud server identified in the phishing infrastructure's Frankfurt deployment. |
| IPV4 | 43[.]157[.]17[.]77 | Tencent Cloud server identified as a high-capacity phishing-infrastructure hub. |
| IPV4 | 43[.]157[.]25[.]170 | Tencent Cloud server identified as a high-capacity phishing-infrastructure hub. |
| IPV4 | 43[.]157[.]64[.]211 | Tencent Cloud server identified in the phishing infrastructure's Frankfurt deployment. |
| IPV4 | 43[.]157[.]91[.]129 | Tencent Cloud server identified in the phishing infrastructure's Frankfurt deployment. |
| IPV4 | 43[.]160[.]221[.]174 | Tencent Cloud server identified in the phishing infrastructure's Singapore deployment. |
| IPV4 | 43[.]160[.]242[.]3 | Tencent Cloud server identified in the phishing infrastructure's Singapore deployment. |
| IPV4 | 43[.]160[.]250[.]19 | Tencent Cloud server in the phishing infrastructure; the report says it hosts 25 domains. |
| IPV4 | 43[.]165[.]1[.]208 | Tencent Cloud server in the phishing infrastructure; the report says it serves nine domains. |
| IPV4 | 43[.]165[.]3[.]200 | Tencent Cloud server identified in the phishing infrastructure's Frankfurt deployment. |
| IPV4 | 43[.]165[.]4[.]234 | Tencent Cloud server identified in the phishing infrastructure's Frankfurt deployment. |
| IPV4 | 43[.]165[.]4[.]68 | Tencent Cloud server identified in the phishing infrastructure's Frankfurt deployment. |
| IPV4 | 43[.]165[.]62[.]39 | Tencent Cloud server identified in the phishing infrastructure's Frankfurt deployment. |
| IPV4 | 43[.]173[.]74[.]207 | Tencent Cloud server identified in the phishing infrastructure's Santa Clara deployment. |
| IPV4 | 47[.]245[.]142[.]76 | Alibaba Cloud server in Frankfurt identified as hosting phishing domains. |
| IPV4 | 47[.]254[.]147[.]205 | Alibaba Cloud server in Frankfurt identified as hosting phishing domains. |
| IPV4 | 47[.]91[.]88[.]57 | Alibaba Cloud server in Frankfurt identified as hosting phishing domains. |
| IPV4 | 80[.]96[.]58[.]119 | ALEXHOST server in Moldova identified as part of the phishing infrastructure. |
| IPV4 | 80[.]96[.]58[.]68 | ALEXHOST server in Moldova identified as part of the phishing infrastructure. |
| URL | hxxp[:]//ghisaul[.]lat/ro | Typosquatted Romanian phishing URL sharing the campaign's JavaScript asset. |
| URL | hxxp[:]//ghiseul-ro[.]cyou/ | Fraudulent URL impersonating GhiÈeul.ro. |
| URL | hxxp[:]//ghiseul-ro[.]sbs/ | Fraudulent URL impersonating GhiÈeul.ro found in the crawler results. |
| URL | hxxp[:]//ghiseul-ro[.]shop/ | Fraudulent URL impersonating GhiÈeul.ro found in the crawler results. |
| URL | hxxp[:]//ghiseul[.]cfd/pay | Fraudulent GhiÈeul.ro-themed payment URL. |
| URL | hxxp[:]//ghiseul[.]eu[.]cc/pay | GhiÈeul.ro-impersonating URL using the distinct toll-payment phishing template. |
| URL | hxxps[:]//ghiseal[.]lat/ro/ | Typosquatted Romanian phishing URL sharing the campaign's JavaScript asset. |
| URL | hxxps[:]//ghiseal[.]lat/ro/#/index | Romanian traffic-fine phishing page that collects vehicle details and leads to card collection. |
| URL | hxxps[:]//ghiseul[.]autos/ro/ | Fraudulent Romanian-language URL impersonating GhiÈeul.ro. |
| URL | hxxps[:]//ghiseul[.]cyou/pay | Fraudulent GhiÈeul.ro-themed payment URL. |
| URL | hxxps[:]//ghisiul[.]lat/ro/ | Typosquatted Romanian phishing URL sharing the campaign's JavaScript asset. |
| URL | hxxps[:]//ghizeul[.]lat/ro/ | Typosquatted Romanian phishing URL sharing the campaign's JavaScript asset. |
| URL | hxxps[:]//www[.]ghiseul-ro[.]bond/ghiseul/public/ | Fraudulent URL mimicking the GhiÈeul.ro portal path. |
| URL | hxxps[:]//www[.]ghiseul-ro[.]cfd/ghiseul/public/ | Fraudulent URL mimicking the GhiÈeul.ro portal path. |
| URL | hxxps[:]//www[.]ghiseul[.]govro[.]one/ghiseul/public/ | Fraudulent URL mimicking the GhiÈeul.ro portal path. |
| URL | hxxps[:]//www[.]ghiseulro[.]cyou/ro/ | Fraudulent URL impersonating GhiÈeul.ro. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe shared phishing template contains hundreds of meaningless HTML spans with randomly generated attributes that the report says are designed to defeat signature-based detection.T1566.002 · Spearphishing LinkFraudulent SMS messages impersonate services and direct recipients to linked phishing sites.T1583.001 · DomainsThe report says the operators continually register new lookalike domains for phishing sites.T1656 · ImpersonationPhishing pages copy the branding and interfaces of government portals, delivery services, and other organizations.
Vendors
AlexHost32 backend IP addresses spanning 6 geographic regions, with infrastructure distributed across Tencent Cloud (15 IPs), Alibaba Cloud (3 IPs), Cloudflare CDN (14 IPs), and ALEXHOST in Moldova (2 IPs).Alibaba Cloud32 backend IP addresses spanning 6 geographic regions, with infrastructure distributed across Tencent Cloud (15 IPs), Alibaba Cloud (3 IPs), Cloudflare CDN (14 IPs), and ALEXHOST in Moldova (2 IPs).Cloudflare32 backend IP addresses spanning 6 geographic regions, with infrastructure distributed across Tencent Cloud (15 IPs), Alibaba Cloud (3 IPs), Cloudflare CDN (14 IPs), and ALEXHOST in Moldova (2 IPs).DynadotThis campaign registers new domains continuously and Dynadot is the registrar of choice.Tencent Cloud32 backend IP addresses spanning 6 geographic regions, with infrastructure distributed across Tencent Cloud (15 IPs), Alibaba Cloud (3 IPs), Cloudflare CDN (14 IPs), and ALEXHOST in Moldova (2 IPs).
Products
e-UpravaGovernment Payment Portals GhiÈeul.ro (National Payment System), e-Uprava (e-Government Portal) Romania, Slovenia 22Hunt.ioOur investigation, using Hunt.io's crawler database and IP intelligence, traced that single impersonation campaign to a coordinated smishing operation spanning 19 countries across Europe, the Americas, and the Caucasus.
Tools
Countries
AlbaniaIreland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (United States, Trinidad & Tobago), and the Caucasus (Georgia,Armeniawas also targeting DPD delivery customers in the UK and Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States.Bulgariataxpayers was also targeting DPD delivery customers in the UK and Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States.EstoniaUnited Kingdom, Ireland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (United States, Trinidad & Tobago), and the CaucasusFranceTargeted countries span three regions: Europe (Romania, United Kingdom, Ireland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (UnitedGeorgiaAlbania, Kosovo, Montenegro), the Americas (United States, Trinidad & Tobago), and the Caucasus (Georgia, Armenia).Germanyprimary provider, with 15 servers across Singapore (43.160.242[.]3, 43.160.221[.]174, 43.160.250[.]19), Germany/Frankfurt (43.157.17[.]77, 43.157.122[.]50, 43.157.64[.]211, 43.165.4[.]234, 43.157.25[.]170,Greecedelivery customers in the UK and Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States.Irelandsame infrastructure hitting Romanian taxpayers was also targeting DPD delivery customers in the UK and Ireland, road police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the UnitedKosovoIreland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (United States, Trinidad & Tobago), and the Caucasus (Georgia, Armenia).Latviaspan three regions: Europe (Romania, United Kingdom, Ireland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (United States,Lithuania(Romania, United Kingdom, Ireland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (United States, Trinidad & Tobago), and theMoldova32 backend IP addresses spanning 6 geographic regions, with infrastructure distributed across Tencent Cloud (15 IPs), Alibaba Cloud (3 IPs), Cloudflare CDN (14 IPs), and ALEXHOST in Moldova (2 IPs).MontenegroFrance, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (United States, Trinidad & Tobago), and the Caucasus (Georgia, Armenia).North MacedoniaEurope (Romania, United Kingdom, Ireland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (United States, Trinidad & Tobago),RomaniaIn May 2026, Romania's official government payment portal GhiÈeul.ro posted a public security warning after citizens began reporting fraudulent SMS messages impersonating the platform. That warning pointed to somethingSingaporeTencent is the primary provider, with 15 servers across Singapore (43.160.242[.]3, 43.160.221[.]174, 43.160.250[.]19), Germany/Frankfurt (43.157.17[.]77, 43.157.122[.]50, 43.157.64[.]211, 43.165.4[.]234,SloveniaTargeted countries span three regions: Europe (Romania, United Kingdom, Ireland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (UnitedSpainTargeted countries span three regions: Europe (Romania, United Kingdom, Ireland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (UnitedTrinidad & TobagoNorth Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (United States, Trinidad & Tobago), and the Caucasus (Georgia, Armenia).United KingdomTargeted countries span three regions: Europe (Romania, United Kingdom, Ireland, Spain, France, Bulgaria, Slovenia, Latvia, Greece, North Macedonia, Lithuania, Estonia, Albania, Kosovo, Montenegro), the Americas (UnitedUnited Statesroad police portals in Bulgaria and Armenia, tax authorities in Greece, and T-Mobile users in the United States.
Industries
BankingGeorgia TBC Pay (Banking/Fines) 5E-commerceE-commerce Platforms Generic shopping platforms Generic / Multi-region 2GovernmentIn May 2026, Romania's official government payment portal GhiÈeul.ro posted a public security warning after citizens began reporting fraudulent SMS messages impersonating the platform. That warning pointed to somethinglogisticsParcel Delivery Services SEUR (Spain courier), DPD (international parcel), DSV (logistics) Spain, Latvia, Ireland, English-speaking regions 84Postal and parcel deliveryRetailRetail / Loyalty Programs Tesco (rewards) United Kingdom 1TelecommunicationsTelecommunications Vodafone Albania 1