Researchers Link Multilingual Asian Phishing Sites Through Shared Delivery Toolkit
Summary
Hunt.io researchers linked 28 Chinese-, English-, and Japanese-language phishing pages across three clusters, finding shared templates, scripts, hosting patterns, and ZIP/RAR lures themed around government, tax, and financial documents.
Key points
- Researchers identified 28 pages in three clusters: 12 Chinese-language, 12 English-language, and four Japanese-language pages.
- Shared page titles, design, scripts, and naming conventions suggest reuse of a common phishing toolkit or centralized builder.
- Pages use scripts such as download.php and visitor_log.php to manage downloads and log visitor activity; the article says visitor data collection is likely.
- ZIP, RAR, and other archive lures impersonate tax, payroll, financial, and government documents to prompt downloads.
- The infrastructure spans multiple domains and shared hosting, with clusters targeting audiences across East and Southeast Asia.
- The article recommends blocking identified domains, monitoring for related endpoints, inspecting archive attachments, and limiting execution of downloaded files.
Article Details
- Attack Vectors
- Multilingual phishing pages use government, payroll, tax, and financial-document lures to prompt users to download ZIP/RAR archives.
- Pages dynamically expose download links when a valid payload is available; shared scripts include download.php and visitor_log.php.
- The article reports that victims may manually execute downloaded archives containing staged malware droppers.
- Defensive Notes
- Block the discovered malicious domains and monitor for newly observed phishing pages using similar naming patterns.
- Monitor outbound HTTP requests to suspicious download.php and visitor_log.php endpoints.
- Configure mail gateways to flag ZIP/RAR attachments with HR, tax, or finance-themed filenames; sanitize archives before access.
- Limit execution of scripts and compressed files from email attachments or browsers, and educate users about fake official-document downloads.
- Use Hunt.io datasets to query for newly observed phishing pages and infrastructure reuse.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gjqygs[.]cn | Phishing domain identified as the English cluster's command-and-control/central hosting node. |
| DOMAIN | jpjpz1[.]cc | Phishing domain used to host Japanese-language lures. |
| DOMAIN | jppjp[.]vip | Listed as a domain in the campaign's cross-cluster infrastructure inventory. |
| DOMAIN | zcqiyess[.]vip | Identified among domains hosting the English-cluster campaign pages. |
| DOMAIN | zxp0010w[.]vip | Phishing domain used to host Chinese-language lures. |
| IPV4 | 38[.]54[.]17[.]167 | Hosting IP associated with the English-cluster phishing domain gjqygs[.]cn. |
| IPV4 | 38[.]54[.]50[.]212 | Hosting IP associated with the Japanese-cluster phishing domain jpjpz1[.]cc. |
| IPV4 | 38[.]54[.]88[.]44 | Hosting IP associated with the Chinese-cluster phishing domain zxp0010w[.]vip. |
| URL | hxxp[:]//199cb150cec25af3132ddd4e47b37248[.]ttcskhdl[.]lol | Campaign-listed phishing page delivering a tax-return archive lure. |
| URL | hxxp[:]//27160fcce1e199401dde5e01ce829006[.]ttcskhdl[.]lol | Campaign-listed phishing page delivering a tax-return archive lure. |
| URL | hxxp[:]//3381536ffe13739277b0a87c08a66596[.]bulinouui[.]sbs | Campaign-listed phishing page delivering a document-themed archive lure. |
| URL | hxxp[:]//53d9da1f7632f687dde3b0ec4df00710[.]bulinouui[.]sbs | Campaign-listed phishing page delivering a document-themed archive lure. |
| URL | hxxp[:]//twmm[.]shop | Campaign-listed page serving a notification-letter archive lure. |
| URL | hxxp[:]//twswzz[.]icu | Campaign-listed page serving a business-registration archive lure. |
| URL | hxxp[:]//twswzz[.]xin | Campaign-listed page serving a financial-confirmation archive lure. |
| URL | hxxp[:]//www[.]wojkejys[.]lat | Campaign-listed phishing page delivering a tax-compliance archive lure. |
| URL | hxxps[:]//11c979baeb8bddc12e79ad4def0964e94[.]bulinouui[.]sbs | Campaign-listed phishing page delivering a tax-penalty archive lure. |
| URL | hxxps[:]//5289c03d6d33ac4cf474de436f6bbf47[.]bulinouui[.]sbs | Campaign-listed phishing page delivering a document-themed archive lure. |
| URL | hxxps[:]//6358bdf15f655e7e305eacaf385cd12[.]bulinouui[.]sbs/?1d794ebf8cc16e0770adc215e34d26a0 | Campaign-listed phishing URL delivering a document-themed archive lure. |
| URL | hxxps[:]//cq1tw[.]icu/index.html | Campaign-listed page serving an application-platform archive lure. |
| URL | hxxps[:]//cq1tw[.]top/index.html | Campaign-listed page serving a regulatory-document archive lure. |
| URL | hxxps[:]//jpjpz1[.]top/index.html | Campaign-listed Japanese-language page serving a salary-revision archive lure. |
| URL | hxxps[:]//jpjpz1[.]vip | Campaign-listed Japanese-language page serving a tax-review archive lure. |
| URL | hxxps[:]//qiqi1[.]xin/index.html | Campaign-listed page serving a Hong Kong financial-regulations archive lure. |
| URL | hxxps[:]//twsw[.]cc/download.html | Campaign-listed page serving a tax-invoice archive lure. |
| URL | hxxps[:]//twsww[.]xin/index.html | Campaign-listed Japanese-language page serving a salary-system archive lure. |
| URL | hxxps[:]//vip[.]gaelh[.]cn | Campaign-listed phishing page delivering a tax-filing archive lure. |
| URL | hxxps[:]//www[.]bulinouui[.]sbs | Campaign-listed phishing page delivering a tax-return archive lure. |
| URL | hxxps[:]//xinwenwamg[.]net/index.html | Campaign-listed Chinese-language landing page. |
| URL | hxxps[:]//z2tw[.]vip/index.html | Campaign-listed page serving an import/export declaration archive lure. |
| URL | hxxps[:]//z2tw[.]xin | Campaign-listed page serving an attached-documents archive lure. |
MITRE ATT&CK
Threat Actors
Malware
GobRATflagged in threat intelligence sources with one warning linked to the "Bulbature, beneath the waves of GobRAT" campaign.HoldingHandsIn early 2025, FortiGuard Labs documented a coordinated, multi-stage campaign that evolved from the deployment of Winos 4.0 in Taiwan to the distribution of the HoldingHands malware family across East and Southeast Asia.Winos 4.0In early 2025, FortiGuard Labs documented a coordinated, multi-stage campaign that evolved from the deployment of Winos 4.0 in Taiwan to the distribution of the HoldingHands malware family across East and Southeast Asia.
Tools
Countries
Cambodiaacross Thailand (38.54.32[.]84, 38.54.118[.]238), Hong Kong (38.54.85[.]164, 38.60.203[.]174), Cambodia (38.54.93[.]14, 38.54.93[.]63), and the United States (38.60.162[.]151).ChinaShift from localized to multinational targeting, expanding from Taiwan, Indonesia, and China to Japan and Southeast Asia.Hong Kongfollowed by Japanese, which strongly suggests an organized operation targeting users across Taiwan, Hong Kong, and Japan.IndonesiaShift from localized to multinational targeting, expanding from Taiwan, Indonesia, and China to Japan and Southeast Asia.JapanShift from localized to multinational targeting, expanding from Taiwan, Indonesia, and China to Japan and Southeast Asia.Malaysiaextending from Mainland China (March 2024) to Taiwan and Japan (January-March 2025), and most recently, Malaysia. The campaigns relied on fake government or corporate documents such as tax regulations, salarySingaporewhich, according to Hunt.io, is hosted by Kaopu Cloud HK Limited under ASN AS138915, and is located in Singapore. The host exposes multiple open services, including SSH (port 22) running OpenBSD OpenSSH 8.9p1 onTaiwanShift from localized to multinational targeting, expanding from Taiwan, Indonesia, and China to Japan and Southeast Asia.ThailandThese related IPs are distributed across Thailand (38.54.32[.]84, 38.54.118[.]238), Hong Kong (38.54.85[.]164, 38.60.203[.]174), Cambodia (38.54.93[.]14,United StatesHong Kong (38.54.85[.]164, 38.60.203[.]174), Cambodia (38.54.93[.]14, 38.54.93[.]63), and the United States (38.60.162[.]151).