Abusing the #Coronavirus & #COVID19outbreak, another phishing site emerges trying to collect bank login details of India citizens 
The site incometaxefilingsindia[.]in was registered today 28/04/2020 with domain registrar @openprovider
The abuser has hosted the site on server with IP 45.87.81[.]14 which belongs to @HostingerCOM.
It also has another lookalike phishing site incometaxefilingindia[.]in
& registered legit looking sites & hosted them on same server. Of course, can't be established if owner is same.
It also has another lookalike phishing site incometaxefilingindia[.]in
& registered legit looking sites & hosted them on same server. Of course, can't be established if owner is same.
The phishing site has official logo of @IncomeTaxIndia & image of @narendramodi @PMOIndia.
It starts with collecting personal details & upload of copies of govt issued sensitive documents like PAN, Aadhaar & passport
It starts with collecting personal details & upload of copies of govt issued sensitive documents like PAN, Aadhaar & passport
The last tab is to collect the bank login details.
After submitting info, document copies & bank details, it then goes on to say the Verification is PENDING. Asking users to download an Android app to verify the documents. At this moment, user has already submitted bank login details.
If bank has not enabled additional verification or OTP then the user would definitely lose his money.
Now the APK file is hosted on a shared web hosting provider https[:]//filetransfer.io/premium?_fid=3bc8 and I could no longer download the file, to check and disassemble.
Now the APK file is hosted on a shared web hosting provider https[:]//filetransfer.io/premium?_fid=3bc8 and I could no longer download the file, to check and disassemble.
The criminal also has a very helpful video guiding the user on how to download and operate the app.
Already sent emails to abuse contacts of @openprovider @HostingerCOM & registrar[.]eu.
Also copied @IndianCERT & @IncomeTaxIndia. Not sure how many days or weeks would it take to bring the phishing site down.
Also copied @IndianCERT & @IncomeTaxIndia. Not sure how many days or weeks would it take to bring the phishing site down.
Reported the phishing site to Google's Safe browsing site safebrowsing.google.com/safebrowsing/r… Which is used by both @firefox & @googlechrome. Hope they take action & block at the browser level itself.
Got response from @openprovider the domain registrar. They say my email complaint has been forwarded to the domain owner asking him to take action.
And either the hosting provider @HostingerCOM or the phishing site owner himself has removed the A entries for the site.
@HostingerCOM confirmed to me that the abusive account has been suspended.
