Credit card phishing using NHS Covid Pass as a lure

screenshot of the NHS Covid Pass user login webpage

This research was performed by Martijn Grooten and the research team

An important advantage of tracking malicious infrastructure compared with looking at telemetry is that we can spot phishing domains without having to know how they are being distributed.

This morning, we found the domain name nhs-covidpass-form[.]com on a bulletproof hosting network we’re tracking. The domain was registered only yesterday and hosts what looks like a Covid pass registration form for the NHS, the National Health Service in the United Kingdom.

Upon entering personal details and clicking through a number of screen, one ends up on a page where a credit card number is required to pay a £4.99 fee. Of course, there is no payment taken but the credit card number, combined with the address details filled in on the previous pages, are then used to make purchases far exceeding £4.99.

It is thus a simple credit card phishing page — not dissimilar to the USPS phishing page we wrote about last week. Indeed, that was hosted on the same bulletproof hosting service as the NHS Covid Pass phishing page and may well be operated by the same actor.

To obtain a real NHS Covid Pass — which one may need to get into nightclubs, indoor venues or maybe even tennis tournaments — one needs to go to a special NHS website. It requires a NHS login but no payment of any kind.

This wasn’t the first NHS Covid Pass phishing page we have come across and many have used the same infrastructure that we internally track as ‘Sasha’. The Silent Push API allowed us to search for many more domains by combining key words in the domain name, such as ‘covid’ or ‘nhs’, with properties that are typical of the hosting provider, such as the registrar and the nameservers.

We believe the following phishing domains — many of which have since been taken down — are all part of the same infrastructure.

List of IOC’s:

apply-mycovidpass-nhs[.]com

c19boosterjab[.]com

covid-pass802[.]com

covid-pass830[.]com

covid-pass934[.]com

covid-pass934[.]com

covid-pass953[.]com

covid-pass954[.]com

covid-pass955[.]com

covid-pass956[.]com

covid-pass957[.]com

covid-pass960[.]com

covid-pass963[.]com

covid-pass965[.]com

covid-pass966[.]com

covid-pass968[.]com

covid-pass969[.]com

covid-pass970[.]com

covid-pass971[.]com

covid-reg-53773[.]com

covid-reg-53773[.]com

covid-reg-62839[.]com

covid-reg-62845[.]com

covid-reg-62847[.]com

covid-reg-62852[.]com

covid-reg-62856[.]com

covid-reg-62859[.]com

covidbooster-jab[.]com

covidpass-nhs-apply[.]com

covidpass-nhsapply[.]com

covidpass-redeem[.]com

covidpass-signup[.]com

covidpassnhs-apply[.]com

covidpassnhsapply[.]com

getboosted-here[.]com

gov-apply-passports[.]com

gov-covid-application[.]com

gov-covid-applications[.]com

gov-covid-apply[.]com

gov-covid-form[.]com

gov-covid-forms[.]com

gov-covid-new-register[.]com

gov-covid-new[.]com

gov-covid-passport[.]com

gov-covid-register[.]com

gov-covid-registration[.]com

gov-new-passport[.]co[.]uk

gov-passports-apply[.]com

gov-passports-covid[.]com

gov-register-passport[.]com

mybooking-vacnhs[.]com

mycovidpass-nhsuk[.]com

nhs-apply-for-covid-pass[.]com

nhs-cov-pass[.]com

nhs-cov-pass[.]com

nhs-covid-applications[.]com

nhs-covid-forms[.]com

nhs-covid-pass-66547[.]com

nhs-covid-pass-66551[.]com

nhs-covid-pass-66553[.]com

nhs-covid-pass-66554[.]com

nhs-covid-pass-66555[.]com

nhs-covid-pass-66558[.]com

nhs-covid-pass-66561[.]com

nhs-covid-pass-66564[.]com

nhs-covid-pass-66565[.]com

nhs-covid-pass-66568[.]com

nhs-covid-pass-66569[.]com

nhs-covid-pass-71635[.]com

nhs-covid-pass-71645[.]com

nhs-covid-pass-71649[.]com

nhs-covid-pass-71651[.]com

nhs-covid-pass-71653[.]com

nhs-covid-pass-71656[.]com

nhs-covid-pass-71658[.]com

nhs-covid-pass-71659[.]com

nhs-covid-pass-71661[.]com

nhs-covid-pass-71663[.]com

nhs-covid-pass-71664[.]com

nhs-covid-pass-71666[.]com

nhs-covid-pass-71667[.]com

nhs-covid-pass-71669[.]com

nhs-covid-pass-71671[.]com

nhs-covid-pass-apply[.]com

nhs-covid-pass-form[.]com

nhs-covid-pass-register[.]com

nhs-covid-passports[.]com

nhs-covid-register[.]com

nhs-covid-verify[.]com

nhs-covid19-vaccine[.]com

nhs-covidapplication[.]com

nhs-covidpass-form[.]com

nhs-new-passport[.]com

nhs-register-covid-pass[.]com

nhs-register-pass-covid[.]com

nhs-register-passport[.]com

nhs-register-passports[.]com

nhscovidpassapply[.]com