This research was performed by Martijn Grooten and the research team
An important advantage of tracking malicious infrastructure compared with looking at telemetry is that we can spot phishing domains without having to know how they are being distributed.
This morning, we found the domain name nhs-covidpass-form[.]com on a bulletproof hosting network we’re tracking. The domain was registered only yesterday and hosts what looks like a Covid pass registration form for the NHS, the National Health Service in the United Kingdom.
Upon entering personal details and clicking through a number of screen, one ends up on a page where a credit card number is required to pay a £4.99 fee. Of course, there is no payment taken but the credit card number, combined with the address details filled in on the previous pages, are then used to make purchases far exceeding £4.99.
It is thus a simple credit card phishing page — not dissimilar to the USPS phishing page we wrote about last week. Indeed, that was hosted on the same bulletproof hosting service as the NHS Covid Pass phishing page and may well be operated by the same actor.
To obtain a real NHS Covid Pass — which one may need to get into nightclubs, indoor venues or maybe even tennis tournaments — one needs to go to a special NHS website. It requires a NHS login but no payment of any kind.
This wasn’t the first NHS Covid Pass phishing page we have come across and many have used the same infrastructure that we internally track as ‘Sasha’. The Silent Push API allowed us to search for many more domains by combining key words in the domain name, such as ‘covid’ or ‘nhs’, with properties that are typical of the hosting provider, such as the registrar and the nameservers.
We believe the following phishing domains — many of which have since been taken down — are all part of the same infrastructure.
List of IOC’s:
apply-mycovidpass-nhs[.]com
c19boosterjab[.]com
covid-pass802[.]com
covid-pass830[.]com
covid-pass934[.]com
covid-pass934[.]com
covid-pass953[.]com
covid-pass954[.]com
covid-pass955[.]com
covid-pass956[.]com
covid-pass957[.]com
covid-pass960[.]com
covid-pass963[.]com
covid-pass965[.]com
covid-pass966[.]com
covid-pass968[.]com
covid-pass969[.]com
covid-pass970[.]com
covid-pass971[.]com
covid-reg-53773[.]com
covid-reg-53773[.]com
covid-reg-62839[.]com
covid-reg-62845[.]com
covid-reg-62847[.]com
covid-reg-62852[.]com
covid-reg-62856[.]com
covid-reg-62859[.]com
covidbooster-jab[.]com
covidpass-nhs-apply[.]com
covidpass-nhsapply[.]com
covidpass-redeem[.]com
covidpass-signup[.]com
covidpassnhs-apply[.]com
covidpassnhsapply[.]com
getboosted-here[.]com
gov-apply-passports[.]com
gov-covid-application[.]com
gov-covid-applications[.]com
gov-covid-apply[.]com
gov-covid-form[.]com
gov-covid-forms[.]com
gov-covid-new-register[.]com
gov-covid-new[.]com
gov-covid-passport[.]com
gov-covid-register[.]com
gov-covid-registration[.]com
gov-new-passport[.]co[.]uk
gov-passports-apply[.]com
gov-passports-covid[.]com
gov-register-passport[.]com
mybooking-vacnhs[.]com
mycovidpass-nhsuk[.]com
nhs-apply-for-covid-pass[.]com
nhs-cov-pass[.]com
nhs-cov-pass[.]com
nhs-covid-applications[.]com
nhs-covid-forms[.]com
nhs-covid-pass-66547[.]com
nhs-covid-pass-66551[.]com
nhs-covid-pass-66553[.]com
nhs-covid-pass-66554[.]com
nhs-covid-pass-66555[.]com
nhs-covid-pass-66558[.]com
nhs-covid-pass-66561[.]com
nhs-covid-pass-66564[.]com
nhs-covid-pass-66565[.]com
nhs-covid-pass-66568[.]com
nhs-covid-pass-66569[.]com
nhs-covid-pass-71635[.]com
nhs-covid-pass-71645[.]com
nhs-covid-pass-71649[.]com
nhs-covid-pass-71651[.]com
nhs-covid-pass-71653[.]com
nhs-covid-pass-71656[.]com
nhs-covid-pass-71658[.]com
nhs-covid-pass-71659[.]com
nhs-covid-pass-71661[.]com
nhs-covid-pass-71663[.]com
nhs-covid-pass-71664[.]com
nhs-covid-pass-71666[.]com
nhs-covid-pass-71667[.]com
nhs-covid-pass-71669[.]com
nhs-covid-pass-71671[.]com
nhs-covid-pass-apply[.]com
nhs-covid-pass-form[.]com
nhs-covid-pass-register[.]com
nhs-covid-passports[.]com
nhs-covid-register[.]com
nhs-covid-verify[.]com
nhs-covid19-vaccine[.]com
nhs-covidapplication[.]com
nhs-covidpass-form[.]com
nhs-new-passport[.]com
nhs-register-covid-pass[.]com
nhs-register-pass-covid[.]com
nhs-register-passport[.]com
nhs-register-passports[.]com
nhscovidpassapply[.]com
