Armenian national postal operator HayPost warns of scammers
YEREVAN, Feb. 21. /ARKA/. Scammers have recently become active in the online space, using various free classifieds pages, such as List.am, as well as mailing platforms, to try to get hold of people's personal banking data, Armenia’s national postal operator HayPost said.
According to the operator, they received a report that attempts were being made to lure people's banking data by manipulating its and other well-known companies’ names and brands.
HayPost said it has nothing to do with these reports and urged citizens to refrain from giving strangers passwords, phone numbers, passport numbers and other personal data registered on the online pages, and in no case provide banking data.
Media expert Artur Papyan said on his Facebook page that they had studied three e-mails sent to Yahoo Mail users. He drew attention to the fact that the email addresses, from which they were sent, were changed:
haypostestablished15[@]hayarmeniapsoat[.]com
haypostestablished27[@]hayarmeniapsoat[.]com
haypostestablished45[@]hayarmeniapsoat[.]com
Papian stated that these emails are classic phishing:
- your parcel cannot be delivered on 10.02.2022 because customs payments have not been paid 10.2;
- click here (hxxps://haypost[.]ddns[.]net/Checkout/) to confirm delivery of the parcel.
The expert said that the link directs the user to the DDNS[.]net space, which is a free dynamic DNS service that allows quick redirection from one IP to another if, for example, one of the servers goes down or is attacked. In his opinion, this suggests that the scammers intend to continue the attack.
"The page that opens is a form for collecting data of electronic payment cards. There are Spanish traces in the code, such as "En la Tienda Online de Correos tenemos todo para hacer tus envíos: cajas, sobres, sellos, embalajes... regalos, coleccionismo y productos solidarios," from which it is clear that the scammers used some elements of the ready-made template of the correos[.]es website," he said.
According to another media expert Ruben Muradyan, there was probably a mass leak of emails from somewhere. "The mailing is massive. I keep repeating my question - where did the intruders get the current database of Armenian addresses?" he wondered. -0-