CampaignPublished 11 May 2022Updated 13 May 2022

Phishing La Banque Postale · Lookyloo Capture (http://one.doesntexist.com/p/b2ba4)

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Phishing La Banque Postale - Lookyloo Capture (http://one.doesntexist.com/p/b2ba4)

Impact

The primary impact of this phishing campaign is the compromise of user credentials and sensitive personal or financial information, which can lead to unauthorized access to bank accounts, fraudulent transactions, identity theft, and financial loss. For European organizations, especially financial institutions and their customers, this undermines trust and can result in regulatory scrutiny under GDPR for failure to protect customer data. The campaign’s focus on La Banque Postale suggests a high impact on French customers, but similar phishing tactics could be adapted to other banks across Europe. The low technical complexity of phishing means it can be widely distributed, potentially affecting a large number of users. The financial sector’s critical role in Europe’s economy and the high value of banking credentials amplify the threat’s significance. Additionally, successful phishing can serve as an initial access vector for more advanced attacks, including fraud and account takeover. The reputational damage to targeted banks and the increased operational costs for incident response and remediation also represent significant impacts.

Defensive guidance

To mitigate this phishing threat, organizations should implement multi-layered defenses beyond generic advice: 1) Deploy advanced email filtering solutions with machine learning capabilities to detect and quarantine phishing emails targeting banking customers. 2) Conduct targeted user awareness campaigns focusing on recognizing phishing attempts specific to La Banque Postale and similar institutions, including training on verifying URLs and avoiding suspicious links. 3) Monitor and take down phishing domains and URLs rapidly by collaborating with hosting providers and law enforcement. 4) Implement strong multi-factor authentication (MFA) for online banking access to reduce the risk of compromised credentials being abused. 5) Use domain-based message authentication, reporting, and conformance (DMARC) policies to prevent email spoofing of the bank’s domain. 6) Continuously monitor for Lookyloo captures or similar tools being abused to replicate legitimate sites and proactively block such content. 7) Encourage customers to report suspected phishing attempts promptly and provide clear guidance on safe online banking practices. 8) Employ behavioral analytics on banking platforms to detect anomalous login patterns indicative of compromised credentials. These measures collectively reduce the likelihood and impact of phishing attacks.

Indicators of compromise

Domains 6

one.doesntexist.com
one.doesntexist.com
one.doesntexist.com
one.doesntexist.com
one.doesntexist.com
one.doesntexist.com

URLs 3

http://one.doesntexist.com/p/b2ba4
https://one.doesntexist.com/p/b2ba4
https://one.doesntexist.com/p/b2ba4/

IP addresses 3

23.94.183.62
23.94.183.62
23.94.183.62

Hashes 4

98a92abab85921a86fa8f357f5c2c4e1
90bdc8691282c1ea1cdb75ef6c108e0e35ae8900
77f737ba3a583162386ef0dfb658552728c313fb03f6459778513e2b8a08ef02
2897386ef7fc4f647b79f2248092112dbfff2df33975a7cce442e3510fe0fb26c274717aae31878cb467eac39244f043c73d4ec4e907c5e6e11c9926eca8e2cb

Link 5

https://lookyloo.circl.lu/tree/184f1ad3-27b1-4402-834b-fc0b579313cb
https://urlscan.io/result/ddce0ad0-1e2a-4c7d-ba74-12c0a33a72c8/
https://www.virustotal.com/gui/url/47f13043816a6cfbb2ab068795b6878b2ba8d68b2aa5957111b3d0e621fe9c87/detection
https://www.virustotal.com/gui/url/e59d879dcb5d59424d6926ddd0039a7951eb2d9ff86abcfe8c476e237f67bdfc/detection
https://www.virustotal.com/gui/url/93fec846863a31fa02a8ffc799a292675774cf33d43b897adc7615b4bbadb210/detection

File 2

screenshot_landing_page.png
b2ba4

Size in bytes 1

9290

Float 1

5.1610648035932

Malware sample 1

b2ba4|98a92abab85921a86fa8f357f5c2c4e1

Mime type 1

text/html

Ssdeep 1

192:KezBXJCdzkNfNjzrL9t4SfjxOZxJZDI4Sm85SHZpBuk45X4NY47LYMgygKnKsj:Ke9JCONlj7PjrYZ/ZUj/54Z//uBqLZvz

Datetime 6

2022-05-09T19:30:18+00:00
2022-05-10T19:29:58+00:00
2022-05-09T19:35:33+00:00
2022-05-10T05:47:56+00:00
2022-05-10T05:34:49+00:00
2022-05-10T05:34:49+00:00

Community reviews

Loading reviews…