{ "type": "Domain", "indicator": "hoiatustrahv.politsei.gov-ee.bond", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/hoiatustrahv.politsei.gov-ee.bond", "alexa": "http://www.alexa.com/siteinfo/hoiatustrahv.politsei.gov-ee.bond", "indicator": "hoiatustrahv.politsei.gov-ee.bond", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": {}, "pulse_info": { "count": 0, "pulses": [], "references": [], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 1, "pulses": [ { "id": "6a17527240dde65694eed30e", "name": "Exposing a Global Smishing Operation Across 19 Countries: Governments, Postal Services, and Telecoms Targeted", "description": "A coordinated smishing operation spanning 19 countries across Europe, the Americas, and the Caucasus has been exposed, originating from fraudulent SMS messages impersonating Romania's government payment portal Ghi\u0219eul.ro. Investigation revealed 1,628 malicious URLs linked by a single 128-character campaign identifier, targeting government portals, traffic police departments, postal services including DPD and SEUR, tax authorities, and telecommunications providers like T-Mobile and Vodafone. The infrastructure utilizes 32 backend IP addresses distributed across Tencent Cloud, Alibaba Cloud, Cloudflare CDN, and ALEXHOST Moldova. Threat actors employ two distinct phishing templates: a Vue.js single-page application and a Bootstrap-based clone, executing a four-stage credential harvesting process that collects complete payment card details through fabricated traffic fines, toll payments, and delivery notifications.", "author_name": "AlienVault", "modified": "2026-05-28T15:19:05.611000", "created": "2026-05-27T20:22:10.565000", "revision": 2, "tlp": "white", "public": 1, "adversary": "", "indicators": [ { "id": 4357270849, "indicator": "mvrx.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4357270852, "indicator": "ghiseul.autos", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4357270864, "indicator": "mvri.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4363816042, "indicator": "dpde.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4363821558, "indicator": "e-uprava.gov-si.shop", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4373640856, "indicator": "gove.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4373640857, "indicator": "govh.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4373640858, "indicator": "govj.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4373640859, "indicator": "govk.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4373640860, "indicator": "govl.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598747, "indicator": "5756505bc94149dda328a2721561cab6", "type": "FileHash-MD5", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598748, "indicator": "http://ghisaul.lat/ro", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598749, "indicator": "http://ghiseul-ro.cyou/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598750, "indicator": "http://ghiseul-ro.sbs/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598751, "indicator": "http://ghiseul-ro.shop/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598752, "indicator": "http://ghiseul.cfd/pay", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598753, "indicator": "http://ghiseul.eu.cc/pay", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598754, "indicator": "http://www.ghiseul.ro/ghiseul/public/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598755, "indicator": "http://www.ghiseul.ro/ghiseul/public/css/bootstrap-theme.css", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598756, "indicator": "http://www.ghiseul.ro/ghiseul/public/css/bootstrap.min.css", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598757, "indicator": "http://www.ghiseul.ro/ghiseul/public/css/font-awesome.min.css", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598758, "indicator": "http://www.ghiseul.ro/ghiseul/public/css/jquery-ui.structure.min.css", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598759, "indicator": "http://www.ghiseul.ro/ghiseul/public/css/simple-line-icons.css", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598760, "indicator": "https://ghiseal.lat/ro/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598761, "indicator": "https://ghiseal.lat/ro/#/index", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598762, "indicator": "https://ghiseul.autos/ro/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598763, "indicator": "https://ghiseul.cyou/pay", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598764, "indicator": "https://ghisiul.lat/ro/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598765, "indicator": "https://ghizeul.lat/ro/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598766, "indicator": "https://www.ghiseul-ro.bond/ghiseul/public/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598767, "indicator": "https://www.ghiseul-ro.cfd/ghiseul/public/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598768, "indicator": "https://www.ghiseul.govro.one/ghiseul/public/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598769, "indicator": "https://www.ghiseul.ro/ghiseul/public/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598770, "indicator": "https://www.ghiseulro.cyou/ro/", "type": "URL", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598771, "indicator": "dpd-lv.top", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598772, "indicator": "dpdlv.bond", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598773, "indicator": "dsvag.sbs", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598774, "indicator": "dsvav.cfd", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598775, "indicator": "dsvcv.cfd", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598776, "indicator": "dsvxk.cyou", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598777, "indicator": "e-csddlv.top", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598778, "indicator": "fanveris.cyou", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598779, "indicator": "ghisaul.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598780, "indicator": "ghiseal.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598781, "indicator": "ghiseul-ro.cyou", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598782, "indicator": "ghiseul-ro.sbs", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598783, "indicator": "ghiseul-ro.shop", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598784, "indicator": "ghiseul.cfd", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598785, "indicator": "ghiseul.cyou", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598786, "indicator": "ghisiul.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598787, "indicator": "ghizeul.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598788, "indicator": "gobal-store-hub.shop", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598789, "indicator": "gov-si.cam", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598790, "indicator": "gov-si.qpon", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598791, "indicator": "gov-si.sbs", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598792, "indicator": "gov-si.xin", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598793, "indicator": "govo.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598794, "indicator": "govsi.bar", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598795, "indicator": "mvr-gov-mk.cyou", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598796, "indicator": "mvrbg.ink", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598797, "indicator": "mvrbg.life", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598798, "indicator": "mvrbg.sbs", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598799, "indicator": "mvrcc.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598800, "indicator": "roadpolice-am.icu", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598801, "indicator": "roadpolice-am.shop", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598802, "indicator": "roadspolice.lat", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598803, "indicator": "seur-bcdef.cc", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598804, "indicator": "seur-cztwp.club", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598805, "indicator": "seur-fghij.org", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598806, "indicator": "seur-fqlap.cyou", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598807, "indicator": "seur-hijkl.cc", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598808, "indicator": "seur-hxrz.org", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598809, "indicator": "seur-jwqec.link", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598810, "indicator": "seur-rmvxq.club", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598811, "indicator": "seur-rxkmd.cyou", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598812, "indicator": "seur-yzabc.com", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598813, "indicator": "seur-zkryw.cloud", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598814, "indicator": "tesco-redeem-check.bond", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598815, "indicator": "vodafaone.shop", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598816, "indicator": "worldmartonline.com", "type": "domain", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598817, "indicator": "dpd.ie-com.vip", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598818, "indicator": "e.csdd.govlv.cam", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598819, "indicator": "hoiatustrahv.politsei.gov-ee.bond", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598820, "indicator": "mvr.govmk.cam", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598821, "indicator": "mvr.govmk.one", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598822, "indicator": "sumin.lrv-lt.shop", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598823, "indicator": "www.ghiseul-ro.bond", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598824, "indicator": "www.ghiseul-ro.cfd", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598825, "indicator": "www.ghiseul.govro.one", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null }, { "id": 4381598826, "indicator": "www.ghiseulro.cyou", "type": "hostname", "created": "2026-05-27T20:22:11", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1, "role": null } ], "tags": [ "smishing", "government impersonation", "credential harvesting", "payment card theft", "phishing", "multi-country campaign", "postal service fraud", "typosquatting" ], "targeted_countries": [ "United States of America", "Albania", "Armenia", "Bulgaria", "Estonia", "France", "Georgia", "Greece", "Ireland", "Kosovo", "Latvia", "Lithuania", "North Macedonia", "Montenegro", "Romania", "Slovenia", "South Georgia and the South Sandwich Islands", "Spain", "Trinidad and Tobago", "United Kingdom of Great Britain and Northern Ireland" ], "malware_families": [], "attack_ids": [ "T1583", "T1204.002", "T1566.002", "T1598.003", "T1586.002", "T1608.001", "T1583.001", "T1560", "T1090", "T1584", "T1586", "T1102", "T1608", "T1583.006", "T1204", "T1041", "T1566", "T1078", "T1598", "T1213", "T1584.001" ], "references": [ "https://hunt.io/blog/massive-smishing-campaign-governments-postal-telecoms" ], "industries": [ "Government", "Telecommunications", "Retail", "Transportation" ], "extract_source": [], "more_indicators": false, "indicator_count": 90 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "hoiatustrahv.politsei.gov-ee.bond", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "hoiatustrahv.politsei.gov-ee.bond", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780173306.4876177 }