lkpat
Executive Member
This came through to my daughter's sms:
It redirects to the SA Post office site via a domain registered in China spoofing the SA post office (note the lower case L in place of i)
I assume it's counting on an insecure device to do it's work, but if I curl that URL I simply get a 302 permanently moved:
<a href="https://www.postoffice.co.za/">Moved Permanently</a>.
What's the point of hosting that?
Whats interesting is that the URL won't resolve on Voda LTE - I had to open a VPN session... Just curious.
Curling the final address (www.postoffice.co.za) reveals:
<head><title>Object moved</title></head><body><h1>Object Moved</h1></body>
It then just opens the regular PO site
Some funkiness going on there... can't find a payload yet, unless the post office site itself has been hacked to track these clicks or some other malicious activity... but then why redirect via postofflce-za.com? Unless they're testing stuff... to see (for example) which numbers have humans on the other end and are susceptible to tapping the first link? Or simply getting a list of valid numbers?
It redirects to the SA Post office site via a domain registered in China spoofing the SA post office (note the lower case L in place of i)
I assume it's counting on an insecure device to do it's work, but if I curl that URL I simply get a 302 permanently moved:
<a href="https://www.postoffice.co.za/">Moved Permanently</a>.
What's the point of hosting that?
Whats interesting is that the URL won't resolve on Voda LTE - I had to open a VPN session... Just curious.
Curling the final address (www.postoffice.co.za) reveals:
<head><title>Object moved</title></head><body><h1>Object Moved</h1></body>
It then just opens the regular PO site
Some funkiness going on there... can't find a payload yet, unless the post office site itself has been hacked to track these clicks or some other malicious activity... but then why redirect via postofflce-za.com? Unless they're testing stuff... to see (for example) which numbers have humans on the other end and are susceptible to tapping the first link? Or simply getting a list of valid numbers?
Last edited:
