Bulgarian Parcel Shipping Company Speedy Under Phishing Attack - An Analysis

Dear blog readers,

I recently intercepted a relatively interesting phishing attempt impersonating the Bulgarian parcel shipping company Speedy that also includes propagation using SMS messages targeting Bulgarian users prompting them to click on bogus and phishing links and I decided to dig a little bit deeper into the infrastructure behind the phishing campaign.

With the company acknowledging the existence of the campaign and prompting users to stay vigilant and avoid interacting with the SMS messages and don't click on the phishing domain links in this post I'll provide actionable intelligence on the infrastructure behind the phishing campaign.

It's worth emphasizing on the fact that based on publicly accessible information and based on my own personal analysis methodology I was able to find out that this specific phishing campaign was originally active since 2023 which makes it a persistent phishing attack campaign that targets Bulgarian parcel shipping services which also includes Bulgarian Post Service and DHL Bulgaria.

Sample domains known to have been involved in the campaign include:

hxxp://bg-paci.com

hxxp://bg-sof.com

hxxp://bg-imy.com

hxxp://bg-myk.com

hxxp://bg-myck.com

hxxp://bg-tck.com

hxxp://bg-tmy.com

hxxp://bg-il.com

hxxp://bg-tzc.com

hxxp://bg-tiack.com

hxxp://bg-myb.com

hxxp://bg-tack.com

Responding IPs:

165.154.239.211

165.154.212.18

Sample URLs known to have been used in the campaign include:

hxxp://speedy.bg-myb.com/en/speedy.html

hxxp://speedy.bg-tiack.com/en/speedy.html

hxxp://speedy.bg-tiack.com/en/speedy.html

hxxp://speedybg.cfd/en/speedy.html

hxxp://speedy-i.com/bg/speedy.html

hxxp://speedy-blg.com/bg/speedy.html

hxxp://speedy.bg-na.qpon/my/speedy.html

hxxp://speedy.bg-ip.qpon/my/speedy.html

hxxp://speedy.bg-ic.qpon/my/speedy.html

hxxp://speedy.bg-it.qpon/my/speedy.html

hxxp://speedy.bg-ip.qpon/my/speedy.html

hxxp://speedy.bg-ia.qpon/my/speedy.html

hxxp://speedy.bg-gl.qpon/my/speedy.html

hxxp://speedy.bu-bd.qpon/my/speedy.html

hxxp://speedy.bu-bd.qpon/my/speedy.html

hxxp://speedy.bg-pv.cfd/my/speedy.html

hxxp://speedy.bg-bz.qpon/my/speedy.html

hxxp://speedy.bg-z.qpon/my/speedy.html

hxxp://speedy.bg-pot.qpon/bg/speedy.html

hxxp://speedy.bg-pot.qpon/bg/speedy.html

hxxp://speedy.bg-packl.cfd/bg/speedy.html

hxxp://speedy.bg-pack.cfd/bg/speedy.html

hxxp://speedy.bg-packg.cfd/bg/speedy.html

hxxp://speedy.bg-packg.cfd/bg/speedy.html

hxxp://speedy.bg-packg.cfd/bg/speedy.html

hxxp://speedy.bg-packi.cfd/bg/speedy.html

hxxp://speedyi.cfd/bg/speedy.html

hxxp://speedyi.cfd/bg/speedy.html