Fishing for QR Code Phishing Traces in the DNS

QR code phishing has reportedly been on the rise. And that isn’t surprising given that almost everyone today can’t live without their mobile phones. In fact, a study cited that 86% of the entire global population use their smartphones to browse the Internet, settle bills online, and even pay for purchases in brick-and-mortar establishments.¹

Trustwave published 18 URLs as indicators of compromise (IoCs) related to the QR phishing code campaign they recently investigated.² The WhoisXML API research team extracted the URLs’ domains for an IoC list expansion analysis to uncover other unreported potentially connected artifacts and found:

• 10,000 domains with the same registrant name as one of the IoCs in their WHOIS records, 10 of which turned out to be malicious based on a bulk malware check
• 10 unique IP addresses to which the domains from the extracted 18 URLs identified as IoCs resolved
• 114 domains that shared the seemingly dedicated IP addresses that played host to the extracted domains, 26 of which turned out to be malicious based on a bulk malware check
• 10,045 domains that contained text strings found among some of the extracted domains, four of which turned out to be malicious based on a bulk malware check
• 30 domains with the exact string qr.codes akin to one of the domains extracted from the URLs identified as IoCs

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

—

• [1] https://www.zippia.com/advice/smartphone-usage-statistics/
• [2] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/think-before-you-scan-the-rise-of-qr-codes-in-phishing/