Waka Kotahi rego Phishing attack

Forums › IT Pro and developers › Waka Kotahi rego Phishing attack

openmedia

3449 posts

Uber Geek
+1 received by user: 877

Trusted

#296402 14-Jun-2022 17:27

Starting to see these attempts on a number of my email addresses.

Email is getting thru most of the spam detectors as it is very well constructed, but the site is being blocked by modern browsers.

Anyone else seeing this?

Generally known online as OpenMedia, now working for Red Hat APAC as a Technology Evangelist and Portfolio Architect. Still playing with MythTV and digital media on the side.

1 | 2 | 3 | 4

Amanzi
1354 posts

Uber Geek
+1 received by user: 331

ID Verified

Trusted

Lifetime subscriber

#2926527 14-Jun-2022 17:29

I seem to be getting lots of these but all are being caught by M365 spam filters. Most seem to fail SPF tests according to my tests.

Batman

Mad Scientist
30012 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#2926528 14-Jun-2022 17:30

Has the govt dept been hacked? How do they get these information?

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 331

ID Verified

Trusted

Lifetime subscriber

#2926529 14-Jun-2022 17:32

I haven't seen any personal info in the spam messages that would indicate anyone's been hacked. But some of them look quite nicely formatted, which I think is what the OP was meaning.

openmedia

3449 posts

Uber Geek
+1 received by user: 877

Trusted

#2926532 14-Jun-2022 17:50

amanzi:

I haven't seen any personal info in the spam messages that would indicate anyone's been hacked. But some of them look quite nicely formatted, which I think is what the OP was meaning.

No personal information or actual Rego details are included in the phishing attack, but the email is very well constructed.

Generally known online as OpenMedia, now working for Red Hat APAC as a Technology Evangelist and Portfolio Architect. Still playing with MythTV and digital media on the side.

k1w1k1d

1711 posts

Uber Geek
+1 received by user: 1305

#2926534 14-Jun-2022 17:53

Looks pretty genuine, but the lack of personal information and vehicle registration number is the giveaway.

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 331

ID Verified

Trusted

Lifetime subscriber

#2926535 14-Jun-2022 17:56

Waka Kotahi have a page on their website where they keep track of some of the scam emails, but it's fair to say they can't keep up with all of them.

https://www.nzta.govt.nz/online-services/report-a-phishing-scam/latest-phishing-scams/vehicle-licence-rego-email-scam/

Dyson

Shop now for Dyson appliances (affiliate link).

CYaBro

4708 posts

Uber Geek
+1 received by user: 1182

ID Verified

Trusted

#2926542 14-Jun-2022 18:23

I get these all the time but m365 always puts them in Junk.

Opinions are my own and not the views of my employer.

Batman

Mad Scientist
30012 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#2926547 14-Jun-2022 19:12

but how do they know your email?

i imagine they know when my rego expires from searching the net but the email ...

lxsw20

3689 posts

Uber Geek
+1 received by user: 2174

Subscriber

#2926552 14-Jun-2022 19:19

Picked it up from one of the many previous online breaches of other companies, similar to credential stuffing.

The email will have no mention of your rego number, or match the expired.

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 331

ID Verified

Trusted

Lifetime subscriber

#2926554 14-Jun-2022 19:22

Batman:

but how do they know your email?

i imagine they know when my rego expires from searching the net but the email ...

I would guess they acquire lists of emails and then send these scam emails to any addresses that can be identified as being from NZ. They have no idea whether you own a car or not. Send enough emails and eventually you'll get a victim.

Batman

Mad Scientist
30012 posts

Uber Geek
+1 received by user: 6217

Trusted

Lifetime subscriber

#2926558 14-Jun-2022 19:30

mine came when my rego was due

what about you guys?

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 331

ID Verified

Trusted

Lifetime subscriber

#2926564 14-Jun-2022 19:46

Batman:

mine came when my rego was due

If that's true, it's just bad luck. They probably send out millions of these scam emails, so no doubt there's a good chance that at least 1 in a million has a rego due.

Linux

12173 posts

Uber Geek
+1 received by user: 8468

Trusted

Lifetime subscriber

#2926584 14-Jun-2022 20:49

Batman:

mine came when my rego was due

what about you guys?

@Batman Did it have the rego of your vehicle in the email?

openmedia

3449 posts

Uber Geek
+1 received by user: 877

Trusted

#2926589 14-Jun-2022 21:07

Batman:

but how do they know your email?

i imagine they know when my rego expires from searching the net but the email ...

Currently appears to be hitting almost all of my email addresses. They've got a big pool of NZ email addresses off the dark web somewhere.

Generally known online as OpenMedia, now working for Red Hat APAC as a Technology Evangelist and Portfolio Architect. Still playing with MythTV and digital media on the side.

mattwnz

20515 posts

Uber Geek
+1 received by user: 4795

#2926590 14-Jun-2022 21:17

I have been getting these for the last few weeks. But ironically the legitimate organisation failed to email us our reminder this year so it expired.

1 | 2 | 3 | 4