Phishing Campaign Impersonates Mexico, Peru, Uruguay Government’s e-Procurement Systems

description: The campaign uses convincing looking phishing pages where individuals and companies are invited to bid on public projects with the governments of Mexico, Peru, or Uruguay. The actors or group behind these phishing attacks setup multiple fraudulent online portals to steal account credentials from unsuspecting users, which can be sold for profit on underground markets or as an initial entry point for obtaining sensitive and privileged information from the victim and their organization.

publish date:

reference :

IOC Table
total 39
type value
domain i3-4.online
domain velia.net
domain compras.gub.uy
hostname compranet.funcionpublica.gob.mx
hostname compranet.funcionpublica.gob.mx.seguro.umernasim.com
hostname compras.gub.uy.seguro.iniciar.umernasim.com
hostname compras.gob.pe.seguro.iniciar.umernasim.com
hostname compranet.funcionpublica.gob.mx.i3-5.online
hostname www.compranet.funcionpublica.gob.mx.seguro.umernasim.com
hostname www.compranet.funcionpublica.gob.mx.i2-i.icu
hostname www.comprasestatales.gub.uy
hostname www.compras.gob.pe.i2-i.icu
hostname www.compras.gob.pe.i1-i.icu
hostname compras.gob.pe.corpenta.com
hostname compras.gob.pe.i2-i.icu
hostname www.compras.gob.pe.seguro.iniciar.umernasim.com
IPv4 37.0.123.217
IPv4 173.212.248.4
IPv4 134.119.176.46
URL http://compras.gob.pe.corpenta.com.pe/
URL http://compras.gub.uy.seguro.iniciar.umernasim.com
URL http://compras.gob.pe.seguro.iniciar.umernasim.com
URL http://www.compranet.funcionpublica.gob.mx.seguro.umernasim.com
URL http://www.compras.gob.pe.i2-i.icu/
URL https://compranet.funcionpublica.gob.mx.i3-5.online/seguro/iniciarsesion.html
URL http://compras.gob.pe.i2-i.icu/
URL http://www.compras.gob.pe.seguro.iniciar.umernasim.com
URL http://compranet.funcionpublica.gob.mx.seguro.umernasim.com
URL https://compras.gub.uy.corpenta.com.pe/seguro/iniciarsesion.html
URL http://www.compras.gob.pe.corpenta.com.pe/
URL https://www.compras.gob.pe.i1-i.icu
URL http://i1-i.icu/compras.gub.uy/seguro/iniciarsesion.html
URL https://compras.gob.pe.corpenta.com.pe/seguro/iniciarsesion.html
URL http://www.compranet.funcionpublica.gob.mx.i2-i.icu/
URL https://www.perucompras.gob.pe/
URL https://www.comprasestatales.gub.uy/consultas/
URL https://compranet.funcionpublica.gob.mx/web/login.html
URL http://compras.gub.uy.corpenta.com.pe/seguro/verificar.html
URL http://www.compras.gub.uy.corpenta.com.pe/