# MA-642.112016: MyCERT Alert - LHDN Phishing Incident

**Date:** 25 Nov 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-642.112016  
**Advisory ID:** MA-642.112016

---

**1.0 Introduction**
MyCERT is aware of the LHDN phishing incident. The first incident reported to Cyber999 was on 18th October 2016. 
**2.0 Impact**
The phishing email’s content is to lure victim to click on the phishing link or download an attachment. Victim is informed to claim the outstanding tax refund. The sender is using compromised email to send the phishing email. Figure below shows the number of incident reports:
Below are the screenshots of sample of phishing emails:
Sample of attachment content:
When user click the phishing link, it will redirect victim to the phishing website as shown below:
Based on our analysis, below is the list of phishing URLs involved in this incident:
|  |  | --- | --- | --- | --- | **#** | **URL** | **IP** | **Country** | **1** | http://www.merchantsquaycork.com/sitework/proadmin\_template/ | 54.217.228.156 | US | **2** | http://www.orthoxel.net/xKD7an3uBXa4yLBRPwcBCWgH/ | 54.217.228.156 | US | **3** | http://itapoacontainers.com.br/modules/ | 192.185.214.24 | US | **4** | http://sanxuatquatang.org/wp-content/plugins/ | 104.31.220.78 | US | **5** | http://sanxuatquatang.org/wp-includes/customize/ | 104.31.220.78 | US | **6** | http://www.vundo.org/UWBkaDb8RVhNDsBGmPEw89v8/ | nil | nil | **7** | http://cleanerscarpet.com/wp-admin/includes/ | nil | nil | **8** | http://www.zzrwkj.com/plug/ | 116.255.235.196 | CHINA | **9** | http://www.mdrcu.ru/components/com\_content/ | 195.208.0.136 | RUSSIA | **10** | http://reefer.parts/img/ | 37.128.146.168 | NETHERLANDS |
**3.0 Recommendations**
3.1 If you received such scam emails, which impersonate LHDN or local online banks, you can immediately:
- Contact the LHDN and the banks for clarification.
- Forward the phishing email to [[email protected]](/cdn-cgi/l/email-protection#7e1d071c1b0c4747473e1d071c1b0c0d1b1d0b0c170a07501307) for MyCERT incident response action.
- Forward to Cyber999, email full header that you has received that is claimed to be from LHDN.
- Delete or ignore the emails.
3.2 If you are a victim:
- Notify the respective bank and get their advise and assistance.
3.3 If you use Firefox browser, please consider using our anti-phishing plugin, 'DontPhishme' for detecting phishing sites. Please visit the following URL for more information on the plugin:
- <https://addons.mozilla.org/en-US/firefox/addon/142878/>
Generally, MyCERT advises the users and administrators to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#d0b3a9b2b5a2e9e9e990b3a9b2b5a2a3b5b3a5a2b9a4a9febda9) or [[email protected]](/cdn-cgi/l/email-protection#5d30243e382f291d30243e382f2973322f3a733024)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**4.0 References**
• <https://addons.mozilla.org/en-US/firefox/addon/142878/>