Researcher lists 17 .cn '/verify/' sites spreading malware posing as Sumitomo Mitsui Card

What happened

Security researcher @KesaGataMe0 posted on X on 12 November 2026 a list of sites labeled as malware distribution impersonating SMBC / SMCC / Sumitomo Mitsui Card (三井住友カード), all at IP 8.216.50.3 (AS45102, Alibaba (US) Technology Co., Ltd.) and using a /verify/ path. The domains listed are: suxsygr.cn, qgfhduc.cn, vjqerpg.cn, hqipdvj.cn, vdfcwwx.cn, nxykfic.cn, dcrudyf.cn, yhtpktl.cn, zthktzx.cn, bqodpaz.cn, sbqfyfc.cn, qqvuomqt.cn, dwzrfue.cn, azfdlwt.cn, ekyhkrmt.cn, mutfsdg.cn and refhigy.cn. In an earlier post the same day the researcher also flagged nzxaxcj.cn/verify/ redirecting to /verify/update.html on the same IP. Sumitomo Mitsui Card and SMBC are impersonated and are not the operators. Do not install apps or 'updates' from links in messages; get apps only from official app stores. Source: https://x.com/KesaGataMe0/status/2120870102661050504

How the scam works

These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.

Source

Source: https://x.com/KesaGataMe0/status/2120870102661050504