Wrote: Etrit Rexhepi
A message (SMS) has been sent to the phones of Kosovo citizens which reads "Your package has been placed on hold due to incomplete address information.".
To ensure that this package is delivered without a problem, a clickable link has been published where the address information can be updated.
What's wrong with this SMS?
After verification of the facts carried out by hibrid.info, it was confirmed that the number that sent this message to the phone has the prefix +44, which belongs to the United Kingdom. Meanwhile, the link presented in the SMS is suspicious and aims to obtain and misuse personal data.
Initially, hibrid.info researched the prefix of the number that sent the SMS and found that it belongs to the United Kingdom (see here).
Further, hibrid.info has investigated, also verifying the link attached to the message. The link in question, after verification on the computer, shows that after clicking, no website was found (see here).
Meanwhile, the same link, after clicking on the phone, displays a page imitating the Kosovo Post website, where the same information is displayed as shown in the SMS content.
After clicking the "Continue" button, a window opens where you can submit your data.
That this website is an imitation of that of the Post of Kosovo is shown by the domain presented on this page, which differs from the domain of the website of this institution "https://postakosoves.com/".
Hibrid.info has also verified the credibility of this domain, using the platform for checking the legality of websites. The data shows that this domain was opened in the last six months and has very low credibility (see here).
Analyze:
An SMS sent from an email address with a phone number with a United Kingdom prefix has arrived on the phones of several citizens, calling them to click on a link in order to change their home address in order to receive a package.
Hibrid.info, after checking and verifying the facts, has found that the link presented in the SMS is an imitation of the Kosovo Post website, is suspicious and not trustworthy.
Based on the working methodology, hibrid.info evaluates this SMS as "Scam".
Reasoning:
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.