Mongolia hit by Traffic Fine / SmartCar Smishing Scam
Mongolia is seeing a smishing wave that impersonates SmartCar (smartcar.mn). Fake SMS messages claim an unpaid traffic fine, push a 24-hour deadline and a 10× penalty threat, then send victims to https://zqyzn.com/mn/ to steal bank usernames, passwords and OTPs. TV5 Mongolia has marked the message as false information. Infrastructure checks rate the domain Confirm Fraud (High).
What the SMS says Scammers send Mongolian SMS branded "Smart Car" claiming a traffic fine ("Та замын хөдөлгөөний торгуультай"). The lure cites a deadline, threatens a 10× penalty and legal consequences within 24 hours, and directs victims to https://zqyzn.com/mn/. Screenshot evidence TV5 Mongolia stamped the fake Smart Car SMS ХУДАЛ МЭДЭЭЛЭЛ (false information), highlighting the phishing URL and warning it steals bank usernames, passwords and OTPs. IMAGE
_HERE Modus operandi - Impersonate SmartCar branding in SMS. - Create urgency with a 24-hour deadline and 10× penalty threat. - Push victims to zqyzn.com/mn/. - Harvest banking credentials and OTPs. Impersonated brand The legitimate service is smartcar.mn (Astvision), Mongolia’s vehicle portal. Official SmartCar does not send payment links from random SMS domains. Use smartcar.mn, its official app, or e-Mongolia. Infrastructure assessment zqyzn.com is Confirm Fraud (High confidence). Domain created 2024-09-06, hosted at 43.135.120.120 (Tencent Cloud, Hong Kong); TLS certificate CN=hmtujmz.cn mismatch; Scamadviser trust score 0. TV5 Mongolia and ikon.mn warnings align with this campaign. How to stay safe - Never open SMS links or enter bank login, password or OTP. - Verify fines on smartcar.mn, the official app, or e-mongolia.mn. - Block zqyzn.com and 43.135.120.120 where appropriate. - Report to registrar/host abuse and Mongolian cyber police through official channels.