There is a justified suspicion that these domains could be used for phishing and smishing attacks aimed at stealing users’ personal and financial data

Croatian Post at the beginning of April issued a warning about new forms of fraud that are spreading. “Croatian Post hereby warns about the existence of 14 suspicious internet domains that visually imitate the official domain of Croatian Post, but are owned by private individuals. The domains have been reported to the competent registry and we expect their shutdown before any potential fraud attempt,” they stated from HP and called on users to be cautious.

They also warned that ahead of the Easter holidays there is a justified suspicion that these domains could be used for phishing and smishing attacks with the aim of stealing users’ personal and financial data.

The attack could, as they state, include sending fake messages via: SMS, WhatsApp, Viber, Messenger, email and phone calls.

In these messages, users are being encouraged to open links that lead to fake websites resembling the official Croatian Post website, where personal data and payment card details are then requested.

The announcement emphasizes that Croatian Post never requests via email, SMS messages or social networks:
• entry of personal or financial data,
• payment of delivery costs via unverified links,
• confirmation of card transactions through unofficial channels.

Therefore, they ask users to:
• not open links from suspicious messages,
• not enter their data on unverified websites,
• immediately delete suspicious messages.

Suspicious domains registered in the past few days:
posta-hr[.]coupons
posta-hr[.]directory
posta-hr[.]digital
posta-hr[.]bid
posta-hr-hr[.]shop
postaohr[.]shop
paketna-posta[.]com

Suspicious domains registered in March:
hr-postas[.]top
postaes-hr[.]cfd
posta-hr[.]quest
posta-hr[.]work
posta-hr[.]beauty
posta-hr[.]xyz
posta-track[.]top”