Vaccine Phishing Campaign Spoofs CDC and Pfizer in Bid for Personal Data
News of COVID-19 vaccine rollouts had barely broken before threat actors started building phishing campaigns around them. Among the earliest was a December operation that impersonated the Centers for Disease Control and Prevention (CDC), then added Pfizer branding to a second wave. The goal was straightforward: harvest personally identifiable information (PII) under the pretense of a census form required to secure a place on a vaccine distribution list.
The messages slipped past Microsoft Office 365’s native filters and were caught by Area 1 Security, which documented the campaign. The phishing emails used a CDC logo and language implying that completing a linked form was necessary for vaccine eligibility. A follow-up variant layered on a Pfizer brand spoof to broaden the disguise.
The sender display name was spoofed to appear as if the message came from within the target organization, using the company’s domain followed by “Secured Mail.” That tactic alone would not defeat typical anti-spoofing controls, but the attacker added several layers of evasion. The SMTP Envelope “MAIL From” address was made to look like it originated from a legitimate domain, and a crafted SMTP HELO command reinforced that impression. In reality, the messages came from the unrelated IP address 184[.]80[.]233[.]138.
The spoofed domain had no SPF, DKIM, or DMARC records configured, and it had been taken offline months earlier—so it no longer resolved to an IP address. With no authentication protocols to check, recipients’ mail servers had nothing to flag. The actual sender IP belonged to a legitimate business and carried no bad reputation, keeping it off spam blocklists entirely.
An analysis of the campaign showed a deliberate sequence of moves:
- Display Name Spoofing faked the visible FROM header.
- An SMTP HELO command was inserted to spoof the Envelope From domain.
- The spoofed domain lacked email authentication and no longer resolved.
- A compromised legitimate host with a benign IP served as the launch point.
The “Vassine” Phishing Page and Infrastructure
Victims who clicked the “COVID19 CDC Count” or “Yes / No” button in the message were taken to hxxps://mail10298[.]buzz/covid/index.php, a page that requested sensitive details such as a physical address and driver’s license number. The form contained a telling typo—"vassine" instead of "vaccine"—suggesting the attacker was not a native English speaker.
The phishing domain was registered within 24 hours of the campaign launch, a common pattern for attacks that aim to harvest victims before the domain is identified as malicious. Newly registered domains (NRDs) have little history or reputation, allowing them to slip past blocklists and email security gateways. The domain in this case was hosted on a Virtual Private Server (VPS) in Cape Town, South Africa, at the IP address 102[.]130[.]119[.]118. Several dozen other mail-themed domains with random 4–6 digit sequences resolved to the same IP, though those were parked or offline at the time of analysis.
Five subdomains on the phishing domain revealed the owner was using cPanel, the web hosting control panel:
cpanel[.]mail10298[.]buzzcpcalendars[.]mail10298[.]buzzcpcontacts[.]mail10298[.]buzzwebdisk[.]mail10298[.]buzzwebmail[.]mail10298[.]buzz
Because the domain was registered less than a day before the campaign began, the attacker likely owned the mail10298[.]buzz account. But legitimate sites running cPanel are routinely targeted in phishing attacks themselves; a compromised cPanel account gives an attacker a stealthy platform for sending malicious email from a domain with a clean reputation.
An open directory on the phishing site revealed an OPSEC failure by the attacker. The site’s main index was publicly accessible and contained a covid.zip archive with basic HTML and PHP scripts. One file, process.php, appeared to be adapted from an open-source PHP form handler—extensive comments and default values were still present. When a victim submitted the form, the script issued an HTTP GET request to a generic PHP mailer that forwarded the victim’s information, along with the host IP address, to the attacker.
Detecting and Stopping the Threat
Traditional email defenses that rely on SPF, DKIM, and DMARC validation alone will miss this kind of attack. The campaign infrastructure used here was identified through early detection of attacker domains and real-time correlation with the brands being impersonated. Additional signals include lexical analysis of the message body and subject, plus scrutiny of recently registered and look-a-like domains.
The same indicators that exposed this campaign provide the data points for blocking future attempts before they reach an inbox.
Indicators of Compromise
Phishing Link:
hxxps://mail10298[.]buzz/covid/index.php
Phishing Domain and Subdomains:
mail10298[.]buzzcpanel[.]mail10298[.]buzzcpcalendars[.]mail10298[.]buzzcpcontacts[.]mail10298[.]buzzwebdisk[.]mail10298[.]buzzwebmail[.]mail10298[.]buzz
Sender IP:
102[.]130[.]119[.]118
PHP Script:
process.php(SHA256 hash:f2023582408358590d9e1576422b5c13addfa740d0d3c9afd46c0982e45d1149)
Website Image Containing Misspelled Word “Vassine”:
logo.png(SHA256 hash:5fd24dca599cc5220e7ea7271a89ea660c9d769177e4f07a0cd7d0fa485f9ffa)
