Mongolia hit by Traffic Fine / SmartCar Smishing Scam
Mongolia is seeing a smishing wave that impersonates SmartCar (smartcar.mn). Fake SMS messages claim an unpaid traffic fine, push a 24-hour deadline and a 10× penalty threat, then send victims to https://zqyzn.com/mn/ to steal bank usernames, passwords and OTPs. TV5 Mongolia has marked the message as false information.
Mongolian citizens have seen a SMS based phishing activity uptick. Scammers send fake message in the name of Mongolian's "Smart Car" claiming a traffic fine ("Та замын хөдөлгөөний торгуультай"). The message cites a deadline, threatens a 10× penalty and legal consequences within 24 hours, and directs victims to https://zqyzn.com/mn/. Screenshot evidence of TV5 Mongolia highlighting the phishing URL and warning it steals bank usernames, passwords and OTPs is shown below
Modus operandi
- Impersonate SmartCar branding in SMS.
- Create urgency with a 24-hour deadline and 10× penalty threat.
- Push victims to zqyzn.com/mn/.
- Harvest banking credentials and OTPs.
Impersonated brand : The legitimate service is smartcar.mn (Astvision), Mongolia’s vehicle portal. Official SmartCar does not send payment links from random SMS domains. Use smartcar.mn, its official app, or e-Mongolia. Infrastructure assessment
IOC - Domain Analysis : zqyzn.com
zqyzn.com is a Mongolian traffic-fine phishing domain impersonating SmartCar (smartcar.mn). SMS copy uses official-sounding “Smart Car” branding, a 24-hour payment deadline, and a 10× penalty threat to push victims onto /mn/, where bank logins, passwords and OTPs are harvested. Infrastructure is a typical disposable Gname + JulyDNS + Tencent Cloud kit: random 5-letter .com, privacy-redacted WHOIS, shared HK hosting, and a mismatched TLS certificate (CN=hmtujmz.cn). That is criminal infrastructure, not a legitimate government or SmartCar service.
How to stay safe
- Never open SMS links or enter bank login, password or OTP.
- Verify fines on smartcar.mn, the official app, or e-mongolia.mn.
- Block zqyzn.com and 43.135.120.120 where appropriate.
- Report to registrar/host abuse and Mongolian cyber police through official channels.