Domains hosted on the same infrastructure fitting the same pattern include:

• imptgouv[.]com
• gouvimpt[.]com
• confirme-fr-enligne[.]com

The resolving IP address (62.4.13[.]122) also hosts a number of other French language phishing URLs for Paypal, says Lookout. After analyzing the aspect ratio, they appear specific to mobile devices: 

• verifauthenacesscloud[.]com
• verifmyaccpp[.]com
• busnow[.]net

Another live phishing site using COVID-19 lure, which has been live since January 2020, is masquerading as a new “beta” service by the UK HMRC:

• hmrc-govupdate-covid-19[.]com
• covid-19-gov[.]claims

The credit card number validation is "spot on," but the language change to Welsh doesn’t work, notes Lookout. 

Lookout also noted a pattern between the two phishing scams: both were live and also hosted on the same mobile PayPal phishing infrastructure(47.90.28[.]145). As seen before, this IP also hosts sites relating to the French General Directorate of Public Finance. Lookout concludes that it is perhaps the same actor or same phishing kit set. 

More recently, active sites contain the keyword “covid-19” in their domain name. Alex Gladd, Principal Product Manager at Lookout, says that each of these phishing attacks is meant to take advantage of the current situation regarding the COVID-19 pandemic. Gladd says, "They're replicating government websites related to providing citizens with financial relief in response to the pandemic.  These sites make it appear as though victims will be receiving some amount of relief money, then ask victims to provide their personal and financial information, like a credit card number or PayPal credentials, in order to receive it.  In reality, the sites are simply stealing the victim's data.  Data like this often gets sold on the dark web and later used to make fraudulent purchases."

"During times like these, it's more important than ever for people to be hyper-vigilant about links they receive via email, messaging, and social media," Gladd notes.  "Whenever it's something claiming to be related to government, financial, or personal information, it's always best to ignore the link in the email, message, or post and go directly to the institution or company's website yourself by typing its known URL into the browser."

Gladd adds, "this guidance is particularly important for people using mobile devices, where small form factors can make it especially difficult to notice suspicious links."