03/09/2026
🚨 PHISHING / CYBERCRIME ALERT — Singapore corporate filing scam
I received a phishing email titled “Notice Regarding Fines for Overdue Corporate Filings”, pretending to be a “Late Filing Penalty Notice” and claiming to come from a “Tax Audit and Investigation Department.”
The email infrastructure identifies:
Sender domain: zgzzs[.]net
Phishing destination: mup4zq[.]lwrwjs[.]com/2026-sg-tax-act[.]html
The email even passed SPF and DKIM because the sender had properly authorised its own malicious sending infrastructure. SPF/DKIM passing does not mean an email is legitimate — it only confirms that the domain owner authorised the transmission.
I am also reporting the suspected phishing domain:
zf17rhq178[.]com
Current registration records list https://bit.ly/4xgarSU Pte. Ltd. as its registrar, IANA ID 1923, with abuse contact [email protected]. The domain was registered on 15 October 2025 and updated on 26 August 2026.
https://bit.ly/4xgarSU Pte. Ltd. is a Singapore company. I am calling on Gname to urgently investigate this domain, preserve the associated registration/account records and relevant logs, suspend the domain if abuse is confirmed, and cooperate fully with the Singapore authorities.
Under ICANN's Registration Data Policy, accredited registrars are required to collect registrant information including the registrant's name, street address, city, country, phone number and email address. Some of that information may be hidden from the public, but lawful disclosure mechanisms exist for non-public registration data.
I am referring this matter to the Singapore Ministry of Home Affairs, Singapore Police Force and SingCERT for investigation.
I would particularly ask the authorities to ensure that relevant registration, account, payment and access records are preserved before they can be deleted or altered.
This is not just spam. Fake government/tax penalty notices designed to pressure recipients into clicking external links are a serious phishing threat.
Domains should be treated as indicators of compromise:
zgzzs[.]net
lwrwjs[.]com
zf17rhq178[.]com