This report is based on a discussion in the r/srilanka community, where the emergence of a fraudulent website impersonating the official portal for obtaining fuel QR codes was recorded. The attackers used a phishing page to collect the personal and vehicle data of citizens.

According to user Dapper_Training8045, they narrowly avoided falling victim to the scam while trying to obtain a QR code, but noticed the URL address in time and realized that the page was built on a suspicious WordPress site. The user urged the community not to click on suspicious links and reported the resource to the relevant authorities.

The danger of this website was not limited to data harvesting. According to user rnsemba, who tested the portal by entering fake information, clicking the submit button triggered an attempt to redirect the browser to a third-party resource that stealthily installs adware and malicious software.

Thanks to the prompt response from users, the fraudulent resource was blocked. According to user InternalMoose, mass complaints led to the domain being taken down, which was later confirmed by user quietNade.