Free Travel Wi-Fi Offer Hides a Phishing Trap
A slick travel Wi-Fi email from voking.online is circulating across NZ, using a newly registered sender domain to lure you into clicking for a supposed free connectivity offer.
You might see an email promoting travel connectivity with the subject line "Unlimited Internet in 175 Countries". It presents as a Ryoko-style offer and pushes you to click through for "free WiFi for my trip", making it look like a handy travel deal rather than a threat. An attachment was also captured with this campaign, which adds another path to compromise if you open it.
What gives it away is that the message only looks legitimate on the surface. The sending domain, voking.online, was registered recently and has no established history as a trusted business sender, which is a common trait in phishing campaigns. While some of the email checks appeared to pass, the message had no DKIM signing, so your email system had limited ability to confirm it genuinely came from the brand it appeared to represent.
The attacker is likely trying to get you to click, open the attachment, or hand over details through a fake offer page. If you engage, you could be pushed into entering credentials, downloading harmful content, or exposing your device and business accounts to further compromise.
This campaign has been observed across multiple organisations in a short window, which means you should treat any similar travel or free Wi-Fi promotion with caution, even if it slips past basic email filtering.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Domain registered ~69 days ago
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Look closely at the sender domain before you click, especially if the message is offering travel deals, free Wi-Fi, or urgent promotions.
- Do not: Open attachments or click links in unexpected promotional emails, even if the branding looks polished and familiar.
- Verify: If the offer appears relevant, go to the provider's official website yourself rather than using the email link.
- Report: Mark the email as phishing in your mail system and alert your IT provider if anyone opened the message or attachment.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
The Local Vocal is published by Decision1 IT Solutions. If one of these landed in your inbox, or someone in the team clicked, give us a call.