Block Telco Phishing Domains

[jasongodev]

Phishing Domain/URL/IP(s):

edgeone.app
focuzuh.cn
sanuzu.cn
13afx.top
198sr.top
ahie.top
apwm.top
aqjw.top
axqt.top
azth.top
b95fit.top
b9rfr.top
bxdo.top
cgeb.top
cinxn.top
cvhi.top
d0rf0.top
ebry.top
ebrz.top
ecgtv.top
edtk.top
ejcx.top
ejky.top
ekfa.top
emgy.top
engm.top
euwm.top
fowq.top
gesx.top
gnho.top
gruj.top
gwew.top
h6fxt.top
hjej.top
hlvp.top
hzne.top
icyk.top
iezw.top
ijis.top
iltf.top
ipnx.top
ipqtm.top
iusj.top
izgk.top
izhd.top
jfsv.top
jh7fg.top
jkca.top
jnqv.top
joir.top
ju7vn.top
jynv.top
kajh.top
kdzru.top
kfha.top
kikd.top
kkjlo.top
kmvp.top
ltquz.top
lxdo.top
lyzv.top
mhbe.top
mjeo.top
mvyp.top
n7fgh.top
ndyv.top
ngxv.top
nhme.top
nvek.top
nzam.top
ofxl.top
ofz6hz.top
onqj.top
orjb6d.top
osdm.top
owsf.top
pakm.top
pasn.top
pwia.top
pzvj.top
qoml.top
qupq.top
sjmwu.top
sldlv.top
sqwo.top
syup.top
tacb.top
tbobm.top
tvwg.top
tykv.top
ujlc.top
ustg.top
uzct.top
vjor.top
vltd.top
vlti.top
vokm.top
vpfa.top
vtqy.top
vuix.top
wafw.top
wajw.top
wd2752.top
wd5626.top
wmih.top
wujk.top
wvoa.top
wxfud.top
wxiyy.top
xexv.top
xhku.top
xnhsr.top
xrq8wl.top
xtza.top
y68gh.top
yiyg.top
yobp.top
yqax.top
ysiz.top
yuwm.top
znbv.top
ztoi.top
zuoh.top
17fdg.xyz
23fg.xyz
268g.xyz
35dg5.xyz
3p6c.xyz
3s74.xyz
3zt11.xyz
44ds2.xyz
4ma7.xyz
4sd1.xyz
7rft.xyz
8h7gh.xyz
8ygu.xyz
b15v.xyz
bnc6d.xyz
bt65d.xyz
bvjb6.xyz
csszy.xyz
cvh5.xyz
d8cj.xyz
dxw3.xyz
e6es.xyz
f5cv.xyz
fc15.xyz
ft76h.xyz
gcseo.xyz
gd87g.xyz
gdfgd.xyz
gv2cg.xyz
gwseo.xyz
h548s.xyz
h65d4.xyz
hnfy6.xyz
jhj7.xyz
jue9.xyz
njsj.xyz
nr56s.xyz
ntf67.xyz
sfd3.xyz
t11f.xyz
vbh66.xyz
x8v2e.xyz
xd456.xyz
xe22.xyz
xr43.xyz
zzq2.xyz

Impersonated domain

Various telecommunications company from different countries

Describe the issue

These malicious domains works the same with previously blocked domains: #1145

These malicious domains usually work with various subdomains targeting local public events from the target country. Their common denominator is the use of a banner image from https://599cdn.com/ with a path from a target country such as https://599cdn.com/Philippines/ph05101.jpg, https://599cdn.com/bangladesh/b2026.jpg, https://599cdn.com/Indonesia/gopay01.jpg, etc.

Searching 599cdn.com using urlscan.io reveals all related links that embeds these banner images: https://urlscan.io/search/#599cdn.com

Here are some of the subdomains used by these malicious domains:

bagi-bagi-dana-2026-n99xxlwrc2.edgeone.app
trendyol.focuzuh.cn
trendyol.sanuzu.cn
sm.13afx.top
hari-buruh-spesial23.198sr.top
hari-buruh-spesial128.ahie.top
klaim-dana-kaget26.apwm.top
klaim-dana-kaget20.aqjw.top
100gb112.axqt.top
labor-day-51gb-free119.azth.top
klaim-dana-kaget69.b95fit.top
hari-buruh-spesial30.b9rfr.top
klaim-dana-kaget24.bxdo.top
free25.cgeb.top
snim.cinxn.top
klaim-dana-kaget25.cvhi.top
klaim-dana-kaget4.d0rf0.top
gardenia.ebry.top
free8.ebrz.top
orange17.ecgtv.top
klaim-dana-kaget22.edtk.top
gopay9.ejcx.top
100gb100.ejky.top
free10.ekfa.top
klaim-dana-kaget195.emgy.top
klaim-dana-kaget1.engm.top
klaim-dana-kaget41.euwm.top
esewa2.fowq.top
esewa15.gesx.top
klaim-dana-kaget42.gnho.top
klaim-dana-kaget32.gruj.top
klaim-dana-kaget46.gwew.top
klaim-dana-kaget15.h6fxt.top
free300.hjej.top
akij.hlvp.top
klaim-dana-kaget17.hzne.top
klaim-dana-kaget28.icyk.top
free3.iezw.top
klaim-dana-kaget27.ijis.top
free35.iltf.top
hari-buruh-spesial17.ipnx.top
free121.ipqtm.top
klaim-dana-kaget29.iusj.top
esewa9.izgk.top
nt.izhd.top
esewa2.jfsv.top
hari-buruh-spesial11.jh7fg.top
esewa378.jkca.top
rs10000-ramzan-relief-package-96.jnqv.top
klaim-dana-kaget1.joir.top
hari-buruh-spesial30.ju7vn.top
esewa3.jynv.top
klaim-dana-kaget42.kajh.top
beeline5.kdzru.top
100gb57.kfha.top
klaim-dana-kaget54.kikd.top
py100gb15.kkjlo.top
gopay40.kmvp.top
py100gb15.ltquz.top
esewa16.lxdo.top
denner.lyzv.top
klaim-dana-kaget5.mhbe.top
klaim-dana-kaget1.mjeo.top
klaim-dana-kaget27.mvyp.top
hari-buruh-spesial30.n7fgh.top
rs10000-ramzan-relief-package-54.ndyv.top
klaim-dana-kaget28.ngxv.top
klaim-dana-kaget146.nhme.top
hari-buruh-spesial.nvek.top
gopay11.nzam.top
free15.ofxl.top
tazeay.ofz6hz.top
free25.onqj.top
abb.orjb6d.top
klaim-dana-kaget6.osdm.top
www-rakuten-card-co-jp.owsf.top
free95.pakm.top
dolima.pasn.top
dana.pwia.top
klaim-dana-kaget4.pzvj.top
free1.qoml.top
walton.qupq.top
orange9.sjmwu.top
debswana.sldlv.top
hari-buruh-spesial141.sqwo.top
free1989.syup.top
free123.tacb.top
kcb.tbobm.top
kaspi.tvwg.top
korzinka.tykv.top
aegean.ujlc.top
100gb47.ustg.top
alfamart.uzct.top
free15.vjor.top
intermarche.vltd.top
klaim-dana-kaget19.vlti.top
100gb1.vokm.top
free8.vpfa.top
klaim-dana-kaget3.vtqy.top
esewa11.vuix.top
free7.wafw.top
rs10000-ramzan-relief-package-205.wajw.top
hari-buruh-spesial50.wd2752.top
hari-buruh-spesial30.wd5626.top
free9.wmih.top
klaim-dana-kaget35.wujk.top
sonali.wvoa.top
arcor.wxfud.top
movit.wxiyy.top
sonibank.xexv.top
free42.xhku.top
kz50gb74.xnhsr.top
klaim-dana-kaget9.xrq8wl.top
100gb5.xtza.top
hari-buruh-spesial15.y68gh.top
trust.yiyg.top
1-mayis-ozel-51gb61.yobp.top
klaim-dana-kaget10.yqax.top
free30.ysiz.top
klaim-dana-kaget23.yuwm.top
euroopt.znbv.top
labor-day-51gb-free123.ztoi.top
labor-day-51gb-free122.zuoh.top
free7.17fdg.xyz
free1148.23fg.xyz
walton.268g.xyz
free13.35dg5.xyz
makro.3p6c.xyz
free1138.3s74.xyz
refriango.3zt11.xyz
free21.44ds2.xyz
walton.4ma7.xyz
free3.4sd1.xyz
free2.7rft.xyz
free4.8h7gh.xyz
1-mayis-ozel-51gb53.8ygu.xyz
free1.b15v.xyz
free13.bnc6d.xyz
free60.bt65d.xyz
free13.bvjb6.xyz
cevital.csszy.xyz
free115.cvh5.xyz
free1137.d8cj.xyz
gp.dxw3.xyz
free137.e6es.xyz
free27.f5cv.xyz
free30.fc15.xyz
boc.ft76h.xyz
superu.gcseo.xyz
netto.gd87g.xyz
klaim-dana-kaget39.gdfgd.xyz
free2.gv2cg.xyz
kbl.gwseo.xyz
free9.h548s.xyz
lidl.h65d4.xyz
free8.hnfy6.xyz
10-mayis-50gb53.jhj7.xyz
free3404.jue9.xyz
biggie.njsj.xyz
free7.nr56s.xyz
free91.ntf67.xyz
free1125.sfd3.xyz
free3.t11f.xyz
free11.vbh66.xyz
free9.x8v2e.xyz
free45.xd456.xyz
free1148.xe22.xyz
free3.xr43.xyz
cactus.zzq2.xyz

Related external source

#1145
uBlockOrigin/uAssets@378b2fa