Block Labor Day Free 51GB Phishing domains

[jasongodev]

Prerequisites

• I use the current version of the lists.
• I have blocked the domains in my network for several days now, and the blocking has not caused any disruptions or limitations.

Which blocklist(s) do you use?

Multi ULTIMATE, Threat Intelligence Feeds

Which category do the domain(s) to be blocked belong to?

Malware/Badware/Phishing/Scam

Which domain(s) should be blocked?

1gc2r.top
5b8tv.top
879cv.top
bt8rc.top
c1b2f.top
dihg.top
dquj.top
dzou.top
eujn.top
ezno.top
f1453.top
fvmk.top
gr12x.top
h1ttv.top
hy2238.top
hy7322.top
ij7gv.top
iokd9.top
iwrf.top
jaui.top
jcs11.top
levu.top
ljuf.top
nurc.top
omiw.top
ozpu.top
slru.top
syfo.top
t87bb.top
tcxv8.top
tiyp.top
vsxd.top
woex.top
xcv9r.top
y8699.top
yfav.top

Which website or app accesses the domain(s)?

Facebook
FB Messenger
Various social media

Why should these domain(s) be blocked?

Various phishing posts are being shared and circulated online, most notably on Facebook and FB Messenger, on May 1, 2026 during the Labor Day event in the Philippines. The posts and the malicious websites claim to provide free mobile data credits in exchange of the user's mobile number.

The malicious websites are designed to mimic a Philippine telecommunications company, DITO dito.ph, complete with design elements and fake Facebook comments. It also mentions the other Philippine telcos such as Globe and Smart.

In tests the websites seem not to send any information to any server at all.

It shows a fake progress bar and fake comment input field.

Interacting with the website causes many JavaScript errors.

It also uses cookies and local storage to store benign data.

The share buttons and links redirect to fb-messenger://share/?link= protocol

Inspecting the source code reveals various comments in Russian.

It also loads an external script single.php which contains ads redirection codes:

The ads redirection routine leads to go.php which then redirects to random ads. As of this writing it redirects to cdn.lcwss.com. Notice that it tracks the IP address of the user.

The usual subdomain used for these malicious domains are labor-day-51gb-free1 and labor-day-51gb-free8. However, any random subdomain is an alias to the same malicious content.

External References

https://urlscan.io/result/019de5e9-f17d-774c-9aac-64638f44c3a4/related/
Phishing-Database/phishing#1145

Not listed as of this reporting

Ultimate: 2026.0501.1841.53
TIF: 2026.0501.1734.00

Confirmation

• I have verified that no existing issue explains why the domain(s) were previously unblocked or why the blocking request was declined.
• I have verified that the domain(s) is/are not already blocked.
• I have verified that the domain(s) is/are active and not inactive (dead).
• I have provided sufficient details to justify the need for blocking the domain(s).
• I did not answer truthfully to any of the above checkboxes.

Terms

• I confirm that the request does not contain any sexually explicit material or private/sensitive information.

[github-actions]

Thank you for your support. Ping @MikhailKasimov for checking and possibly including the domain(s).

[github-actions]

Thank you for your support. The issue is scheduled to be fixed in the next release.
Please do not make any further changes to this issue. Any changes made after this point will not be taken into consideration. If additional updates are required, please open a new issue.
You will be notified when the issue is finally fixed.
Please keep the issue open; it will be automatically closed in the next release.

[github-actions]

This issue has been fixed in release 37522026.122.36008