#infobloxthreatintel — Public Fediverse posts

🚨 Tax Season, Scam Season: Lookalike Domains Target Spain’s Agencia Tributaria

Today (April 8), the tax filing and refund period officially starts in Spain — and as expected, so do the scams.

We’ve identified multiple new registrations of lookalike domains impersonating Spain’s official tax authority (Agencia Tributaria) happening over the past weeks, including:

agenciatributaria-gob[.]com
agencia-tributaria[.]im
agenciatributaria[.]de
sede-agenciatributaria[.]com

Threat actors moved so fast that some campaigns were launched before the official refund process even started, already promising generous (and obviously fake) tax refunds.

For example, agencia-tributaria[.]im advertises refunds of €250+ — a clear lure.

Laughs aside, while they may not be the smartest in terms of timing, they are learning new tricks. We’ve been talking a lot about TDSs lately, and they seem to like them too.

That same domain redirects users almost instantly to a malicious phishing landing page if they match the attacker’s targeting criteria. However, when accessed from a Linux virtual machine, fingerprinting likely flags a security analyst environment — and suddenly you’re redirected to the lovely and familiar "google[.]com" page, never seeing a second of the phishing content. The same seems to occur if you access it from another country.

They may have been fast starting their campaigns (maybe too fast)…but we’re faster finding them!

#dns #infoblox
#infobloxthreatintel
#threatintel
#threatintelligence
#cybercrime
#cybersecurity #phishing #scam
#spain #agenciatributaria #declaraciondelarenta

🏇 Sports and gambling are long time partners, and the 2026 Winter Olympics is no exception. 🥇 🏂

In recent years, higher adoption of digital payment methods, cheaper mobile internet, and legalization in more jurisdictions have rapidly expanded online gambling. Industry forecasts put the market at about USD 153 billion by 2030. Although more regions have moved from bans to regulated licensing, it hasn't eliminated illicit activities. There are many providers that are unlicensed, use offshore operators, and have been implicated in unlawful practices. One of the most prominent and controversial platforms is 1XBET, which offers betting on football, esports, and even weather events. Numerous investigative groups have questioned the legitimacy of 1XBET, and many users associate it with scams.

Last week, we observed a 1XBET email spam campaign targeting Burmese internet users. Emails were sent from mailer[@]1xbet[.]com via Melbicom SMTP servers (AS 56630) with the subject ❄️ 1xBet ရဲ့ Winter Olympics မှာ ပါဝင်ပြီး Legend တစ်ယောက် ဖြစ်လာလိုက်ပါ။. They also targeted the same audience through their Facebook account at https://www.facebook.com/mmsportsnet/.

Although online gambling is technically illegal in Myanmar, 1XBET continues to reach users through numerous mirror sites that can be quickly replaced when blocked. They also apply geo‑gating for additional protection. Our initial access attempt to 1xlite-03801[.]world was blocked, but switching to a South Asian endpoint allowed us to reach content at 1xlite-17342[.]bar.

Below is a subset of domains we have attributed to 1XBET and the associated spam campaign.

Mirror site domains:
10x-bet[.]org,10xbet[.]icu,11xslp[.]top,14xsl[.]top,1ex-bet[.]net,1x-bat[.]net,1x-vet[.]com,1xbat[.]xyz,1xbatdownload[.]com,1xbate[.]com,1xbeat[.]net,1xbed[.]net,1xbeet[.]icu,1xbetdemoaccount[.]com,1xbetslipcheck[.]com,1xbettingapp[.]com,1xbey[.]net,1xbst[.]org,1xbwt[.]org,1xdet[.]net,1xlk-chickenroad[.]com,1xslopi[.]top,1z-bet[.]com,2xslops[.]top,3xslo[.]top,42sport[.]ph,4xslo[.]top,5xslops[.]top,6xslops[.]top

Geo-gate / Landing page domains:
1xlite-03801[.]world,1xlite-048726[.]top,1xlite-107192[.]top,1xlite-17342[.]bar

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #sportsbetting #onlinegambling #gambling #betting #1xbet #myanmar #winterolympics #olympics #spam