Add 43.166.138.67 - thetollroads.com lures

[g0d33p3rsec]

Phishing Domain/URL/IP(s):

43.166.138.67
com-3emo.sbs
com-43kw.sbs
com-6qu3.sbs
com-9l0f.sbs
com-a04k.sbs
com-e6n1.sbs
com-j67r.sbs
com-k26d.sbs
com-p0ey.sbs
com-z8xr.cfd
http://thetollroads.com-p0ey.sbs/us/address.html
http://thetollroads.com-6qu3.sbs/us/address.html
http://thetollroads.com-e6n1.sbs/us/address.html
http://thetollroads.com-a04k.sbs/us/address.html
http://thetollroads.com-43kw.sbs/us/address.html
http://thetollroads.com-3emo.sbs/us/address.html
http://thetollroads.com-j67r.sbs/us/address.html
http://thetollroads.com-9l0f.sbs/us/address.html
http://thetollroads.com-k26d.sbs/us/address.html
http://thetollroads.com-z8xr.cfd/us/address.html

Impersonated domain

thetollroads.com

Describe the issue

IP address hosting multiple algorithmically generated domains targeting California's Transportation Corridor Agencies

Related external source

https://urlscan.io/result/a3d56327-d595-4051-9740-27f57129afe0/
https://urlscan.io/result/5c4a74b0-516d-4dbd-b7b0-a7e263e1fe35/
https://urlscan.io/result/c0e4eef1-d85e-4a80-843e-9c2a9ec08b9a/
https://urlscan.io/result/c2ae4b46-f498-46d6-8793-2411dc51597b/
https://urlscan.io/result/664f66b0-7a63-4bc8-b6a7-a624210441c7/
https://urlscan.io/result/b19a737a-8873-4ec4-89d2-f7d789a74abe/
https://urlscan.io/result/9b45050f-279c-4d75-aaa0-78cd4437cf36/
https://urlscan.io/result/192ba308-bdb8-4f03-aaef-1b47ce85ecb4/
https://urlscan.io/result/e22e85e8-348f-4b4f-9dee-80b73d2cd23d/
https://urlscan.io/result/2b5fe955-e934-4f3d-b2b4-2f82beec83cb/

Screenshot

Click to expand