add westernautomobileassembly.com to add-wildcard-domain

[g0d33p3rsec]

Phishing Domain/URL/IP(s):

https://westernautomobileassembly.com/M3YydzlMOUYxQzR3M1o=
https://westernautomobileassembly.com/M3cyVjliOWwxRDljOVc=
https://westernautomobileassembly.com/M0YydTJvN000ejRqOTg=
https://westernautomobileassembly.com/MzIyMjl0OVk0eDdpN0Y
https://westernautomobileassembly.com/M1IycTl5OVc4NzRUMzM=
https://westernautomobileassembly.com/M2EySzlUOXc3bTNRN0s=
https://westernautomobileassembly.com/M0YyTjc1OGc2ZDZPMzI=
https://westernautomobileassembly.com/M2gyNjlwOUc0RjlPNW8=
https://westernautomobileassembly.com/M0wyRjhjNjMyaDB4MU8=
https://westernautomobileassembly.com/M2MyeTl3NHUwTzdZOWU= 
https://westernautomobileassembly.com/MzYyTzlhOUU0Yjl1NUQ=
https://westernautomobileassembly.com/M2IySDl6ODM1ZjBvNzY=
https://westernautomobileassembly.com/M1IyTjV4OGk5czZYNVE=
https://westernautomobileassembly.com/M2EySzdhOE4zTjJaNVY=
https://westernautomobileassembly.com/M1MyeTlmOVc5NTVMN0w=
https://westernautomobileassembly.com/M3czdTBCMEkwQjc1OHk= 
https://westernautomobileassembly.com/Mmw3WDd3MTc5TDFiNEo=
https://westernautomobileassembly.com/M1UyeTl6OWg2dzBlN0o=
https://westernautomobileassembly.com/M0MyczlZM1MySjBBMUs=
https://westernautomobileassembly.com/M2EzNTBkMHMwYjRpOXk
https://westernautomobileassembly.com/M0UyYjlBODA1cDMxOTI=
https://westernautomobileassembly.com/M2YwZzk2MnYzVjZhNlA=
https://westernautomobileassembly.com/M3cyVzZ3OEIyMTBOOXk=
https://westernautomobileassembly.com/M1QyZDNoOTQxVDNxN20=
https://westernautomobileassembly.com/M1oyUTg2N3U3NDd2N1E= 
https://westernautomobileassembly.com/M2cwVTUxNEIxOTFXM3I=
https://westernautomobileassembly.com/M20zNjBPMDYxQjFiMng=
https://westernautomobileassembly.com/M2MzdDB2MDM2ODc2OU0=
https://westernautomobileassembly.com/M1gyaDk2MU8xcjZVNEE=
https://westernautomobileassembly.com/Mmc4TTNaNzQ0RTNGNlU=
https://westernautomobileassembly.com/MlAzNzJCME85cDd1NEk= 
https://westernautomobileassembly.com/MkY3azNFMnkzWjRWN0Y=
https://westernautomobileassembly.com/MzUzMjA2MVMzZDdVNHM=
https://westernautomobileassembly.com/M20zRDBUMFUxbDQ1Nm4=
https://westernautomobileassembly.com/M1YzTjBNMUQ0aTNmNWM=
https://westernautomobileassembly.com/M2cyZDlROXE2VTRYMVI=
https://westernautomobileassembly.com/M0czNTBEMHU4UDIzOWg=
https://westernautomobileassembly.com/M3MxejNYMjQwbjJ4MWE=
https://westernautomobileassembly.com/M3YxVDFEOTg4MTk5OXE=
https://westernautomobileassembly.com/Mlg4OTY2M0Y0WDZVMlM= 
https://westernautomobileassembly.com/M0QyRzkzOVo0NDNOMEE=
https://westernautomobileassembly.com/M2YzcTBLMUg1VjlyNjQ=
https://westernautomobileassembly.com/MzAyQzhnNjkyUjQyOWM=
https://westernautomobileassembly.com/MzQyMzZGMmo4aDVSN0Y= 
https://westernautomobileassembly.com/MzEyRDkwOTE3VTN4MVY=
https://westernautomobileassembly.com/M1gxbjdDNWg4SjdRNjU=
https://westernautomobileassembly.com/M2sydTlGNkQ4SDhSOFg=
https://westernautomobileassembly.com/M1gzMTAyMEI2YjkzMEY=
https://westernautomobileassembly.com/M2kxQzJqNkQ3dDF4OE4=
https://westernautomobileassembly.com/M1UzNzB4MnMwUjdiNUQ=
https://westernautomobileassembly.com/M3QyNDhSNTI4VjhsOVg=
https://westernautomobileassembly.com/MnY5bjFNNGs0bzVzODM=
https://westernautomobileassembly.com/M2MyYzQwOXk4dDRsNFY=
https://westernautomobileassembly.com/M0IzVjBjMlMzZzJrOGQ=
https://westernautomobileassembly.com/M3MyWTZXNTM1MjRIM08= 

Impersonated domain

https://facebook.com/
https://metamask.io/
https://www.betway.co.za
https://sunbet.co.za/
https://easybet.co.za/
https://www.hollywoodbets.net/spina-zonke/all
https://gamesredeem.com/ 
https://ff.garena.com
https://www.tut.ac.za/
https://www.ufh.ac.za/
https://www.ufs.ac.za/
https://ww1.ukzn.ac.za/
https://www.uwc.ac.za/
https://www.wits.ac.za/

Describe the issue

This site is now hosting the kit that was previously at littleswanaircon[.]com[.]sg(#372 ), iwan2travel[.]com (#370 ), applesforfred[.]com(#369), theaerie[.]ca (#367), nico[.]sa (#366), and ajstelecom[.]com[.]mx (#362)

Related external source

Screenshot

Click to expand

[g0d33p3rsec]

As mentioned in mypdns/matrix#463 (comment), I took a look at the web root of the compromised domain today and noticed this.