Update add-wildcard-domain to include bersowir.org

[g0d33p3rsec]

Phishing Domain/URL/IP(s):

https://bersowir.org/MzgzaTkxMmY3cDJCMDY=
https://bersowir.org/M3AzUDk1NHMxeDQ2NG8=
https://bersowir.org/MzQzdTZoOWYzNTFZN0U=
https://bersowir.org/M0YzMTljMzQzRTR6OFE=
https://bersowir.org/M0EwWDFIM2g1dTdlNWY=
https://bersowir.org/M0szajRKMnQ0STJSM1E=
https://bersowir.org/MzEzZTl5MzM0SjdoMkc=
https://bersowir.org/M0MzSzh0N2Q2TDc0M1Y=
https://bersowir.org/MzgzWTlUM3Y5UzVkMk8=
https://bersowir.org/M1gzWTlYNFgwUTRWNzc=
https://bersowir.org/M1czczlMNDk1WjJGNUs=
https://bersowir.org/M0MzQjltNGc5MDRzMjM=
https://bersowir.org/M1AzRTlLMUsyYjZWOHQ=
https://bersowir.org/M3UzRTdHM3EzTjluMHk=
https://bersowir.org/M3kzZTlxNGE1UzZkOWY=
https://bersowir.org/M0czNDF5OVU5ZzZNM3A=
https://bersowir.org/MzMzMzdOMHQ1VDhZMG0=
https://bersowir.org/M2swUjgyM0s1ZTVVOFI=
https://bersowir.org/MzMzazVNN3E4Rjc3NnQ=
https://bersowir.org/M0wwaDhkOXkxZTVxOUM=
https://bersowir.org/M0kzNDlMMzU0NzhkN0Q=
https://bersowir.org/M0UzQjh0N1M2QjdWM20=
https://bersowir.org/M2YzUjlrMzk5bjlMMWM=
https://bersowir.org/MzMzVTdNNkc4STFpOGc=
https://bersowir.org/M0gzSzI0OVMzcDNUOFM=
https://bersowir.org/M1kzWjlJNDc1WDVLNGs=
https://bersowir.org/MkE3YTNCMmozZDQyNzk=
https://bersowir.org/M2MzbjU2MlczVTJVOE0=
https://bersowir.org/Mno5QjFHNFA0QjA4NjI=
https://bersowir.org/M1IzZTdVMkE3YjN4NTA=
https://bersowir.org/M0UzVTl0M0U1MjQ0Mk4=
https://bersowir.org/M2czVTl6M1A5WjhROVc=
https://bersowir.org/M08zRzhsNVQ2Sjc5OWg=

Impersonated domain

https://facebook.com/
https://www.google.com
https://www.betway.co.za
https://www.1voucher.co.za/
https://ff.garena.com/
https://trustwallet.com/
https://www.uefa.com/euro2024/
https://www.tut.ac.za/
https://www.wsu.ac.za/
https://srd.sassa.gov.za/

Describe the issue

This domain is now hosting the phishing kit that was previously at brunotasso[.]com[.]br (#413), wisbechguide[.]uk (#408), pescacancun[.]com (#406), bkengineersindia[.]com(#405), englishplusmore[.]com(#404), carnesboinobre[.]com[.]br(#398), technowide[.]com[.]tr(#396), jestertunes[.]com (#393), safecartusa[.]com (#391), foreverfarley[.]com (#387), azezieldraconous[.]com (#381), westernautomobileassembly[.]com (#376) , littleswanaircon[.]com[.]sg (#372), iwan2travel[.]com(#370), applesforfred[.]com (#369), theaerie[.]ca (#367), nico[.]sa (#366), ajstelecom[.]com[.]mx (#362), and others (more than 120 domains since 2021).

Related external source

Screenshot

Click to expand

[g0d33p3rsec]

Looking at the Virus Total results for this domain leads to this maldoc, which was submitted yesterday. The maldoc, in turn, reaches out to several files via http://151.139.177.50.

Adding to the list of things to follow up on.