Malicious Domains Capitalizing on Popularity of Labubu and Pop Mart

    Date: 07/02/2025

    Severity: High

    Summary

    Labubu, part of "The Monsters" collectible series by toy company POP MART, has grown significantly in popularity.  This surge has coincided with a rise in newly registered domains (NRDs) linked to Labubu and POP MART. Many of these domains are being used for cryptocurrency scams, gambling sites, or impersonating official Labubu and POP MART pages. These malicious NRDs exploit the brand’s popularity to deceive unsuspecting users.

    Indicators of Compromise (IOC) List 

    Domains\URLs:

    exepopmart.com

    francepopmart.com

    freelabubu.site

    frpopmart.com

    hk-popmart.com

    hongkong-popmart.com

    kf-labubupg.com

    kup-labubu.shop

    labubu-777.com

    labubu-official-popmart.com

    labubu-pop.fr

    labubu188.net

    labubu4u.top

    labubu777.bet

    labububig.com

    labubucoin.me

    labubucollection.store

    labubueshop.com

    labubufun.net

    labubuhype.shop

    labubulovers.shop

    labubuofficial.com.co

    labubuonlines.shop

    labubuonlinestore.com

    labubusale.com

    labubusol.lol

    labubustock.com

    labubustore.cc

    labubuvip.shop

    mypopmart.shop

    mypopmart.store

    pop-marts.com.mx

    pop-marts.com.se

    pop-marts.de

    pop-marts.es

    pop-marts.fr

    pop-marts.it

    pop-marts.ro

    popmart-au.com

    popmart-australia.com

    popmart-ca.com

    popmart-dubai.com

    popmart-france.com

    popmart-global.com

    popmart-nl.com

    popmart-nz.com

    popmart-schweiz.com

    popmart-shop.com

    popmart-shop.store

    popmart-shtop.club

    popmart-us.us

    popmart-usa.shop

    popmart-usaonline.store

    popmart.boutique

    popmart1.vip

    popmartae.com

    popmartappdl.vip

    popmartau.com

    popmartbuyer.fun

    popmartclub.shop

    popmartdk.com

    popmartdoll.shop

    popmarter.com

    popmarteurope.com

    popmarthome.online

    popmartindia.store

    popmartksa.com

    popmartlabs.com

    popmartme.com

    popmartmonster.com

    popmarts-uk.com

    popmarts.cn

    popmarts.co.nz

    popmartsales.com

    popmartshop-uk.com

    popmartshop.top

    popmartshow.com

    popmartstore.co

    popmartstoresale.com

    popmartsuk.com

    popmartusa.net

    popomart.cc

    popomlabubu.shop

    popousmart.com

    poppmmart.com

    popppmart.com

    popularmart.cc

    popularmart.top

    popusmart.shop

    superpopmart.com

    thepopmart.com.tr

    uaepopmart.store

    usa-popmart.shop

    usa-popmart.shop

    usapopmart.net

    ustoypopmart.com

    zimomo-eth.xyz

    zimnomocoin.com

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Domains\URLs 1:

    domainname like "freelabubu.site" or url like "freelabubu.site" or siteurl like "freelabubu.site" or domainname like "popularmart.cc" or url like "popularmart.cc" or siteurl like "popularmart.cc" or domainname like "popmartshop-uk.com" or url like "popmartshop-uk.com" or siteurl like "popmartshop-uk.com" or domainname like "labubusale.com" or url like "labubusale.com" or siteurl like "labubusale.com" or domainname like "popmarteurope.com" or url like "popmarteurope.com" or siteurl like "popmarteurope.com" or domainname like "popmartclub.shop" or url like "popmartclub.shop" or siteurl like "popmartclub.shop" or domainname like "hongkong-popmart.com" or url like "hongkong-popmart.com" or siteurl like "hongkong-popmart.com" or domainname like "popusmart.shop" or url like "popusmart.shop" or siteurl like "popusmart.shop" or domainname like "labubuhype.shop" or url like "labubuhype.shop" or siteurl like "labubuhype.shop" or domainname like "popularmart.top" or url like "popularmart.top" or siteurl like "popularmart.top" or domainname like "labubu188.net" or url like "labubu188.net" or siteurl like "labubu188.net" or domainname like "kup-labubu.shop" or url like "kup-labubu.shop" or siteurl like "kup-labubu.shop" or domainname like "popomart.cc" or url like "popomart.cc" or siteurl like "popomart.cc" or domainname like "popmart-shop.com" or url like "popmart-shop.com" or siteurl like "popmart-shop.com" or domainname like "popmarts.cn" or url like "popmarts.cn" or siteurl like "popmarts.cn" or domainname like "usa-popmart.shop" or url like "usa-popmart.shop" or siteurl like "usa-popmart.shop" or domainname like "popmartshop.top" or url like "popmartshop.top" or siteurl like "popmartshop.top" or domainname like "labubulovers.shop" or url like "labubulovers.shop" or siteurl like "labubulovers.shop" or domainname like "popmart-nz.com" or url like "popmart-nz.com" or siteurl like "popmart-nz.com" or domainname like "labubueshop.com" or url like "labubueshop.com" or siteurl like "labubueshop.com" or domainname like "popmart1.vip" or url like "popmart1.vip" or siteurl like "popmart1.vip" or domainname like "popmart-usa.shop" or url like "popmart-usa.shop" or siteurl like "popmart-usa.shop" or domainname like "popomlabubu.shop" or url like "popomlabubu.shop" or siteurl like "popomlabubu.shop" or domainname like "labubusol.lol" or url like "labubusol.lol" or siteurl like "labubusol.lol" or domainname like "francepopmart.com" or url like "francepopmart.com" or siteurl like "francepopmart.com" or domainname like "labubu4u.top" or url like "labubu4u.top" or siteurl like "labubu4u.top" or domainname like "labubuvip.shop" or url like "labubuvip.shop" or siteurl like "labubuvip.shop" or domainname like "frpopmart.com" or url like "frpopmart.com" or siteurl like "frpopmart.com"

    Domains\URLs 2:

    domainname like "exepopmart.com" or url like "exepopmart.com" or siteurl like "exepopmart.com" or domainname like "hk-popmart.com" or url like "hk-popmart.com" or siteurl like "hk-popmart.com" or domainname like "kf-labubupg.com" or url like "kf-labubupg.com" or siteurl like "kf-labubupg.com" or domainname like "labubu-777.com" or url like "labubu-777.com" or siteurl like "labubu-777.com" or domainname like "labubu-official-popmart.com" or url like "labubu-official-popmart.com" or siteurl like "labubu-official-popmart.com" or domainname like "labubu-pop.fr" or url like "labubu-pop.fr" or siteurl like "labubu-pop.fr" or domainname like "labubu777.bet" or url like "labubu777.bet" or siteurl like "labubu777.bet" or domainname like "labububig.com" or url like "labububig.com" or siteurl like "labububig.com" or domainname like "labubucoin.me" or url like "labubucoin.me" or siteurl like "labubucoin.me" or domainname like "labubucollection.store" or url like "labubucollection.store" or siteurl like "labubucollection.store" or domainname like "labubufun.net" or url like "labubufun.net" or siteurl like "labubufun.net" or domainname like "labubuofficial.com.co" or url like "labubuofficial.com.co" or siteurl like "labubuofficial.com.co" or dominname like "labubuonlines.shop" or url like "labubuonlines.shop" or siteurl like "labubuonlines.shop" or domainname like "labubuonlinestore.com" or url like "labubuonlinestore.com" or siteurl like "labubuonlinestore.com" or domainname like "labubustock.com" or url like "labubustock.com" or siteurl like "labubustock.com" or domainname like "labubustore.cc" or url like "labubustore.cc" or siteurl like "labubustore.cc" or domainname like "mypopmart.shop" or url like "mypopmart.shop" or siteurl like "mypopmart.shop" or domainname like "mypopmart.store" or url like "mypopmart.store" or siteurl like "mypopmart.store" or domainname like "pop-marts.com.mx" or url like "pop-marts.com.mx" or siteurl like "pop-marts.com.mx" or domainname like "pop-marts.com.se" or url like "pop-marts.com.se" or siteurl like "pop-marts.com.se" or domainname like "pop-marts.de" or url like "pop-marts.de" or siteurl like "pop-marts.de" or domainname like "pop-marts.es" or url like "pop-marts.es" or siteurl like "pop-marts.es" or domainname like "pop-marts.fr" or url like "pop-marts.fr" or siteurl like "pop-marts.fr" or domainname like "pop-marts.it" or url like "pop-marts.it" or siteurl like "pop-marts.it"

    Domains\URLs 3:

    domainname like "pop-marts.ro" or url like "pop-marts.ro" or siteurl like "pop-marts.ro" or domainname like "popmart-au.com" or url like "popmart-au.com" or siteurl like "popmart-au.com" or domainname like "popmart-australia.com" or url like "popmart-australia.com" or siteurl like "popmart-australia.com" or domainname like "popmart-ca.com" or url like "popmart-ca.com" or siteurl like "popmart-ca.com" or domainname like "popmart-dubai.com" or url like "popmart-dubai.com" or siteurl like "popmart-dubai.com" or domainname like "popmart-france.com" or url like "popmart-france.com" or siteurl like "popmart-france.com" or domainname like "popmart-global.com" or url like "popmart-global.com" or siteurl like "popmart-global.com" or domainname like "popmart-nl.com" or url like "popmart-nl.com" or siteurl like "popmart-nl.com" or domainname like "popmart-schweiz.com" or url like "popmart-schweiz.com" or siteurl like "popmart-schweiz.com" or domainname like "popmart-shop.store" or url like "popmart-shop.store" or siteurl like "popmart-shop.store" or domainname like "popmart-shtop.club" or url like "popmart-shtop.club" or siteurl like "popmart-shtop.club" or domainname like "popmart-us.us" or url like "popmart-us.us" or siteurl like "popmart-us.us" or domainname like "popmart-usaonline.store" or url like "popmart-usaonline.store" or siteurl like "popmart-usaonline.store" or domainname like "popmart.boutique" or url like "popmart.boutique" or siteurl like "popmart.boutique" or domainname like "popmartae.com" or url like "popmartae.com" or siteurl like "popmartae.com" or domainname like "popmartappdl.vip" or url like "popmartappdl.vip" or siteurl like "popmartappdl.vip" or domainname like "popmartau.com" or url like "popmartau.com" or siteurl like "popmartau.com" or domainname like "popmartbuyer.fun" or url like "popmartbuyer.fun" or siteurl like "popmartbuyer.fun" or domainname like "popmartdk.com" or url like "popmartdk.com" or siteurl like "popmartdk.com" or domainname like "popmartdoll.shop" or url like "popmartdoll.shop" or siteurl like "popmartdoll.shop" or domainname like "popmarter.com" or url like "popmarter.com" or siteurl like "popmarter.com" or domainname like "popmarthome.online" or url like "popmarthome.online" or siteurl like "popmarthome.online" or domainname like "popmartindia.store" or url like "popmartindia.store" or siteurl like "popmartindia.store" or domainname like "popmartksa.com" or url like "popmartksa.com" or siteurl like "popmartksa.com" or domainname like "popmartlabs.com" or url like "popmartlabs.com" or siteurl like "popmartlabs.com" or domainname like "popmartme.com" or url like "popmartme.com" or siteurl like "popmartme.com" or domainname like "popmartmonster.com" or url like "popmartmonster.com" or siteurl like "popmartmonster.com" or domainname like "popmarts-uk.com" or url like "popmarts-uk.com" or siteurl like "popmarts-uk.com" or domainname like "popmarts.co.nz" or url like "popmarts.co.nz" or siteurl like "popmarts.co.nz" or domainname like "popmartsales.com" or url like "popmartsales.com" or siteurl like "popmartsales.com" or domainname like "popmartshow.com" or url like "popmartshow.com" or siteurl like "popmartshow.com" or domainname like "popmartstore.co" or url like "popmartstore.co" or siteurl like "popmartstore.co" or domainname like "popmartstoresale.com" or url like "popmartstoresale.com" or siteurl like "popmartstoresale.com" or domainname like "popmartsuk.com" or url like "popmartsuk.com" or siteurl like "popmartsuk.com" 

    Domains\URLs 4:

    domainname like "popmartusa.net" or siteurl like "popmartusa.net" or url like "popmartusa.net" or domainname like "popousmart.com" or siteurl like "popousmart.com" or url like "popousmart.com" or domainname like "poppmmart.com" or siteurl like "poppmmart.com" or url like "poppmmart.com" or domainname like "superpopmart.com" or siteurl like "superpopmart.com" or url like "superpopmart.com" or domainname like "thepopmart.com.tr" or siteurl like "thepopmart.com.tr" or url like "thepopmart.com.tr" or domainname like "uaepopmart.store" or siteurl like "uaepopmart.store" or url like "uaepopmart.store" or domainname like "usapopmart.net" or siteurl like "usapopmart.net" or url like "usapopmart.net" or domainname like "ustoypopmart.com" or siteurl like "ustoypopmart.com" or url like "ustoypopmart.com" or domainname like "zimomo-eth.xyz" or siteurl like "zimomo-eth.xyz" or url like "zimomo-eth.xyz" or domainname like "zimnomocoin.com" or siteurl like "zimnomocoin.com" or url like "zimnomocoin.com"

    Reference:    

    https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-06-30-IOCs-for-Labubu-scam-domains.txt 


    Tags

    Threat ActorLabubuPOP MARTcryptocurrencyGambling WebsitesExploit

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags