Date: 07/02/2025
Severity: High
Summary
Labubu, part of "The Monsters" collectible series by toy company POP MART, has grown significantly in popularity. This surge has coincided with a rise in newly registered domains (NRDs) linked to Labubu and POP MART. Many of these domains are being used for cryptocurrency scams, gambling sites, or impersonating official Labubu and POP MART pages. These malicious NRDs exploit the brand’s popularity to deceive unsuspecting users.
Indicators of Compromise (IOC) List
Domains\URLs: | exepopmart.com francepopmart.com freelabubu.site frpopmart.com hk-popmart.com hongkong-popmart.com kf-labubupg.com kup-labubu.shop labubu-777.com labubu-official-popmart.com labubu-pop.fr labubu188.net labubu4u.top labubu777.bet labububig.com labubucoin.me labubucollection.store labubueshop.com labubufun.net labubuhype.shop labubulovers.shop labubuofficial.com.co labubuonlines.shop labubuonlinestore.com labubusale.com labubusol.lol labubustock.com labubustore.cc labubuvip.shop mypopmart.shop mypopmart.store pop-marts.com.mx pop-marts.com.se pop-marts.de pop-marts.es pop-marts.fr pop-marts.it pop-marts.ro popmart-au.com popmart-australia.com popmart-ca.com popmart-dubai.com popmart-france.com popmart-global.com popmart-nl.com popmart-nz.com popmart-schweiz.com popmart-shop.com popmart-shop.store popmart-shtop.club popmart-us.us popmart-usa.shop popmart-usaonline.store popmart.boutique popmart1.vip popmartae.com popmartappdl.vip popmartau.com popmartbuyer.fun popmartclub.shop popmartdk.com popmartdoll.shop popmarter.com popmarteurope.com popmarthome.online popmartindia.store popmartksa.com popmartlabs.com popmartme.com popmartmonster.com popmarts-uk.com popmarts.cn popmarts.co.nz popmartsales.com popmartshop-uk.com popmartshop.top popmartshow.com popmartstore.co popmartstoresale.com popmartsuk.com popmartusa.net popomart.cc popomlabubu.shop popousmart.com poppmmart.com popppmart.com popularmart.cc popularmart.top popusmart.shop superpopmart.com thepopmart.com.tr uaepopmart.store usa-popmart.shop usa-popmart.shop usapopmart.net ustoypopmart.com zimomo-eth.xyz zimnomocoin.com |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Domains\URLs 1: | domainname like "freelabubu.site" or url like "freelabubu.site" or siteurl like "freelabubu.site" or domainname like "popularmart.cc" or url like "popularmart.cc" or siteurl like "popularmart.cc" or domainname like "popmartshop-uk.com" or url like "popmartshop-uk.com" or siteurl like "popmartshop-uk.com" or domainname like "labubusale.com" or url like "labubusale.com" or siteurl like "labubusale.com" or domainname like "popmarteurope.com" or url like "popmarteurope.com" or siteurl like "popmarteurope.com" or domainname like "popmartclub.shop" or url like "popmartclub.shop" or siteurl like "popmartclub.shop" or domainname like "hongkong-popmart.com" or url like "hongkong-popmart.com" or siteurl like "hongkong-popmart.com" or domainname like "popusmart.shop" or url like "popusmart.shop" or siteurl like "popusmart.shop" or domainname like "labubuhype.shop" or url like "labubuhype.shop" or siteurl like "labubuhype.shop" or domainname like "popularmart.top" or url like "popularmart.top" or siteurl like "popularmart.top" or domainname like "labubu188.net" or url like "labubu188.net" or siteurl like "labubu188.net" or domainname like "kup-labubu.shop" or url like "kup-labubu.shop" or siteurl like "kup-labubu.shop" or domainname like "popomart.cc" or url like "popomart.cc" or siteurl like "popomart.cc" or domainname like "popmart-shop.com" or url like "popmart-shop.com" or siteurl like "popmart-shop.com" or domainname like "popmarts.cn" or url like "popmarts.cn" or siteurl like "popmarts.cn" or domainname like "usa-popmart.shop" or url like "usa-popmart.shop" or siteurl like "usa-popmart.shop" or domainname like "popmartshop.top" or url like "popmartshop.top" or siteurl like "popmartshop.top" or domainname like "labubulovers.shop" or url like "labubulovers.shop" or siteurl like "labubulovers.shop" or domainname like "popmart-nz.com" or url like "popmart-nz.com" or siteurl like "popmart-nz.com" or domainname like "labubueshop.com" or url like "labubueshop.com" or siteurl like "labubueshop.com" or domainname like "popmart1.vip" or url like "popmart1.vip" or siteurl like "popmart1.vip" or domainname like "popmart-usa.shop" or url like "popmart-usa.shop" or siteurl like "popmart-usa.shop" or domainname like "popomlabubu.shop" or url like "popomlabubu.shop" or siteurl like "popomlabubu.shop" or domainname like "labubusol.lol" or url like "labubusol.lol" or siteurl like "labubusol.lol" or domainname like "francepopmart.com" or url like "francepopmart.com" or siteurl like "francepopmart.com" or domainname like "labubu4u.top" or url like "labubu4u.top" or siteurl like "labubu4u.top" or domainname like "labubuvip.shop" or url like "labubuvip.shop" or siteurl like "labubuvip.shop" or domainname like "frpopmart.com" or url like "frpopmart.com" or siteurl like "frpopmart.com" |
Domains\URLs 2: | domainname like "exepopmart.com" or url like "exepopmart.com" or siteurl like "exepopmart.com" or domainname like "hk-popmart.com" or url like "hk-popmart.com" or siteurl like "hk-popmart.com" or domainname like "kf-labubupg.com" or url like "kf-labubupg.com" or siteurl like "kf-labubupg.com" or domainname like "labubu-777.com" or url like "labubu-777.com" or siteurl like "labubu-777.com" or domainname like "labubu-official-popmart.com" or url like "labubu-official-popmart.com" or siteurl like "labubu-official-popmart.com" or domainname like "labubu-pop.fr" or url like "labubu-pop.fr" or siteurl like "labubu-pop.fr" or domainname like "labubu777.bet" or url like "labubu777.bet" or siteurl like "labubu777.bet" or domainname like "labububig.com" or url like "labububig.com" or siteurl like "labububig.com" or domainname like "labubucoin.me" or url like "labubucoin.me" or siteurl like "labubucoin.me" or domainname like "labubucollection.store" or url like "labubucollection.store" or siteurl like "labubucollection.store" or domainname like "labubufun.net" or url like "labubufun.net" or siteurl like "labubufun.net" or domainname like "labubuofficial.com.co" or url like "labubuofficial.com.co" or siteurl like "labubuofficial.com.co" or dominname like "labubuonlines.shop" or url like "labubuonlines.shop" or siteurl like "labubuonlines.shop" or domainname like "labubuonlinestore.com" or url like "labubuonlinestore.com" or siteurl like "labubuonlinestore.com" or domainname like "labubustock.com" or url like "labubustock.com" or siteurl like "labubustock.com" or domainname like "labubustore.cc" or url like "labubustore.cc" or siteurl like "labubustore.cc" or domainname like "mypopmart.shop" or url like "mypopmart.shop" or siteurl like "mypopmart.shop" or domainname like "mypopmart.store" or url like "mypopmart.store" or siteurl like "mypopmart.store" or domainname like "pop-marts.com.mx" or url like "pop-marts.com.mx" or siteurl like "pop-marts.com.mx" or domainname like "pop-marts.com.se" or url like "pop-marts.com.se" or siteurl like "pop-marts.com.se" or domainname like "pop-marts.de" or url like "pop-marts.de" or siteurl like "pop-marts.de" or domainname like "pop-marts.es" or url like "pop-marts.es" or siteurl like "pop-marts.es" or domainname like "pop-marts.fr" or url like "pop-marts.fr" or siteurl like "pop-marts.fr" or domainname like "pop-marts.it" or url like "pop-marts.it" or siteurl like "pop-marts.it" |
Domains\URLs 3: | domainname like "pop-marts.ro" or url like "pop-marts.ro" or siteurl like "pop-marts.ro" or domainname like "popmart-au.com" or url like "popmart-au.com" or siteurl like "popmart-au.com" or domainname like "popmart-australia.com" or url like "popmart-australia.com" or siteurl like "popmart-australia.com" or domainname like "popmart-ca.com" or url like "popmart-ca.com" or siteurl like "popmart-ca.com" or domainname like "popmart-dubai.com" or url like "popmart-dubai.com" or siteurl like "popmart-dubai.com" or domainname like "popmart-france.com" or url like "popmart-france.com" or siteurl like "popmart-france.com" or domainname like "popmart-global.com" or url like "popmart-global.com" or siteurl like "popmart-global.com" or domainname like "popmart-nl.com" or url like "popmart-nl.com" or siteurl like "popmart-nl.com" or domainname like "popmart-schweiz.com" or url like "popmart-schweiz.com" or siteurl like "popmart-schweiz.com" or domainname like "popmart-shop.store" or url like "popmart-shop.store" or siteurl like "popmart-shop.store" or domainname like "popmart-shtop.club" or url like "popmart-shtop.club" or siteurl like "popmart-shtop.club" or domainname like "popmart-us.us" or url like "popmart-us.us" or siteurl like "popmart-us.us" or domainname like "popmart-usaonline.store" or url like "popmart-usaonline.store" or siteurl like "popmart-usaonline.store" or domainname like "popmart.boutique" or url like "popmart.boutique" or siteurl like "popmart.boutique" or domainname like "popmartae.com" or url like "popmartae.com" or siteurl like "popmartae.com" or domainname like "popmartappdl.vip" or url like "popmartappdl.vip" or siteurl like "popmartappdl.vip" or domainname like "popmartau.com" or url like "popmartau.com" or siteurl like "popmartau.com" or domainname like "popmartbuyer.fun" or url like "popmartbuyer.fun" or siteurl like "popmartbuyer.fun" or domainname like "popmartdk.com" or url like "popmartdk.com" or siteurl like "popmartdk.com" or domainname like "popmartdoll.shop" or url like "popmartdoll.shop" or siteurl like "popmartdoll.shop" or domainname like "popmarter.com" or url like "popmarter.com" or siteurl like "popmarter.com" or domainname like "popmarthome.online" or url like "popmarthome.online" or siteurl like "popmarthome.online" or domainname like "popmartindia.store" or url like "popmartindia.store" or siteurl like "popmartindia.store" or domainname like "popmartksa.com" or url like "popmartksa.com" or siteurl like "popmartksa.com" or domainname like "popmartlabs.com" or url like "popmartlabs.com" or siteurl like "popmartlabs.com" or domainname like "popmartme.com" or url like "popmartme.com" or siteurl like "popmartme.com" or domainname like "popmartmonster.com" or url like "popmartmonster.com" or siteurl like "popmartmonster.com" or domainname like "popmarts-uk.com" or url like "popmarts-uk.com" or siteurl like "popmarts-uk.com" or domainname like "popmarts.co.nz" or url like "popmarts.co.nz" or siteurl like "popmarts.co.nz" or domainname like "popmartsales.com" or url like "popmartsales.com" or siteurl like "popmartsales.com" or domainname like "popmartshow.com" or url like "popmartshow.com" or siteurl like "popmartshow.com" or domainname like "popmartstore.co" or url like "popmartstore.co" or siteurl like "popmartstore.co" or domainname like "popmartstoresale.com" or url like "popmartstoresale.com" or siteurl like "popmartstoresale.com" or domainname like "popmartsuk.com" or url like "popmartsuk.com" or siteurl like "popmartsuk.com" |
Domains\URLs 4: | domainname like "popmartusa.net" or siteurl like "popmartusa.net" or url like "popmartusa.net" or domainname like "popousmart.com" or siteurl like "popousmart.com" or url like "popousmart.com" or domainname like "poppmmart.com" or siteurl like "poppmmart.com" or url like "poppmmart.com" or domainname like "superpopmart.com" or siteurl like "superpopmart.com" or url like "superpopmart.com" or domainname like "thepopmart.com.tr" or siteurl like "thepopmart.com.tr" or url like "thepopmart.com.tr" or domainname like "uaepopmart.store" or siteurl like "uaepopmart.store" or url like "uaepopmart.store" or domainname like "usapopmart.net" or siteurl like "usapopmart.net" or url like "usapopmart.net" or domainname like "ustoypopmart.com" or siteurl like "ustoypopmart.com" or url like "ustoypopmart.com" or domainname like "zimomo-eth.xyz" or siteurl like "zimomo-eth.xyz" or url like "zimomo-eth.xyz" or domainname like "zimnomocoin.com" or siteurl like "zimnomocoin.com" or url like "zimnomocoin.com" |
Reference:
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-06-30-IOCs-for-Labubu-scam-domains.txt