Date: 12/24/2025
Severity: High
Summary
A renewed RTO/e-Challan phishing wave is actively targeting Indian vehicle owners through SMS-based lures that link to fake, browser-based portals mimicking official government services. Unlike earlier malware-driven campaigns, this activity relies solely on phishing, dynamically generating challan details and pushing victims toward card-only payments to facilitate financial fraud. Analysis shows shared hosting infrastructure supporting multiple government, BFSI, and logistics-themed scams, highlighting an ongoing, large-scale operation that exploits urgency and user trust despite browser security warnings.
Indicators of Compromise (IOC) List
URLs/Domains | echalt.vip echalr.vip echallaxs.vip echallaxe.vip echallax.vip echallaxo.vip echale.vip echalk.vip echalj.vip echalh.vip echald.vip echalg.vip echals.vip echalf.vip echala.vip echallaxzov.vip echalaxzs.vip echalm.vip echalb.vip echaln.vip echallaxzrs.vip echallaxzo.vip echallaxzre.vip echallaxzrx.vip echallaxzm.vip echallaxzv.vip echallaxzx.vip echallaxzn.vip echallaxzc.vip echallc.vip echallx.vip echalln.vip echallv.vip echallz.vip echallb.vip echallaq.vip echallaw.vip echallac.vip echallas.vip echallad.vip echallag.vip echallav.vip echallaf.vip echallax.com echallaz.xin echallaz.com deihin.vip dtdcinm.vip dtdcinb.vip dtdcinc.vip dtdcinx.vip dtdcinz.vip dtdcins.vip dtdcin.vip dtdcspostb.vip dtdcspostc.vip dtdcspostz.vip dtdcspostx.vip delhirzxcy.vip delhirzecy.vip delhiczexy.vip delhixczexy.vip delhixczery.vip delhixzery.vip delhiszery.vip delhizery.vip delhisery.vip delhivery.vip delhicery.cc delhicvery.cc delhizery.cc delhiiery.cc dtdcspost.cc dtdcapost.cc dtdczwsxz.cc dtdczasxn.com dtdczwsxc.cc dtdczasxv.cc dtdczasxg.cc dtdczasc.cc dtdczasx.cc delheieru.com dtdczasxf.cc dtdczasxd.cc dtdczasxs.cc dtdczasxa.cc dadcpoert.cc dtdczasxn.cc dadcpoest.com dtdczasxv.com dtdczasxi.net dtdczasxi.com dtdczasti.com delheieri.com delheiery.com delhevery.com dtdcpastr.com dtdcpastw.net dtdcpastr.net dtdcpaste.net dtdcpastq.net delhirzexu.vip delhirzexi.vip hsbc-vnd.cc pariovaihen.icu parisvaihen.icu parihvaihen.icu parixvaihen.icu parizvaihen.icu parikvaihen.icu parievaihen.icu pariuvaihen.icu pariavaihen.icu parvaihacn.icu parvaihaen.icu parvaihatn.icu parvaihajn.icu parvaihain.icu parvaihaun.icu parvaiharn.icu parinwahan.icu parixwahan.icu paricwahan.icu pariawahan.icu parivwahan.icu parivanvhuan.icu parivaerhuan.icu parivaashuan.icu parivacxhuan.icu parivaichuan.icu parivaoxhuan.icu parivaudhuan.icu parivahiant.icu parievahuan.icu parivahiane.icu parivahianu.icu parivahianr.icu parivahianv.icu parievahnan.icu parievahean.icu parievahian.icu parievahtan.icu parivahucan.icu parivahuean.icu parvahdsut.icu parvahdsur.icu parvahdsue.icu parvahdsun.icu parvahdsuh.icu parviavhuan.icu parviavhfan.icu parviavhudn.icu parivahcean.icu parivahioan.icu parivahxran.icu parivahoan.icu parivahsan.icu parivahdan.icu parivahpan.icu parivahian.icu parvahani.icu parvahans.icu |
IP Address | 43.130.12.41 101.33.78.145 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "dtdczasxd.cc" or siteurl like "dtdczasxd.cc" or url like "dtdczasxd.cc" or domainname like "parvahdsue.icu" or siteurl like "parvahdsue.icu" or url like "parvahdsue.icu" or domainname like "parivahianu.icu" or siteurl like "parivahianu.icu" or url like "parivahianu.icu" or domainname like "parivwahan.icu" or siteurl like "parivwahan.icu" or url like "parivwahan.icu" or domainname like "parivanvhuan.icu" or siteurl like "parivanvhuan.icu" or url like "parivanvhuan.icu" or domainname like "parivahian.icu" or siteurl like "parivahian.icu" or url like "parivahian.icu" or domainname like "echallz.vip" or siteurl like "echallz.vip" or url like "echallz.vip" or domainname like "dtdcinm.vip" or siteurl like "dtdcinm.vip" or url like "dtdcinm.vip" or domainname like "parvahdsuh.icu" or siteurl like "parvahdsuh.icu" or url like "parvahdsuh.icu" or domainname like "parivahxran.icu" or siteurl like "parivahxran.icu" or url like "parivahxran.icu" or domainname like "echallb.vip" or siteurl like "echallb.vip" or url like "echallb.vip" or domainname like "delhiszery.vip" or siteurl like "delhiszery.vip" or url like "delhiszery.vip" or domainname like "delhixzery.vip" or siteurl like "delhixzery.vip" or url like "delhixzery.vip" or domainname like "dtdczwsxz.cc" or siteurl like "dtdczwsxz.cc" or url like "dtdczwsxz.cc" or domainname like "dtdcins.vip" or siteurl like "dtdcins.vip" or url like "dtdcins.vip" or domainname like "echallav.vip" or siteurl like "echallav.vip" or url like "echallav.vip" or domainname like "parizvaihen.icu" or siteurl like "parizvaihen.icu" or url like "parizvaihen.icu" or domainname like "delhixczexy.vip" or siteurl like "delhixczexy.vip" or url like "delhixczexy.vip" or domainname like "echallax.vip" or siteurl like "echallax.vip" or url like "echallax.vip" or domainname like "parikvaihen.icu" or siteurl like "parikvaihen.icu" or url like "parikvaihen.icu" or domainname like "echallaxzo.vip" or siteurl like "echallaxzo.vip" or url like "echallaxzo.vip" or domainname like "dtdczasc.cc" or siteurl like "dtdczasc.cc" or url like "dtdczasc.cc" or domainname like "parvahani.icu" or siteurl like "parvahani.icu" or url like "parvahani.icu" or domainname like "dtdcpastw.net" or siteurl like "dtdcpastw.net" or url like "dtdcpastw.net" or domainname like "parvaihaun.icu" or siteurl like "parvaihaun.icu" or url like "parvaihaun.icu" or domainname like "parivaerhuan.icu" or siteurl like "parivaerhuan.icu" or url like "parivaerhuan.icu" or domainname like "parvahdsun.icu" or siteurl like "parvahdsun.icu" or url like "parvahdsun.icu" or domainname like "delhevery.com" or siteurl like "delhevery.com" or url like "delhevery.com" or domainname like "echallaxzn.vip" or siteurl like "echallaxzn.vip" or url like "echallaxzn.vip" or domainname like "echallad.vip" or siteurl like "echallad.vip" or url like "echallad.vip" or domainname like "echalm.vip" or siteurl like "echalm.vip" or url like "echalm.vip" or domainname like "dtdcspostz.vip" or siteurl like "dtdcspostz.vip" or url like "dtdcspostz.vip" or domainname like "parvaihain.icu" or siteurl like "parvaihain.icu" or url like "parvaihain.icu" or domainname like "dtdczasxi.net" or siteurl like "dtdczasxi.net" or url like "dtdczasxi.net" or domainname like "echald.vip" or siteurl like "echald.vip" or url like "echald.vip" or domainname like "echallaxzc.vip" or siteurl like "echallaxzc.vip" or url like "echallaxzc.vip" or domainname like "parinwahan.icu" or siteurl like "parinwahan.icu" or url like "parinwahan.icu" or domainname like "dtdczasxv.cc" or siteurl like "dtdczasxv.cc" or url like "dtdczasxv.cc" or domainname like "parivahiane.icu" or siteurl like "parivahiane.icu" or url like "parivahiane.icu" or domainname like "echallaq.vip" or siteurl like "echallaq.vip" or url like "echallaq.vip" or domainname like "dtdcpastr.net" or siteurl like "dtdcpastr.net" or url like "dtdcpastr.net" or domainname like "echallaf.vip" or siteurl like "echallaf.vip" or url like "echallaf.vip" or domainname like "echallaz.xin" or siteurl like "echallaz.xin" or url like "echallaz.xin" or domainname like "echallaxzov.vip" or siteurl like "echallaxzov.vip" or url like "echallaxzov.vip" or domainname like "echals.vip" or siteurl like "echals.vip" or url like "echals.vip" or domainname like "parivahianr.icu" or siteurl like "parivahianr.icu" or url like "parivahianr.icu" or domainname like "delhirzexi.vip" or siteurl like "delhirzexi.vip" or url like "delhirzexi.vip" or domainname like "parivahuean.icu" or siteurl like "parivahuean.icu" or url like "parivahuean.icu" or domainname like "delhixczery.vip" or siteurl like "delhixczery.vip" or url like "delhixczery.vip" or domainname like "delhivery.vip" or siteurl like "delhivery.vip" or url like "delhivery.vip" or domainname like "delhirzexu.vip" or siteurl like "delhirzexu.vip" or url like "delhirzexu.vip" or domainname like "delhicvery.cc" or siteurl like "delhicvery.cc" or url like "delhicvery.cc" or domainname like "parivaichuan.icu" or siteurl like "parivaichuan.icu" or url like "parivaichuan.icu" or domainname like "parivahioan.icu" or siteurl like "parivahioan.icu" or url like "parivahioan.icu" or domainname like "delhisery.vip" or siteurl like "delhisery.vip" or url like "delhisery.vip" or domainname like "dtdczasxs.cc" or siteurl like "dtdczasxs.cc" or url like "dtdczasxs.cc" or domainname like "parihvaihen.icu" or siteurl like "parihvaihen.icu" or url like "parihvaihen.icu" or domainname like "parviavhuan.icu" or siteurl like "parviavhuan.icu" or url like "parviavhuan.icu" or domainname like "echallaz.com" or siteurl like "echallaz.com" or url like "echallaz.com" or domainname like "parivahdan.icu" or siteurl like "parivahdan.icu" or url like "parivahdan.icu" or domainname like "parivahucan.icu" or siteurl like "parivahucan.icu" or url like "parivahucan.icu" or domainname like "parivaoxhuan.icu" or siteurl like "parivaoxhuan.icu" or url like "parivaoxhuan.icu" or domainname like "dtdcpastr.com" or siteurl like "dtdcpastr.com" or url like "dtdcpastr.com" or domainname like "parvaihacn.icu" or siteurl like "parvaihacn.icu" or url like "parvaihacn.icu" or domainname like "deihin.vip" or siteurl like "deihin.vip" or url like "deihin.vip" or domainname like "dtdcinc.vip" or siteurl like "dtdcinc.vip" or url like "dtdcinc.vip" or domainname like "parvaihatn.icu" or siteurl like "parvaihatn.icu" or url like "parvaihatn.icu" or domainname like "parievahian.icu" or siteurl like "parievahian.icu" or url like "parievahian.icu" or domainname like "dtdcinz.vip" or siteurl like "dtdcinz.vip" or url like "dtdcinz.vip" or domainname like "echallaxe.vip" or siteurl like "echallaxe.vip" or url like "echallaxe.vip" or domainname like "delhicery.cc" or siteurl like "delhicery.cc" or url like "delhicery.cc" or domainname like "dadcpoert.cc" or siteurl like "dadcpoert.cc" or url like "dadcpoert.cc" or domainname like "dtdczasxa.cc" or siteurl like "dtdczasxa.cc" or url like "dtdczasxa.cc" or domainname like "dtdczasxv.com" or siteurl like "dtdczasxv.com" or url like "dtdczasxv.com" or domainname like "echallaxzre.vip" or siteurl like "echallaxzre.vip" or url like "echallaxzre.vip" or domainname like "parivahiant.icu" or siteurl like "parivahiant.icu" or url like "parivahiant.icu" or domainname like "echallx.vip" or siteurl like "echallx.vip" or url like "echallx.vip" or domainname like "echallaxzrx.vip" or siteurl like "echallaxzrx.vip" or url like "echallaxzrx.vip" or domainname like "pariavaihen.icu" or siteurl like "pariavaihen.icu" or url like "pariavaihen.icu" or domainname like "echallc.vip" or siteurl like "echallc.vip" or url like "echallc.vip" or domainname like "echallas.vip" or siteurl like "echallas.vip" or url like "echallas.vip" or domainname like "hsbc-vnd.cc" or siteurl like "hsbc-vnd.cc" or url like "hsbc-vnd.cc" or domainname like "pariawahan.icu" or siteurl like "pariawahan.icu" or url like "pariawahan.icu" or domainname like "echallv.vip" or siteurl like "echallv.vip" or url like "echallv.vip" or domainname like "dtdczasx.cc" or siteurl like "dtdczasx.cc" or url like "dtdczasx.cc" or domainname like "dtdcapost.cc" or siteurl like "dtdcapost.cc" or url like "dtdcapost.cc" or domainname like "echale.vip" or siteurl like "echale.vip" or url like "echale.vip" or domainname like "delhirzxcy.vip" or siteurl like "delhirzxcy.vip" or url like "delhirzxcy.vip" or domainname like "dtdczasxg.cc" or siteurl like "dtdczasxg.cc" or url like "dtdczasxg.cc" or domainname like "parvaihaen.icu" or siteurl like "parvaihaen.icu" or url like "parvaihaen.icu" or domainname like "dtdcspostc.vip" or siteurl like "dtdcspostc.vip" or url like "dtdcspostc.vip" or domainname like "parivaudhuan.icu" or siteurl like "parivaudhuan.icu" or url like "parivaudhuan.icu" or domainname like "parievahtan.icu" or siteurl like "parievahtan.icu" or url like "parievahtan.icu" or domainname like "parivahpan.icu" or siteurl like "parivahpan.icu" or url like "parivahpan.icu" or domainname like "echalb.vip" or siteurl like "echalb.vip" or url like "echalb.vip" or domainname like "echallaxzm.vip" or siteurl like "echallaxzm.vip" or url like "echallaxzm.vip" or domainname like "dtdcinx.vip" or siteurl like "dtdcinx.vip" or url like "dtdcinx.vip" or domainname like "parivahianv.icu" or siteurl like "parivahianv.icu" or url like "parivahianv.icu" or domainname like "dtdcpastq.net" or siteurl like "dtdcpastq.net" or url like "dtdcpastq.net" |
Detection Query 2 : | domainname like "echalt.vip" or siteurl like "echalt.vip" or url like "echalt.vip" or domainname like "echalr.vip" or siteurl like "echalr.vip" or url like "echalr.vip" or domainname like "echallaxo.vip" or siteurl like "echallaxo.vip" or url like "echallaxo.vip" or domainname like "echalk.vip" or siteurl like "echalk.vip" or url like "echalk.vip" or domainname like "echalj.vip" or siteurl like "echalj.vip" or url like "echalj.vip" or domainname like "echalh.vip" or siteurl like "echalh.vip" or url like "echalh.vip" or domainname like "echalg.vip" or siteurl like "echalg.vip" or url like "echalg.vip" or domainname like "echalf.vip" or siteurl like "echalf.vip" or url like "echalf.vip" or domainname like "echala.vip" or siteurl like "echala.vip" or url like "echala.vip" or domainname like "echalaxzs.vip" or siteurl like "echalaxzs.vip" or url like "echalaxzs.vip" or domainname like "echaln.vip" or siteurl like "echaln.vip" or url like "echaln.vip" or domainname like "echallaxzrs.vip" or siteurl like "echallaxzrs.vip" or url like "echallaxzrs.vip" or domainname like "echallaxzv.vip" or siteurl like "echallaxzv.vip" or url like "echallaxzv.vip" or domainname like "echallaxzx.vip" or siteurl like "echallaxzx.vip" or url like "echallaxzx.vip" or domainname like "echalln.vip" or siteurl like "echalln.vip" or url like "echalln.vip" or domainname like "echallaw.vip" or siteurl like "echallaw.vip" or url like "echallaw.vip" or domainname like "echallac.vip" or siteurl like "echallac.vip" or url like "echallac.vip" or domainname like "echallag.vip" or siteurl like "echallag.vip" or url like "echallag.vip" or domainname like "echallax.com" or siteurl like "echallax.com" or url like "echallax.com" or domainname like "dtdcinb.vip" or siteurl like "dtdcinb.vip" or url like "dtdcinb.vip" or domainname like "dtdcin.vip" or siteurl like "dtdcin.vip" or url like "dtdcin.vip" or domainname like "dtdcspostb.vip" or siteurl like "dtdcspostb.vip" or url like "dtdcspostb.vip" or domainname like "delhirzecy.vip" or siteurl like "delhirzecy.vip" or url like "delhirzecy.vip" or domainname like "delhiczexy.vip" or siteurl like "delhiczexy.vip" or url like "delhiczexy.vip" or domainname like "delhizery.vip" or siteurl like "delhizery.vip" or url like "delhizery.vip" or domainname like "delhizery.cc" or siteurl like "delhizery.cc" or url like "delhizery.cc" or domainname like "delhiiery.cc" or siteurl like "delhiiery.cc" or url like "delhiiery.cc" or domainname like "dtdcspost.cc" or siteurl like "dtdcspost.cc" or url like "dtdcspost.cc" or domainname like "dtdczasxn.com" or siteurl like "dtdczasxn.com" or url like "dtdczasxn.com" or domainname like "dtdczwsxc.cc" or siteurl like "dtdczwsxc.cc" or url like "dtdczwsxc.cc" or domainname like "delheieru.com" or siteurl like "delheieru.com" or url like "delheieru.com" or domainname like "dtdczasxf.cc" or siteurl like "dtdczasxf.cc" or url like "dtdczasxf.cc" or domainname like "dtdczasxn.cc" or siteurl like "dtdczasxn.cc" or url like "dtdczasxn.cc" or domainname like "dadcpoest.com" or siteurl like "dadcpoest.com" or url like "dadcpoest.com" or domainname like "dtdczasxi.com" or siteurl like "dtdczasxi.com" or url like "dtdczasxi.com" or domainname like "dtdczasti.com" or siteurl like "dtdczasti.com" or url like "dtdczasti.com" or domainname like "delheieri.com" or siteurl like "delheieri.com" or url like "delheieri.com" or domainname like "delheiery.com" or siteurl like "delheiery.com" or url like "delheiery.com" or domainname like "dtdcpaste.net" or siteurl like "dtdcpaste.net" or url like "dtdcpaste.net" or domainname like "pariovaihen.icu" or siteurl like "pariovaihen.icu" or url like "pariovaihen.icu" or domainname like "parisvaihen.icu" or siteurl like "parisvaihen.icu" or url like "parisvaihen.icu" or domainname like "parixvaihen.icu" or siteurl like "parixvaihen.icu" or url like "parixvaihen.icu" or domainname like "parievaihen.icu" or siteurl like "parievaihen.icu" or url like "parievaihen.icu" or domainname like "pariuvaihen.icu" or siteurl like "pariuvaihen.icu" or url like "pariuvaihen.icu" or domainname like "parvaihajn.icu" or siteurl like "parvaihajn.icu" or url like "parvaihajn.icu" or domainname like "parvaiharn.icu" or siteurl like "parvaiharn.icu" or url like "parvaiharn.icu" or domainname like "parixwahan.icu" or siteurl like "parixwahan.icu" or url like "parixwahan.icu" or domainname like "paricwahan.icu" or siteurl like "paricwahan.icu" or url like "paricwahan.icu" or domainname like "parivaashuan.icu" or siteurl like "parivaashuan.icu" or url like "parivaashuan.icu" or domainname like "parivacxhuan.icu" or siteurl like "parivacxhuan.icu" or url like "parivacxhuan.icu" or domainname like "parievahuan.icu" or siteurl like "parievahuan.icu" or url like "parievahuan.icu" or domainname like "parievahnan.icu" or siteurl like "parievahnan.icu" or url like "parievahnan.icu" or domainname like "parievahean.icu" or siteurl like "parievahean.icu" or url like "parievahean.icu" or domainname like "parvahdsut.icu" or siteurl like "parvahdsut.icu" or url like "parvahdsut.icu" or domainname like "parvahdsur.icu" or siteurl like "parvahdsur.icu" or url like "parvahdsur.icu" or domainname like "parviavhfan.icu" or siteurl like "parviavhfan.icu" or url like "parviavhfan.icu" or domainname like "parviavhudn.icu" or siteurl like "parviavhudn.icu" or url like "parviavhudn.icu" or domainname like "parivahcean.icu" or siteurl like "parivahcean.icu" or url like "parivahcean.icu" or domainname like "parivahoan.icu" or siteurl like "parivahoan.icu" or url like "parivahoan.icu" or domainname like "parivahsan.icu" or siteurl like "parivahsan.icu" or url like "parivahsan.icu" or domainname like "parvahans.icu" or siteurl like "parvahans.icu" or url like "parvahans.icu" |
Detection Query 3 : | dstipaddress IN ("101.33.78.145","43.130.12.41") or srcipaddress IN ("101.33.78.145","43.130.12.41") |
Reference:
https://cyble.com/blog/rto-scam-wave-continues/