Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5798 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Darcula (Magic Cat) PhaaS Infrastructure and Kit Fingerprint Access — TL-2026-5798

Detects web-proxy traffic to known darcula-suite / Magic Cat infrastructure (magic-cat.world, magic-cat.net, v3 admin panel and Docker registry hosts, urlscan.io-reported Darcula v2/v3 hosts, NewBee/PandaShop-related hosts), to the Darcula-associated IPs 190.2.153.226, 206.66.99.27 and 43.135.133.79, and to kit fingerprint paths (/api/can-active, /loadDarcula.js, *.cat-page). Phishing-as-a-service lures impersonating utilities (FPL, Tampa Electric, Pepco, Duke Energy, PG&E, Entergy) are delivered by iMessage/RCS/SMS links; a proxy hit indicates a user clicked through to Darcula infrastructure or a host is contacting operator tooling.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.001, T1583.001
• Data sources: web_proxy:zscalernss-web, DeviceNetworkEvents, DnsEvents, proxy
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype="zscalernss-web" earliest=-24h
```comment Darcula and Magic Cat PhaaS TL-2026-5798 known infra domains IPs and kit fingerprints```
| eval dom=lower(coalesce(url_domain, dest_host, dest)), path=lower(coalesce(uri_path, url))
| eval hit_domain=if(match(dom,"(^|[.])(magic-cat[.](world|net)|empowersafetybc[.]one|gobposnbe[.]live|aumiy[.]shop|abackendsystem[.]com|newpandasystem[.]com|newbeesystem[.]com)$"),"darcula_domain",null())
| eval hit_ip=if(match(coalesce(dest_ip,""),"^(190[.]2[.]153[.]226|206[.]66[.]99[.]27|43[.]135[.]133[.]79)$"),"darcula_ip",null())
| eval hit_path=if(match(path,"/api/can-active|/loaddarcula[.]js|[.]cat-page($|[?])"),"darcula_path",null())
| where isnotnull(hit_domain) OR isnotnull(hit_ip) OR isnotnull(hit_path)
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(hit_domain) as hit_domain values(hit_ip) as hit_ip values(hit_path) as hit_path by src user dom dest_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

let ioc_domains = dynamic(['magic-cat.world','v3.magic-cat.world','registry.magic-cat.world','magic-cat.net','empowersafetybc.one','posdom.gobposnbe.live','aumiy.shop','pruqdh.abackendsystem.com','newpandasystem.com','saas.newbeesystem.com']);
let ioc_ips = dynamic(['190.2.153.226','206.66.99.27','43.135.133.79']);
union
(DeviceNetworkEvents
 | where Timestamp > ago(24h)
 | where RemoteIP in (ioc_ips) or RemoteUrl has_any (ioc_domains)
 | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Process = InitiatingProcessFileName, RemoteUrl, RemoteIP, Source = 'DeviceNetworkEvents'),
(DnsEvents
 | where TimeGenerated > ago(24h)
 | where Name has_any (ioc_domains)
 | project Timestamp = TimeGenerated, DeviceName = Computer, RemoteUrl = Name, RemoteIP = tostring(IPAddresses), Source = 'DnsEvents')
| order by Timestamp desc

Sigma

title: Darcula Magic Cat PhaaS Infrastructure Access
id: 7c1f0e52-3a9b-4d6e-9f21-5b8a0c4d7e11
status: experimental
description: Detects web proxy connections to known darcula-suite (Magic Cat) phishing-as-a-service infrastructure and Darcula-associated IP addresses reported by Netcraft and urlscan.io.
references:
  - https://netcraft.com/blog/darcula-v3-phishing-kits-targeting-any-brand
  - https://urlscan.io/blog/2026/05/11/CnDarcula/
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.resource-development
  - attack.t1583.001
logsource:
  category: proxy
detection:
  selection_exact:
    cs-host:
      - 'magic-cat.world'
      - 'magic-cat.net'
      - 'empowersafetybc.one'
      - 'aumiy.shop'
      - 'newpandasystem.com'
  selection_sub:
    cs-host|endswith:
      - '.magic-cat.world'
      - '.magic-cat.net'
      - '.gobposnbe.live'
      - '.abackendsystem.com'
      - '.newbeesystem.com'
  selection_ip:
    dst_ip:
      - '190.2.153.226'
      - '206.66.99.27'
      - '43.135.133.79'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or threat-intel analysts deliberately browsing Darcula infrastructure
  - Automated URL detonation or brand-protection crawlers
level: high

Known false positives:

• Threat-intel or brand-protection analysts and sandboxes deliberately visiting Darcula infrastructure
• Shared hosting IPs (43.135.133.79) may carry unrelated tenants; validate the Host header before escalating

Tuning notes: Map url_domain/dest_host/dest/dest_ip to your proxy add-on field names (the search assumes CIM-style Web fields). Add the same indicators to a DNS-log search for coverage of users off the proxy. Refresh IOC lists from the research feed regularly because Darcula rotates over 100 domains per day; the path fingerprints are the durable signal. Pivot hits to the affected user's recent SMS/iMessage/email lures.

• 🔒 Community-Related Sibling Infrastructure (Malvertising Cluster) DNS and Network Contact · unlock with TL Creds
• 🔒 Scam-Ad Click Landing on Utility Brand Lookalike Domain · unlock with TL Creds
• 🔒 Server-Side Runtime Contacting Telegram Bot API (Darcula Panel Victim Alerts) · unlock with TL Creds
• 🔒 Darcula Kit Fingerprint Paths ([indicator], [indicator], .cat-page) · unlock with TL Creds
• 🔒 Crawler-Evasion Redirect to Cat-Breed Google Search (Darcula Guardrail) · unlock with TL Creds
• 🔒 Darcula V3 Panel Deployment: Magic Cat Install Script, Registry Pull or .cat-page Bundle · unlock with TL Creds
• 🔒 Utility Brand Lookalike Domain With Bill-Payment or Shutoff URI · unlock with TL Creds
• 🔒 Darcula Wrapper API POST Burst With Card/2FA/Address Page Flow · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5798.

Sample indicators (3 of 20)

• IP address: 190.2.153[.]226
• Domain: magic-cat[.]world
• IP address: 206.66.99[.]27

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Technical analysis

Utility impostor scams follow a consistent formula: manufactured urgency, a threat of service shutoff, and a demand for immediate payment. Doppel's vendor awareness post (undated; it refers to Utility Scam Awareness Day on Wednesday, November 18, 2026) lists variations including fake overpayment refunds, bogus equipment fees, post-storm 'power restoration' charges, spoofed bills, fake job listings and impostor workers at the door. Victims are pushed toward prepaid cards or wire transfers. Callers spoof caller ID and use call-back numbers that replay the utility's greeting, and some use AI-generated voices, voice cloning and deepfakes. Utilities cited in warnings include Florida Power & Light (AI voices offering fake rebates, texts about a supposed net metering program), Tampa Electric (rising scam reports since 2024 including fake websites), Pepco (voice cloning, deepfakes, AI-written phishing), Duke Energy, PG&E and Entergy.

Before contact, scammers prepare infrastructure: lookalike domains, scam phone numbers, search ads carrying bogus support numbers, and fake social pages. Channels are cloned websites, scam ads, mass texts, spoofed calls and search-engine scams. Doppel names Darcula V3 as a modern phishing-as-a-service (PhaaS) kit that lets operators clone a real brand's site, add payment forms and distribute lures by text without coding. The Doppel post itself gives no further Darcula detail and lists no domains, IPs, phone numbers, hashes, CVEs or named actors.

Public technical research supplies the Darcula context. Netcraft (March 27, 2024) describes darcula as a Chinese-language PhaaS sold by subscription through a Telegram user of the same name, with about 200 brand templates across 100+ countries (mostly postal services, plus utilities, banks, government, airlines and telecoms). Lures are sent over iMessage and RCS rather than SMS to bypass SMS firewalls; iMessage link gating is worked around by asking victims to reply 'Y' or '1'. Bulk sending uses macOS Messages automation with rotated Apple IDs and Android device farms for RCS. Sites are React-based (not PHP), packaged as Docker images served from a Harbor registry, and deployed by a per-brand setup script that also installs an admin panel. Front pages show a fake domain-for-sale page and suspected bots are redirected to cat-breed Google searches. Cloudflare fronted about 32% of pages; Tencent, Quadranet and Multacom were other common hosts. Netcraft observed over 20,000 darcula domains on about 11,000 IPs and an average of about 120 new domains per day in early 2024.

Netcraft's February 20, 2025 analysis of darcula-suite 3.0 (V3) says the main addition is DIY kit generation for any brand: the operator enters a brand URL, a Puppeteer-style headless-Chrome tool exports the HTML and assets, the operator injects phishing form elements, restyles them, generates separate lure, address, card-details and 2FA pages, exports a .cat-page bundle and uploads it to the admin panel. The admin panel (Docker, Node, React, SQLite) manages campaigns, stolen credentials and card data, shows performance dashboards, sends Telegram victim alerts, and offers IP blocking, crawler filtering and device-type restrictions. Campaigns sit under random per-campaign paths that defeat hostname-level analysis such as Certificate Transparency and passive DNS. V3 can generate a virtual card image from stolen card data so it can be added to a digital wallet, and cards are reportedly loaded onto burner phones for resale. Since March 2024 Netcraft reports over 90,000 darcula domains, nearly 31,000 IPs and over 20,000 takedowns. urlscan.io (May 11, 2026) reports Darcula v3 remains operational and appears regularly in submissions, and publishes fingerprints (Rabbit/CryptoJS-encrypted wrapper API calls at /api/<hex>, hex-encoded browser storage keys) plus related NewBee/PandaShop fake-shop frameworks whose relationship to Darcula is unclear.

Statistics cited by Doppel: BBB 2024 median utility-scam loss $435; Duke Energy more than 5,600 reports through end of October 2025; PG&E nearly 700 reports in 2025 with nearly $300,000 in losses; Gartner (Sept 22, 2025) 62% of organizations experienced a deepfake social-engineering attack. Doppel's own takedown performance claims are vendor self-reported. This is best treated as a brand-impersonation detection and takedown topic; no specific utility-targeting Darcula infrastructure is published in the cited sources, so the IOCs below are general Darcula tooling/infrastructure from Netcraft and urlscan.io.

MITRE ATT&CK techniques by tactic:

Credential Access

T1111 Multi-Factor Authentication Interception

Execution

T1204.001 Malicious Link

Defense Evasion

T1480 Execution Guardrails; T1684.001 Impersonation

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.008 Malvertising; T1585.001 Social Media Accounts

Reconnaissance

T1598.003 Spearphishing Link

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Search your brand with 'customer service number' and 'pay my bill' and review results and ads for bogus support numbers
• Check recently registered lookalike domains of your brand and submit takedowns
• Consolidate customer and employee scam reports into a single investigation and takedown workflow
• Block known Darcula infrastructure domains and IPs listed in the IOCs at web and DNS gateways

Workarounds

• Customers: pause on payment requests that create panic, verify via the official number on the bill, and report the scam (UUAS: Slow Down, Verify, Stop the Scam)
• Do not pay utility bills with prepaid cards or wire transfers on request of an unsolicited caller or text

Longer-term hardening

• Monitor beyond your own domain for lookalike domains, fake social profiles, scam ads, cloned apps and spoofed numbers
• Link related scam assets into one campaign view and track time-to-disruption and asset reuse rather than alert counts
• Use headless-browser and non-crawling monitoring (abuse-box and reporting communities) because Darcula filters crawlers, security-vendor IPs and non-mobile devices
• Train contact center and helpdesk staff with realistic vishing simulations
• Publish a 'how we contact you' page explaining real billing and disconnection processes

Affected and fixed versions

• Utility providers (electric, water, gas) — Customer billing and support brand identity
  Vulnerable versions: Brands named in cited warnings: Florida Power & Light, Tampa Electric, Pepco, Duke Energy, PG&E, Entergy

Timeline

• 2016-01-01 Utility Scam Awareness Day traces to a 2016 House resolution; Utilities United Against Scams (UUAS) coalition now spans more than 150 electric, water and gas utilities (year only per source; day/month not stated)
• 2024-03-27 Netcraft publishes first public research on the darcula PhaaS, reporting iMessage/RCS smishing, ~200 brand templates, 20,000+ domains on ~11,000 IPs and ~120 new domains per day
• 2025-02-20 Netcraft reports darcula-suite 3.0 (V3) announced on Telegram, enabling DIY phishing kits for any brand from a URL, with card-image generation for digital wallets
• 2025-04-01 Netcraft reports the darcula-suite toolkit now leverages generative AI to accelerate phishing kit creation (month per search summary; exact day not confirmed)
• 2025-09-22 Gartner press release cited by Doppel: 62% of organizations experienced a deepfake attack involving social engineering or exploiting automated processes
• 2025-10-31 Duke Energy reports more than 5,600 scam reports across its service areas through end of October 2025; PG&E reports nearly 700 reports and nearly $300,000 in 2025 customer losses
• 2026-05-11 urlscan.io reports Darcula v3 remains operational and publishes detection fingerprints, domains and IPs, and notes overlap with NewBee/PandaShop fake-shop kits
• 2026-11-18 Utility Scam Awareness Day 2026 (Wednesday); Doppel publishes awareness post naming Darcula V3 and recommending brand monitoring and takedown workflows

Sources cited

• Utilities United Against Scams utilitiesunited.org · Advisory
• The Bleeding Edge of Phishing: darcula-suite 3.0 Enables DIY Phishing of Any Brand (Netcraft) netcraft.com · Research · 2025-02-20
• Out of the Shadows: darcula iMessage and RCS Smishing Attacks Target USPS and Global Postal Services (Netcraft) netcraft.com · Research · 2024-03-27
• Darcula (Magic Cat) analysis (urlscan.io) urlscan.io · Research · 2026-05-11
• AI-enabled darcula-suite makes phishing kits more accessible, easier to deploy (Netcraft) netcraft.com · Research · 2025-04-01
• BBB Scam Tracker Risk Report 2024 bbbmarketplacetrust.org · Research
• Utility Scam Awareness Day 2026: Why Education Alone Won't Stop Impostor Scams (Doppel) doppel.com · Blog
• Darcula allows tech-illiterate crooks to create, deploy DIY phishing kits targeting any brand (Help Net Security) Help Net Security · News · 2025-02-20
• Cybercriminals Can Now Clone Any Brand's Site in Minutes Using Darcula PhaaS v3 (The Hacker News) The Hacker News · News · 2025-02-20

Related threats

• Darcula V3 Phishing Kit: On-Demand Brand Cloning via darcula-suite

Previous and next in phishing

• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting Previous report