# Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers

> Doppel's Utility Scam Awareness Day 2026 post describes utility impostor scams built on urgency and shutoff threats, cloned websites, scam ads, mass texts, spoofed calls and AI-generated voices. It names Darcula V3 (darcula-suite 3.0), a phishing-as-a-service kit that clones any brand's site from a URL and distributes lures by text, as an enabling tool.

- **Published:** 2026-11-11T21:56:54Z
- **Last reviewed:** 2026-11-11T21:56:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5798
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5798.png
- **ID:** TL-2026-5798
- **Severity:** LOW
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Utility impostor scams follow a consistent formula: manufactured urgency, a threat of service shutoff, and a demand for immediate payment. Doppel's vendor awareness post (undated; it refers to Utility Scam Awareness Day on Wednesday, November 18, 2026) lists variations including fake overpayment refunds, bogus equipment fees, post-storm 'power restoration' charges, spoofed bills, fake job listings and impostor workers at the door. Victims are pushed toward prepaid cards or wire transfers. Callers spoof caller ID and use call-back numbers that replay the utility's greeting, and some use AI-generated voices, voice cloning and deepfakes. Utilities cited in warnings include Florida Power & Light (AI voices offering fake rebates, texts about a supposed net metering program), Tampa Electric (rising scam reports since 2024 including fake websites), Pepco (voice cloning, deepfakes, AI-written phishing), Duke Energy, PG&E and Entergy.

Before contact, scammers prepare infrastructure: lookalike domains, scam phone numbers, search ads carrying bogus support numbers, and fake social pages. Channels are cloned websites, scam ads, mass texts, spoofed calls and search-engine scams. Doppel names Darcula V3 as a modern phishing-as-a-service (PhaaS) kit that lets operators clone a real brand's site, add payment forms and distribute lures by text without coding. The Doppel post itself gives no further Darcula detail and lists no domains, IPs, phone numbers, hashes, CVEs or named actors.

Public technical research supplies the Darcula context. Netcraft (March 27, 2024) describes darcula as a Chinese-language PhaaS sold by subscription through a Telegram user of the same name, with about 200 brand templates across 100+ countries (mostly postal services, plus utilities, banks, government, airlines and telecoms). Lures are sent over iMessage and RCS rather than SMS to bypass SMS firewalls; iMessage link gating is worked around by asking victims to reply 'Y' or '1'. Bulk sending uses macOS Messages automation with rotated Apple IDs and Android device farms for RCS. Sites are React-based (not PHP), packaged as Docker images served from a Harbor registry, and deployed by a per-brand setup script that also installs an admin panel. Front pages show a fake domain-for-sale page and suspected bots are redirected to cat-breed Google searches. Cloudflare fronted about 32% of pages; Tencent, Quadranet and Multacom were other common hosts. Netcraft observed over 20,000 darcula domains on about 11,000 IPs and an average of about 120 new domains per day in early 2024.

Netcraft's February 20, 2025 analysis of darcula-suite 3.0 (V3) says the main addition is DIY kit generation for any brand: the operator enters a brand URL, a Puppeteer-style headless-Chrome tool exports the HTML and assets, the operator injects phishing form elements, restyles them, generates separate lure, address, card-details and 2FA pages, exports a .cat-page bundle and uploads it to the admin panel. The admin panel (Docker, Node, React, SQLite) manages campaigns, stolen credentials and card data, shows performance dashboards, sends Telegram victim alerts, and offers IP blocking, crawler filtering and device-type restrictions. Campaigns sit under random per-campaign paths that defeat hostname-level analysis such as Certificate Transparency and passive DNS. V3 can generate a virtual card image from stolen card data so it can be added to a digital wallet, and cards are reportedly loaded onto burner phones for resale. Since March 2024 Netcraft reports over 90,000 darcula domains, nearly 31,000 IPs and over 20,000 takedowns. urlscan.io (May 11, 2026) reports Darcula v3 remains operational and appears regularly in submissions, and publishes fingerprints (Rabbit/CryptoJS-encrypted wrapper API calls at /api/<hex>, hex-encoded browser storage keys) plus related NewBee/PandaShop fake-shop frameworks whose relationship to Darcula is unclear.

Statistics cited by Doppel: BBB 2024 median utility-scam loss $435; Duke Energy more than 5,600 reports through end of October 2025; PG&E nearly 700 reports in 2025 with nearly $300,000 in losses; Gartner (Sept 22, 2025) 62% of organizations experienced a deepfake social-engineering attack. Doppel's own takedown performance claims are vendor self-reported. This is best treated as a brand-impersonation detection and takedown topic; no specific utility-targeting Darcula infrastructure is published in the cited sources, so the IOCs below are general Darcula tooling/infrastructure from Netcraft and urlscan.io.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1585.001 Social Media Accounts
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1480 Execution Guardrails
- T1111 Multi-Factor Authentication Interception
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Darcula (Magic Cat) PhaaS Infrastructure and Kit Fingerprint Access — TL-2026-5798** (`TL-2026-5798-SPL-001`)

Detects web-proxy traffic to known darcula-suite / Magic Cat infrastructure (magic-cat.world, magic-cat.net, v3 admin panel and Docker registry hosts, urlscan.io-reported Darcula v2/v3 hosts, NewBee/PandaShop-related hosts), to the Darcula-associated IPs 190.2.153.226, 206.66.99.27 and 43.135.133.79, and to kit fingerprint paths (/api/can-active, /loadDarcula.js, *.cat-page). Phishing-as-a-service lures impersonating utilities (FPL, Tampa Electric, Pepco, Duke Energy, PG&E, Entergy) are delivered by iMessage/RCS/SMS links; a proxy hit indicates a user clicked through to Darcula infrastructure or a host is contacting operator tooling.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1583.001
- **Data sources:** web_proxy:zscalernss-web, DeviceNetworkEvents, DnsEvents, proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=proxy sourcetype="zscalernss-web" earliest=-24h
```comment Darcula and Magic Cat PhaaS TL-2026-5798 known infra domains IPs and kit fingerprints```
| eval dom=lower(coalesce(url_domain, dest_host, dest)), path=lower(coalesce(uri_path, url))
| eval hit_domain=if(match(dom,"(^|[.])(magic-cat[.](world|net)|empowersafetybc[.]one|gobposnbe[.]live|aumiy[.]shop|abackendsystem[.]com|newpandasystem[.]com|newbeesystem[.]com)$"),"darcula_domain",null())
| eval hit_ip=if(match(coalesce(dest_ip,""),"^(190[.]2[.]153[.]226|206[.]66[.]99[.]27|43[.]135[.]133[.]79)$"),"darcula_ip",null())
| eval hit_path=if(match(path,"/api/can-active|/loaddarcula[.]js|[.]cat-page($|[?])"),"darcula_path",null())
| where isnotnull(hit_domain) OR isnotnull(hit_ip) OR isnotnull(hit_path)
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(hit_domain) as hit_domain values(hit_ip) as hit_ip values(hit_path) as hit_path by src user dom dest_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - count
````

### Microsoft KQL

```kql
let ioc_domains = dynamic(['magic-cat.world','v3.magic-cat.world','registry.magic-cat.world','magic-cat.net','empowersafetybc.one','posdom.gobposnbe.live','aumiy.shop','pruqdh.abackendsystem.com','newpandasystem.com','saas.newbeesystem.com']);
let ioc_ips = dynamic(['190.2.153.226','206.66.99.27','43.135.133.79']);
union
(DeviceNetworkEvents
 | where Timestamp > ago(24h)
 | where RemoteIP in (ioc_ips) or RemoteUrl has_any (ioc_domains)
 | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Process = InitiatingProcessFileName, RemoteUrl, RemoteIP, Source = 'DeviceNetworkEvents'),
(DnsEvents
 | where TimeGenerated > ago(24h)
 | where Name has_any (ioc_domains)
 | project Timestamp = TimeGenerated, DeviceName = Computer, RemoteUrl = Name, RemoteIP = tostring(IPAddresses), Source = 'DnsEvents')
| order by Timestamp desc
```

### Sigma

```yaml
title: Darcula Magic Cat PhaaS Infrastructure Access
id: 7c1f0e52-3a9b-4d6e-9f21-5b8a0c4d7e11
status: experimental
description: Detects web proxy connections to known darcula-suite (Magic Cat) phishing-as-a-service infrastructure and Darcula-associated IP addresses reported by Netcraft and urlscan.io.
references:
  - https://netcraft.com/blog/darcula-v3-phishing-kits-targeting-any-brand
  - https://urlscan.io/blog/2026/05/11/CnDarcula/
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.resource-development
  - attack.t1583.001
logsource:
  category: proxy
detection:
  selection_exact:
    cs-host:
      - 'magic-cat.world'
      - 'magic-cat.net'
      - 'empowersafetybc.one'
      - 'aumiy.shop'
      - 'newpandasystem.com'
  selection_sub:
    cs-host|endswith:
      - '.magic-cat.world'
      - '.magic-cat.net'
      - '.gobposnbe.live'
      - '.abackendsystem.com'
      - '.newbeesystem.com'
  selection_ip:
    dst_ip:
      - '190.2.153.226'
      - '206.66.99.27'
      - '43.135.133.79'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or threat-intel analysts deliberately browsing Darcula infrastructure
  - Automated URL detonation or brand-protection crawlers
level: high

```

**Known false positives:**

- Threat-intel or brand-protection analysts and sandboxes deliberately visiting Darcula infrastructure
- Shared hosting IPs (43.135.133.79) may carry unrelated tenants; validate the Host header before escalating

**Tuning notes:** Map url_domain/dest_host/dest/dest_ip to your proxy add-on field names (the search assumes CIM-style Web fields). Add the same indicators to a DNS-log search for coverage of users off the proxy. Refresh IOC lists from the research feed regularly because Darcula rotates over 100 domains per day; the path fingerprints are the durable signal. Pivot hits to the affected user's recent SMS/iMessage/email lures.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Community-Related Sibling Infrastructure (Malvertising Cluster) DNS and Network Contact (locked: unlock with TL Creds)
- Scam-Ad Click Landing on Utility Brand Lookalike Domain (locked: unlock with TL Creds)
- Server-Side Runtime Contacting Telegram Bot API (Darcula Panel Victim Alerts) (locked: unlock with TL Creds)
- Darcula Kit Fingerprint Paths ([indicator], [indicator], .cat-page) (locked: unlock with TL Creds)
- Crawler-Evasion Redirect to Cat-Breed Google Search (Darcula Guardrail) (locked: unlock with TL Creds)
- Darcula V3 Panel Deployment: Magic Cat Install Script, Registry Pull or .cat-page Bundle (locked: unlock with TL Creds)
- Utility Brand Lookalike Domain With Bill-Payment or Shutoff URI (locked: unlock with TL Creds)
- Darcula Wrapper API POST Burst With Card/2FA/Address Page Flow (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `190.2.153[.]226`
- Domain: `magic-cat[.]world`
- IP address: `206.66.99[.]27`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Utility Scam Awareness Day 2026: Why Education Alone Won't Stop Impostor Scams (Doppel)](https://www.doppel.com/blog/utility-scam-awareness-day-impostor-scams)
- [The Bleeding Edge of Phishing: darcula-suite 3.0 Enables DIY Phishing of Any Brand (Netcraft)](https://netcraft.com/blog/darcula-v3-phishing-kits-targeting-any-brand)
- [Out of the Shadows: darcula iMessage and RCS Smishing Attacks Target USPS and Global Postal Services (Netcraft)](https://netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services)
- [Darcula (Magic Cat) analysis (urlscan.io)](https://urlscan.io/blog/2026/05/11/CnDarcula/)
- [Darcula allows tech-illiterate crooks to create, deploy DIY phishing kits targeting any brand (Help Net Security)](https://www.helpnetsecurity.com/2025/02/20/darcula-allows-tech-illiterate-crooks-to-create-deploy-diy-phishing-kits-targeting-any-brand/)
- [Cybercriminals Can Now Clone Any Brand's Site in Minutes Using Darcula PhaaS v3 (The Hacker News)](https://thehackernews.com/2025/02/cybercriminals-can-now-clone-any-brands.html)
- [AI-enabled darcula-suite makes phishing kits more accessible, easier to deploy (Netcraft)](https://www.netcraft.com/blog/ai-enabled-darcula-suite-makes-phishing-kits-more-accessible-easier-to-deploy)
- [Utilities United Against Scams](https://utilitiesunited.org/)
- [BBB Scam Tracker Risk Report 2024](https://bbbmarketplacetrust.org/riskreport2024/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5798