{
  "name": "Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs",
  "slug": "hold-the-phone-international-revenue-share-fraud-driven-by-fake-captchas",
  "description": "Threat actors are leveraging fake CAPTCHA pages to trick victims into sending premium SMS messages as part of an international revenue share fraud (IRSF) scheme. Operating since at least June 2020, this campaign uses traffic distribution systems and social engineering to direct users through multi-stage fake verifications requiring SMS messages to international phone numbers across 17 countries with high termination fees. Each CAPTCHA step triggers messages to over a dozen destinations, generating over 60 SMS messages per victim costing approximately $30. The operation employs back button hijacking, sophisticated tracking cookies, and affiliate advertising networks to maximize reach while obscuring the fraud from detection. Both individual victims and telecommunication carriers suffer financial losses through this deceptive scheme.",
  "published": "2026-04-23T19:25:54.787000+00:00",
  "created_at": "2026-04-27T14:39:00.181000+00:00",
  "modified_at": "2026-04-27T12:39:00+00:00",
  "created_at_opencti": "2026-04-27T14:39:00.181000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "click2sms",
    "fake captcha",
    "irsf",
    "sms fraud",
    "social engineering",
    "tds"
  ],
  "tags": [
    "2026-04-23",
    "click2sms",
    "fake captcha",
    "irsf",
    "sms fraud",
    "social engineering",
    "tds"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "9c6e31f0-8696-466b-b385-5be8ec6dc6b9",
        "name": "d.santafebuno.top"
      },
      {
        "id": "1b1c283d-80e6-4b7f-adca-b95e7ed109b9",
        "name": "d.vistertransit.com"
      },
      {
        "id": "fde1de54-742a-47e9-965b-7ff7455087fa",
        "name": "megaplaylive.com"
      },
      {
        "id": "1bb894ed-9471-49bb-b6fc-5ddf9d64987d",
        "name": "d.ruelomamuy.com"
      },
      {
        "id": "2607f25a-3734-48d2-a64c-6af69d2719ef",
        "name": "r.transitcaxip.com"
      },
      {
        "id": "73d5068f-2fa0-405b-95e6-fb09937d0773",
        "name": "verifysuper.com"
      },
      {
        "id": "0d9c403c-94d6-4448-b290-45d12298274c",
        "name": "mamil.com"
      },
      {
        "id": "02ef9703-78df-4b22-a5cd-46d1a45c9d3b",
        "name": "chat.matchnewtoday.com"
      },
      {
        "id": "5466cd0f-280e-44f8-ac9a-874f1e5c397f",
        "name": "d.fufecarrol.top"
      },
      {
        "id": "d6a8322b-d784-485f-979a-3f485446f74d",
        "name": "d.remotesbuffalo.top"
      },
      {
        "id": "2b0746c5-6363-41b3-bbc3-a67c35fa2a16",
        "name": "claimandwins.com"
      },
      {
        "id": "0ba562ab-c7c4-4b3d-b999-f0f772aad4d8",
        "name": "r.buffalosolpe.top"
      },
      {
        "id": "b826ced3-9930-4152-a78b-cdf6d9dff5d7",
        "name": "r.carrolvassin.top"
      },
      {
        "id": "5d4dc6e5-84e0-4572-b478-7590092ba9a9",
        "name": "d.panzozerrot.com"
      },
      {
        "id": "9e72c104-82f3-4e85-a2e0-d69e3dbd1e7a",
        "name": "4lifetips.com"
      },
      {
        "id": "307f8e3b-8f17-4d1d-8d2a-108313f746e9",
        "name": "hotnow.sweeffg.online"
      },
      {
        "id": "76c9db41-d643-44a2-8a70-91cfcf223491",
        "name": "d.zerrotmamil.com"
      },
      {
        "id": "8714134f-8869-48a1-a407-fb5ba88d93c2",
        "name": "vids.chatorizon.com"
      },
      {
        "id": "d6bcf0eb-80e7-46c3-85b2-626e23e8c9e3",
        "name": "zawsterris.com"
      },
      {
        "id": "17b904d5-b796-4547-b383-b3a8643ef5d0",
        "name": "solpe.top"
      },
      {
        "id": "15d2bc91-5a1f-41db-8b3c-1fa76967d539",
        "name": "vassin.top"
      },
      {
        "id": "3a34c106-33da-41fe-9ebc-3e61d741870d",
        "name": "caxip.com"
      },
      {
        "id": "c32ccbd0-ac61-463a-aa7d-000d0a3ffa48",
        "name": "d.herbosfinx.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "75702b35-b790-4504-a1e0-7829e76f22e9",
        "name": "T1585"
      },
      {
        "id": "79525d9e-3824-4347-a471-7dcea20fd864",
        "name": "T1583.006"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "a7cb57ea-5e24-437e-8dad-1d22c2d8a80b",
        "name": "T1590.001"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "78fb7aa9-3053-46c9-b9c7-c74eeecc429c",
        "name": "T1585.001"
      },
      {
        "id": "14da8ebf-e0b0-4d4e-9c83-56277980f266",
        "name": "T1134"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "de38dd3a-41d7-4621-8a00-a32d7f0ff420",
        "name": "T1102.002"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "5dee2969-7083-430e-9083-73bab54c3a18",
        "name": "T1590"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      }
    ],
    "observables": [
      {
        "id": "8a0a41e9-2ca1-48cb-b2a7-20151a582257",
        "name": "4lifetips.com"
      },
      {
        "id": "258059ba-9384-4c78-94ce-3114d9cab1a8",
        "name": "solpe.top"
      },
      {
        "id": "1b6a16e7-0715-4553-b606-b98d9a3c6dde",
        "name": "vassin.top"
      },
      {
        "id": "39f79c85-c173-4c41-b50a-60b844bc555f",
        "name": "mamil.com"
      },
      {
        "id": "2913a511-0193-4c31-91ea-24a62035a663",
        "name": "zawsterris.com"
      },
      {
        "id": "bf657e7c-bf76-42c8-a7ee-5d00b9c6805b",
        "name": "megaplaylive.com"
      },
      {
        "id": "1f6a6eab-5a7c-4bac-8a8b-8617eb9b2a1e",
        "name": "caxip.com"
      },
      {
        "id": "96f6c54a-02aa-423d-ae12-7e0311a02096",
        "name": "claimandwins.com"
      },
      {
        "id": "e893514d-7dab-447e-b364-93528d51ab96",
        "name": "verifysuper.com"
      },
      {
        "id": "f9591c12-49b5-4631-a16e-efae7ab2a325",
        "name": "r.transitcaxip.com"
      },
      {
        "id": "7d22abae-0741-47f3-9aaf-d03be8bf2e9a",
        "name": "hotnow.sweeffg.online"
      },
      {
        "id": "5996dd4c-0ccf-4d3f-8c7e-5e9e16032cbf",
        "name": "r.carrolvassin.top"
      },
      {
        "id": "b3adb5f3-af7b-4ade-a07a-ead8dcbe8119",
        "name": "d.ruelomamuy.com"
      },
      {
        "id": "2f86760b-5705-4679-ae6f-502f6780d6f3",
        "name": "vids.chatorizon.com"
      },
      {
        "id": "f7db468e-0ba9-45e0-9492-0ae5ceb48d4d",
        "name": "d.fufecarrol.top"
      },
      {
        "id": "2bf35f03-19d3-48ba-97bf-8f1fbde085d6",
        "name": "d.santafebuno.top"
      },
      {
        "id": "4457b91e-d9aa-42a0-94d2-a50db62fcf87",
        "name": "r.buffalosolpe.top"
      },
      {
        "id": "5bd015f4-cf1d-4877-bcb4-b5965892e18b",
        "name": "chat.matchnewtoday.com"
      },
      {
        "id": "9b12d824-e499-43d3-8fbf-369fb7da8dd6",
        "name": "d.remotesbuffalo.top"
      },
      {
        "id": "db52e5e1-51d1-49d9-b333-81b04bb74297",
        "name": "d.vistertransit.com"
      },
      {
        "id": "6821b929-5556-45c0-8b28-598e27e5cc78",
        "name": "d.herbosfinx.com"
      },
      {
        "id": "0afb9aa0-e187-46b7-9b8a-7b9f3cf33637",
        "name": "d.zerrotmamil.com"
      },
      {
        "id": "dfa960b8-ef70-44a8-ae94-e9efcdafdc76",
        "name": "d.panzozerrot.com"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Belgium"
      },
      {
        "id": "",
        "name": "Poland"
      },
      {
        "id": "",
        "name": "Egypt"
      },
      {
        "id": "",
        "name": "Sweden"
      },
      {
        "id": "",
        "name": "Austria"
      },
      {
        "id": "",
        "name": "Azerbaijan"
      },
      {
        "id": "",
        "name": "Netherlands"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "Kazakhstan"
      },
      {
        "id": "",
        "name": "Spain"
      },
      {
        "id": "",
        "name": "France"
      },
      {
        "id": "",
        "name": "Myanmar"
      },
      {
        "id": "",
        "name": "Switzerland"
      },
      {
        "id": "",
        "name": "Italy"
      },
      {
        "id": "",
        "name": "Malawi"
      },
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "d.santafebuno.top"
      },
      {
        "id": "",
        "name": "d.vistertransit.com"
      },
      {
        "id": "",
        "name": "megaplaylive.com"
      },
      {
        "id": "",
        "name": "d.ruelomamuy.com"
      },
      {
        "id": "",
        "name": "r.transitcaxip.com"
      },
      {
        "id": "",
        "name": "verifysuper.com"
      },
      {
        "id": "",
        "name": "mamil.com"
      },
      {
        "id": "",
        "name": "chat.matchnewtoday.com"
      },
      {
        "id": "",
        "name": "d.fufecarrol.top"
      },
      {
        "id": "",
        "name": "d.remotesbuffalo.top"
      },
      {
        "id": "",
        "name": "claimandwins.com"
      },
      {
        "id": "",
        "name": "r.buffalosolpe.top"
      },
      {
        "id": "",
        "name": "r.carrolvassin.top"
      },
      {
        "id": "",
        "name": "d.panzozerrot.com"
      },
      {
        "id": "",
        "name": "4lifetips.com"
      },
      {
        "id": "",
        "name": "hotnow.sweeffg.online"
      },
      {
        "id": "",
        "name": "d.zerrotmamil.com"
      },
      {
        "id": "",
        "name": "vids.chatorizon.com"
      },
      {
        "id": "",
        "name": "zawsterris.com"
      },
      {
        "id": "",
        "name": "solpe.top"
      },
      {
        "id": "",
        "name": "vassin.top"
      },
      {
        "id": "",
        "name": "caxip.com"
      },
      {
        "id": "",
        "name": "d.herbosfinx.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "010e0553-1362-4311-b857-199696cd82fe",
      "standard_id": "external-reference--c9de4525-4011-5501-8096-00feb9f01398",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69ea72429017f495ef581024",
      "hash": null,
      "external_id": "69ea72429017f495ef581024",
      "created": "2026-04-27T14:38:59.857Z",
      "modified": "2026-04-27T14:38:59.857Z",
      "createdById": null
    },
    {
      "id": "02134f5a-57de-445f-bf26-5042e59360e2",
      "standard_id": "external-reference--e49cc4fc-6012-55b7-9617-fc0d6c234e16",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.infoblox.com/blog/threat-intelligence/hold-the-phone-international-revenue-share-fraud-driven-by-fake-captchas/",
      "hash": null,
      "external_id": null,
      "created": "2026-04-27T14:39:00.029Z",
      "modified": "2026-04-27T14:39:00.029Z",
      "createdById": null
    }
  ]
}