Every 10 minutes, this domain list is downloaded directly from the LosPollos API endpoint using the malware operator\u2019s own key:\u00a0\u00a0<\/p>\n
\n
hxxps:\/\/domainapi.<\/span>lospollos[.]com\/actualdomain?key=ea6ff61a45e946c287ea5f121c4f2e4b<\/span><\/pre>\n<\/div>\nHere\u2019s a typical unencrypted response with VexTrio\/LosPollos domains:<\/p>\n
\n
{<\/span>\u00a0<\/span>\n\"<\/span>Dating<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>romancezone[.]one<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Mainstream<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>topawardpicks[.]top<\/span>\"<\/span>,<\/span>\"<\/span>yourspacegain[.]top<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Crypto<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>coinsboostbonus[.]top<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Gay Dating<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>hot-gays-quest[.]life<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>iGaming<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>your-bigprofit[.]top<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Cams<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>myhot-cams[.]life<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Dating-new<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>p9xpmrp.romancezone[.]one<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Mainstream-new<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>p9xpmrp.topawardpicks[.]top<\/span>\"<\/span>,<\/span>\"<\/span>p9xpmrp.yourspacegain[.]top<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Crypto-new<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>p9xpmrp.coinsboostbonus[.]top<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Gay Dating-new<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>p9xpmrp.hot-gays-quest[.]life<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>iGaming-new<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>p9xpmrp.your-bigprofit[.]top<\/span>\"<\/span>]<\/span>,<\/span>\u00a0<\/span>\n\"<\/span>Cams-new<\/span>\"<\/span>:<\/span>[<\/span>\"<\/span>p9xpmrp.myhot-cams[.]life<\/span>\"<\/span>]<\/span>\u00a0<\/span>\n}<\/span><\/span><\/pre>\n<\/div>\nTDS functionality\u00a0<\/h3>\n The main function of the counts.php<\/strong> script is to serve the JavaScript redirect code to infected website that request it via URLs like this:<\/p>\n\n
https:\/\/node<\/span>><\/span>\/wp-content\/counts.<\/span>php?cat=0<\/span>&t=encrypted-ref-domain<\/span>><\/span>\u00a0<\/span><\/span><\/span><\/pre>\n<\/div>\nBased on the requested category (&cat) the script selects the domain name, user id and the category to generate a LosPollos \u201csmart link\u201d.\u00a0<\/p>\n
\n
For example, if the ?cat<\/strong> parameter is \u201c0<\/strong>\u201d, then the TDS will select the \u201cDating\u201d category, the romancezone[.]one<\/strong> domain and the \u201c\/?u=7mkpd0d&o=ex3wmkx<\/strong>\u201d parameters to form the following smart link:\u00a0<\/p>\n\n
hxxps:\/\/romancezone[.]one\/?u=7<\/span>mkpd0d&o=ex3wmkx&t=encrypted-ref-domain<\/span>><\/span><\/span><\/span><\/pre>\n<\/div>\nSimilarly, for ?cat=1, we get the \u201cMainstream\u201d category and the following smart link:\u00a0<\/p>\n
\n
hxxps:\/\/topawardpicks[.]top\/?u=7<\/span>mkpd0d&o=ex5whk5&t=encrypted-ref-demin<\/span>><\/span>\u00a0<\/span><\/span><\/pre>\n<\/div>\nThis link is then injected into the final JavaScript code, which is already familiar to us from the \u201cclient side\u201d section of our first DollyWay post<\/a>.\u00a0<\/p>\n\n
December 2024: New counts.php version\u00a0<\/h4>\n Mid-November 2024, many threat actors started switching from LosPollos smart links to alternative redirect destinations. DollyWay operators followed the suit and by the end of December 2024, they gradually upgraded the counts.php script on most C2\/TDS nodes.\u00a0<\/p>\n
The new version included new functionality:\u00a0<\/p>\n
\nInstead of LosPollos API, the new redirect URLs are retrieved from the trafficredirect<\/strong> Telegram channel (it was created on November 28, 2023). If it\u2019s not available, the fallback URL is: hxxps:\/\/pinkfels[.]shop<\/strong>\/?t=json&i=01e077f41c42710c07820d85fff21c63&a=11341608982415′\u00a0 (domain was created on November 28, 2023)\u00a0<\/li>\nThe new redirect URL is cached for 100 seconds in the \/wp-content\/4052e211471469076d33effdf1795b24<\/strong> file (where 4052e211471469076d33effdf1795b24 is MD5 hash for \u201c11341608982415<\/strong>\u201d)\u00a0<\/li>\n<\/ol>\n\nConstants in the generated redirect JavaScript are changed:\u00a0<\/span>\n\ntest \u2192 test01\u00a0<\/li>\n click4 \u2192 click01<\/li>\n<\/ul>\n<\/li>\n<\/ol>\nTDS usage statistics\u00a0<\/h2>\n While taking over individual C2\/TDS nodes can\u2019t disrupt the malicious campaign, it allows us to peek into the statistics of the whole operation by leveraging the website server logs.\u00a0<\/p>\n
From the logs, we see the following:\u00a0<\/p>\n
\nRequests to the TDS scripts (counts.php \/ count.php<\/strong>) from infected websites around the world\u00a0<\/li>\nRequests to the data.txt<\/strong> file; infected sites request this file once a day.\u00a0<\/li>\nReferrers: these requests come from compromised sites\u00a0<\/li>\n Requested categories (&cat<\/strong> parameter of the counts.php script)\u00a0<\/li>\nWordPress versions of infected sites\u00a0<\/li>\n<\/ul>\nWe analyzed four months worth of logs on 3 different nodes that served both counts.php and count.php versions and found the following:\u00a0<\/p>\n
Each individual node gets about 1.9 million<\/strong> TDS requests per month from about 1.3 million <\/strong>unique IP addresses. These are requests from real visitors with browsers that execute JavaScript code. They are literally \u201cone click away\u201d from getting redirected to malicious sites (they get redirected if they click anywhere on a web page).\u00a0<\/p>\nGiven that currently there are 14 nodes in the list and three of them are randomly picked to load malicious code, the chances that any specific node is chosen in roughly 20%. \u00a0<\/p>\n
This allows us to extrapolate our numbers to the whole network of malicious TDS nodes: \u00a0<\/p>\n
9-10 million<\/strong> impressions of infected pages per month result in loading malicious scripts from the TDS.\u00a0<\/p>\nRoughly 60%<\/strong> of them used the \u201cMainstream<\/strong>\u201d category (?cat=1) for the redirect links and 40%<\/strong> the \u201cDating<\/strong>\u201d category (?cat=0).\u00a0During October 2024 to February 2025, 10,043<\/strong> unique domains were used as referrers in requests to DollyWay v2 and v3 TDS scripts and the data.txt files.\u00a0<\/p>\nWe\u2019ve also analyzed the WordPress versions of infected sites. Total we found
![\"\"](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image-22.png?size=3840x0\"\/)
<\/figure>\n<\/div>\n![\"\"](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image-21.png?size=3840x0\"\/)
<\/figure>\n<\/div>\n![\"LosPollos](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image-23.png?size=3840x0\"\/)
<\/figure>\n<\/div>\n![\"text\"](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image-20.png?size=3840x0\"\/)
<\/figure>\n<\/div>\n