Toll-Scam Infrastructure Report: Attackers Rely on a Small Cluster of Permissive TLDs

A new analysis reveals toll-scam operators repeatedly using a narrow group of permissive TLDs to host phishing and SMS-bait pages. We break down the TLD clusters and patterns.








