VexTrio operates a large-scale fraud enterprise centered on smartlink-driven scams, spam distribution, and scam apps that impersonate legitimate brands and services. Their operations include affiliated ad networks, fake VPNs and spam‑blocker apps, and extensive DNS/mail infrastructure tying domains like datingcell[.]com and mail.holaco[.]de to their campaigns. #VexTrio #datingcell[.]com #mail.holaco[.]de
Keypoints
- VexTrio primarily creates and controls scam landing pages delivered via smartlinks embedded in compromised sites and social platforms, favoring dating and crypto verticals.
- The group publishes and distributes malicious apps (VPNs, spam blockers, dating apps) under developer names like HolaCode, LocoMind, AlphaScale Media, and others, with millions of aggregate downloads.
- Shared code, hosting, trademarks, and personnel links tie VexTrio to advertisers/partners such as Techintrade and OILIMPEX, suggesting close or overlapping relationships.
- VexTrio runs extensive spam operations using lookalike mail domains (e.g., sendgrid[.]rest, mailgun[.]fun) and contracts third-party mail services like YNOT Mail for distribution.
- DNS and hosting evidence (e.g., AS5368, IPs like 136.243.216.249 and 185.155.186.134) show consolidation of apps, ad networks (Los Pollos, TacoLoco, AdsPro), and scam infrastructure.
- Scam landing pages impersonate high-profile brands and public figures (e.g., Tinder, MrBeast, Elon Musk, Trump, CISA) to lure victims into investment, crypto, dating, and antivirus frauds.
- VexTrio’s extended corporate network includes many micro-companies and unexpected businesses (e.g., Profine Energy Bulgaria) that obscure and possibly legitimize the enterprise.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Smartlinks and compromised websites redirect users to scam landing pages; “…embedded into compromised websites…the final landing pages are all scams…”
- [T1204] User Execution – Victims are tricked into interacting with fake chat prompts, questionnaires, and app permissions that lead to fraud; “…users are charged excessive amounts to send messages…constant stream of connection requests from fake profiles…”
- [T1566] Phishing – Dating and promotional spam emails impersonate messaging and dating notifications to lure clicks to scam sites; “…messages that masquerade as a chat or text exchange…embedded with a link that redirects to datingcell[.]com.”
- [T1071] Application Layer Protocol – Use of HTTP(S) smartlink redirections and trafficiq[.]com trackers to route and track victims to scam landing pages; “…Buttons…allow YNOT Mail to track clicks, which when pressed will lead users to VexTrio fake dating sites.”
- [T1588] Establish Accounts – Registration and use of lookalike and affiliate domains and developer accounts in app stores to publish scam apps under multiple developer names; “…released apps under several developer names, including HolaCode, LocoMind, Hugmi, Klover Group, and AlphaScale Media.”
- [T1078] Valid Accounts – Abuse of legitimate third-party email marketing services (YNOT Mail) and SPF delegation to send spam on behalf of VexTrio-owned domains; “…domains…configured with the DNS TXT record v=spf1 include:_spf.smtp.com include:_spf.ynotmail.com ~all.”
Indicators of Compromise
- [Domain] Scam landing and mail domains – datingcell[.]com, fidelityemail[.]com (used in dating and email marketing campaigns)
- [Domain] Smartlink/scam URLs – fastminingpro[.]com/payouts/, cryptoprofit[.]life/?u=fmkpte4 (examples of cryptocurrency/investment scam pages)
- [IP Address] Hosting and app/server IPs – 136[.]243[.]216[.]249 (hosts HolaCode, AdsPro Digital, Los Pollos and apps), 185[.]155[.]186[.]134 (resolves vm-oilimpex.holacode[.]tech and vm-technitrade.holacode[.]tech)
- [IP Address] Mail server – 78[.]47[.]103[.]187 (mail.holaco[.]de authorized in SPF for sendgrid[.]rest)
- [App ID / Package] App identifier – com.spam.shield.spamblocker.notificationhistory (Spam Shield app tied to HolaCode)
- [Mail Host / Tracker] Tracking domains and SMTP hosts – trafficiq[.]com (YNOT Mail tracker), smtp host 99[.]192[.]179[.]143 used to send emails from postmaster[@]datingcell[.]com
- [Other] Lookalike mail service domains – sendgrid[.]rest, mailgun[.]fun (used for deceptive email distribution)