One Group, Six Countries, One Target: Unpacking a Scam Corridor to Australia
Over the summer of 2026, the OXIL research team have been developing an LLM-scaled methodology to analyse scam target geographies of signals in the GSE. They mapped a dataset of ~8 million unique, domain-based signals from the first six months of 2026 to respective countries, giving a relevance score between 1-6.
The team were especially interested in the concept of scam corridors, following the geographic journey a scam takes before reaching its target. For instance, a scammer in Cambodia may register a domain using a registrant proxy service in Iceland, hosting the IP address in the US, and targeting residents of the UK. Repeatedly seeing the same pattern of this scam journey in our data often exposes common scammer behaviour, or in some cases, even identifies the presence of a single organised crime entity.
Let’s look at an example. There are 850 signals in our dataset where Botswana is listed and the domain registrant country. Of these, 638 signals target a country with a relevance score >= 2. Of these, 533 signals target Australia (that’s 63% all targeting one country!).
Let’s unpack these:
Registrar: 100% of these domains were registered with Hong Kong-based registrar Dominet.
Top Level Domain: 53% use .vip (US) and 44% use .top (China).
Autonomous Systems: 65% of these domains are hosted by the Chinese autonomous system, TENCENT-NET-AP-CN, and 17% are hosted by the Saudi Arabian autonomous system STC-IGW-AS Saudi Telecom Company JSC.
Regional Internet Registry Prefix Country: All of the domains hosted on the Chinese ASN have Singapore listed as the RIR prefix country.
HTML Content: Many of the signals have website html content containing Chinese-language developers comments, suggesting either an understanding of the language or the use of Chinese phishing kits.
It seems very unlikely that these patterns are by chance. It is clear that an organised group of scammers, who are supposedly based in Botswana, are using Chinese phishing kits to build websites, registering domains with a Hong Kong registrar, that have TLDs owned by registries in the US and China, hosting using either a Chinese Autonomous System (with an IP block allocated to Singapore) or a Saudi Arabian Autonomous System, and finally targeting residents of Australia.
But how exactly do they target them?
Thematic Lures:
In the majority of domains, the scammers spoofed 6 Australian Banks, as well as local supermarkets, airlines and Australia Post. In many cases, scammers used well-known local abbreviations or shortenings such as ‘commbank’ or ‘cba’ (Commonwealth Bank Australia).
Top entities in Botswana->Australia signals^
This links to our wider research, where we see scammers creating bespoke attacks to gain the interest, trust and finances of residents of a certain place.
Other Trends: 84 of the domains contain the number 365, indiscriminately of the spoofed bank or business.
After unpacking the Australian domains, the team begin to wonder:
Is this scam group using similar tactics in other countries?
When looking at other signals that share the same infrastructure (registrant, registrar, ASNs), the second most targeted country after Australia is Greece. Looking closer at those signals, the domains spoof Greece’s state-owned national postal service provider, Hellenic Post (ELTA), and their public tax and revenue services (AADE). As Melbourne hosts one of the largest Greek-speaking populations outside of Greece and Cyprus, could these results be linked?
