MONOPOLY GUARD v3 Powers Allegro Lokalnie PhaaS — Bulletproof Hosting, XOR Anti-Bot, Serial .pl Domain Seizure Loop
A six-day-old phishing-as-a-service kit cloning Allegro Lokalnie (Poland's largest secondhand marketplace) uses a custom XOR-obfuscated bot-fingerprinting system called MONOPOLY GUARD v3 to block all scanner and analyst access. The kit runs on AS197769 (VPSDEDICATED-AS, US bulletproof) and the operator has established a serial domain registration pattern: each time NASK seizes a .pl subdomain, a new sequential one goes live within days. Predecessor domain allegrolokalnie.282119.pl is already under NASK proceeding.
allegrolokalnie.283101.pl, allegrolokalnie.282032.pl, and allegrolokalnie.282119.pl. NASK actioned the full serial registration pattern documented in this report, taking down all three generations simultaneously. The underlying server (102.220.160.128, AS197769) remains alive with HTTP 404 — the vhosts are gone, not the machine. The operator cannot reuse these domains. Fresh registration on a new .pl or alternative TLD is the expected next move.
Allegro Lokalnie PhaaS Clone — iPhone 8 Lure, Seller-Targeted Push-Payment Fraud
The kit is a full client-side replica of allegrolokalnie.pl, Poland's leading secondhand marketplace. It targets sellers, not buyers. The lure: a Polish Allegro user has posted a real-looking listing for an iPhone 8 128GB Space Gray and is directed to this kit via a personalized URL to "receive payment" from a purported buyer. The victim believes they are collecting money — not surrendering credentials or authorizing a charge.
Operator configuration is injected server-side into window.__ZaufaniebotOfferSettings — delivery prices in PLN, InPost locker availability, courier, and pickup options. The product title, photo carousel, and Polish breadcrumb trail are all rendered dynamically, making the page indistinguishable from a real Allegro Lokalnie offer.
MONOPOLY GUARD v3 — XOR-Obfuscated Anti-Bot with 10-Probe Fingerprinting and Beacon Exfil
The file guard.js is 24,985 bytes of XOR-obfuscated JavaScript. Decoding algorithm: b[i] = arr[i] ^ 66 ^ (i % 256) where key 66 (0x42) is the fixed XOR constant and position modulo 256 adds per-byte rotation. The decoded payload is 6,942 characters of minified JavaScript named MONOPOLY GUARD v3.
The system requires window.__MONOPOLY_GUARD__ to be injected into the page HTML by the server. This object carries G.endpoint (beacon URL) and G.blockThreshold (score cutoff for blocking). Both remain unknown without a valid victim session — the server refuses to render the HTML to non-victim IPs.
$cdc_asdjflasutopfhvcZLmcfl_), stack trace scan, and SwiftShader WebGL renderer. Datacenter IPs are blocked at the HTTP layer before any JS executes. The only reachable endpoints without a valid victim-session URL are /guard.js, /allegrolokalnie.js, and /health.AS197769 VPSDEDICATED-AS Bulletproof Infrastructure — Dedicated IP, No Co-hosted Domains
The kit resolves to 102.220.160.128, allocated within netblock 102.220.160.0/22 (1,024 IPs) under AS197769, operated by VPS Dedicated LLC (US-registered). The abuse contact for this ASN is abuse@vpsdedicated.net. HackerTarget reverse-IP lookup returned zero co-hosted domains — the operator is using a clean, single-purpose dedicated server with no other domains sharing the IP, eliminating standard pivot opportunities.
Cloudflare nameservers (poppy.ns.cloudflare.com, vasilii.ns.cloudflare.com) provide DNS management. The wildcard certificate *.283101.pl was issued by Let's Encrypt at 2026-08-11T10:25:00Z — 37 minutes before the domain registration timestamp (11:02:46 UTC). This pre-staged cert issuance indicates a scripted deployment pipeline: the operator automates domain registration and cert acquisition as a single workflow.
Serial NASK Seizure Evasion — Operator Registers Sequential .pl Subdomains as Predecessors Are Seized
Domain research reveals a three-generation active fraud infrastructure on the same subdomain pattern and IP, with NASK (Poland's national domain registry) actively seizing earlier iterations. The operator counters each seizure by registering a new sequential .pl numeric subdomain within days, all through the same registrar (nazwa.pl) and pointing to the same server IP.
MITRE ATT&CK Mapping and Operational Security Profile
The operator runs a professionally structured fraud operation with deliberate OPSEC choices at each layer: scripted infrastructure deployment, anti-bot obfuscation with custom XOR encoding, victim-session gating, bulletproof offshore hosting, and Telegram-based C2 (inferred from zero MX records). The combination of MONOPOLY GUARD v3 and per-victim URL assignment makes both automated scanning and manual probing from non-victim IPs impossible.
Reporting Targets
{"status":"ok"}.*.283101.pl issued Let's Encrypt 2026-08-11T10:25:00Z — 37 minutes before domain registration. Confirms scripted, automated deployment pipeline. Subdomain allegrolokalnie.283101.pl covered by wildcard.IOC Table
| Type | Indicator | Notes |
|---|---|---|
| DOMAIN | 283101.pl | Primary domain — registered 2026-08-11, nazwa.pl registrar |
| DOMAIN | allegrolokalnie.283101.pl | Active PhaaS subdomain — Allegro Lokalnie clone |
| DOMAIN | allegrolokalnie.282032.pl | Sister domain — same IP, active (Generation 2) |
| DOMAIN | allegrolokalnie.282119.pl | Predecessor — under NASK seizure proceeding (Generation 1) |
| IP | 102.220.160.128 | Dedicated server — all three generations, AS197769 |
| ASN | AS197769 | VPSDEDICATED-AS — VPS Dedicated LLC (US), netblock 102.220.160.0/22 |
| PATH | /guard.js | MONOPOLY GUARD v3 — 24,985 bytes XOR(key=66,pos%256) obfuscated |
| PATH | /allegrolokalnie.js | Kit loader — 352 lines, Allegro Lokalnie UI clone |
| PATH | /health | Live server probe — HTTP 200 {"status":"ok"} |
| JS | window.__ZaufaniebotOfferSettings | Operator config injection — delivery options, pricing in PLN |
| JS | window.__MONOPOLY_GUARD__ | Runtime config — carries G.endpoint and G.blockThreshold (server-injected) |
| JS | navigator.sendBeacon(G.endpoint, blob) | Bot fingerprint exfil — payload: score, flags, token, canvas, tz, page, ts |
| CERT | *.283101.pl (Let's Encrypt) | Wildcard TLS — issued 2026-08-11T10:25Z (37min before domain registration) |
| abuse@vpsdedicated.net | ASN abuse contact — VPSDEDICATED-AS (AS197769) |
Evidence: MONOPOLY GUARD v3 Decoded Analysis
Evidence: Infrastructure Attribution
Live Web Capture — Bot-Gate Active (Datacenter IP Blocked)
Live Web Capture — Server Alive Proof (/health Endpoint)
