Industrialized Smishing Infrastructure Targeting the UAE and Singapore Transportation, Government

A large-scale, industrialized smishing campaign is impersonating UAE and Singapore government and transportation services via dynamically generated .top/.cc subdomains hosted on Alibaba Cloud (e.g., emiratespost.ae.tcsz.top, onemotoring.lta.govl.top, IP 47.254.56.221). The infrastructure uses automated domain rotation, Let’s Encrypt certificates, geo-fencing, and mobile-optimized phishing pages to harvest credentials and payment data, indicating coordinated phishing-as-a-service activity targeting financial credentials and national digital identity services.