DNS Analysis Maps 90 Domains Linked to Pushpaganda Scareware Campaign

Summary

HUMAN’s Satori team linked Pushpaganda’s Google Discovery feed abuse, SEO manipulation and AI-generated lures to scareware and scams. A DNS/WHOIS review of 90 domains found 162 associated IPs (101 confirmed malicious) and 1,055 email-connected domains.

Key points

HUMAN’s Satori team described Pushpaganda as a campaign that used Google Discovery feeds, SEO techniques and AI-generated content to direct Android and Chrome users to scareware, fake legal threats and financial scams.
The DNS follow-up examined 90 of 113 domain IoCs after excluding domains the researchers considered legitimate.
Sample traffic showed five client IP addresses across two ASNs communicating with four IoCs in 1,795 DNS queries between February 16 and April 16, 2026.
Researchers identified 162 associated IP addresses, 101 of which they confirmed as malicious, and 1,055 email-connected domains.
Historical DNS and WHOIS analysis found one IoC bulk-registered with two look-alike domains and eight IoCs likely registered with malicious intent.
The researchers caution that some entities identified as malicious could later be deemed harmless and recommend further investigation.

Article Details

Attack Vectors: The campaign used advanced SEO techniques and AI-generated content to place deceptive news in personalized Google Discovery feeds for Android and Chrome users.
Users were tricked into enabling push notifications and then shown scareware messages, fake legal threats, or financial scam lures.
The investigation identified look-alike domains associated with a campaign domain IoC.
Defensive Notes: The article recommends supplementary investigation to corroborate threat classifications, noting that entities identified as malicious may later prove harmless or be reassessed.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`alakamahabidyalaya[.]org`	Listed as a Pushpaganda domain IoC and reported on a malicious-domains feed.
DOMAIN	`apacollege[.]org`	Identified among Pushpaganda domain IoCs with historical DNS resolutions dating to 2017.
DOMAIN	`assessmentsonline[.]co[.]za`	Identified among Pushpaganda domain IoCs with historical DNS resolutions dating to 2017.
DOMAIN	`behavioralhealthworkforce[.]org`	Listed as a Pushpaganda domain IoC and reported on a malicious-domains feed.
DOMAIN	`brokenhillcottages[.]com[.]au`	Identified among Pushpaganda domain IoCs with historical DNS resolutions dating to 2017.
DOMAIN	`cisda[.]org`	Listed as a domain IoC in the investigation's historical DNS-resolution examples.
DOMAIN	`crmcateringcollege[.]com`	Identified among Pushpaganda domain IoCs with historical DNS resolutions dating to 2017.
DOMAIN	`englishproject[.]org`	Listed as a domain IoC in the investigation's historical DNS-resolution examples.
DOMAIN	`gardn[.]org[.]au`	Identified among Pushpaganda domain IoCs with historical DNS resolutions dating to 2017.
DOMAIN	`harvardglobalcollege[.]co[.]za`	Listed as a Pushpaganda domain IoC and reported on a malicious-domains feed.
DOMAIN	`jasminsgranville[.]com[.]au`	Listed as a domain IoC in the investigation's historical DNS-resolution examples.
DOMAIN	`northcoastradio104[.]co[.]za`	Listed as a Pushpaganda domain IoC and reported on a malicious-domains feed.
DOMAIN	`publishedreporter[.]com`	Listed as a domain IoC in the investigation's historical DNS-resolution examples.
DOMAIN	`shastrijimahilavidyaniketan[.]org`	Listed as a Pushpaganda domain IoC and reported on a malicious-domains feed.
DOMAIN	`thrillscranton[.]com`	Listed as a domain IoC in the investigation's historical DNS-resolution examples.
DOMAIN	`triplea[.]pl`	Reported as a look-alike domain bulk-registered alongside the campaign domain IoC triplek[.]co[.]za.
DOMAIN	`triplek[.]co[.]za`	Identified as a Pushpaganda campaign domain IoC.
DOMAIN	`triplex[.]industries`	Reported as a look-alike domain bulk-registered alongside the campaign domain IoC triplek[.]co[.]za.