gov.fgtgr.buzz: badware

[ExtRIELICi]

Prerequisites

• This is NOT a YouTube, Facebook, Twitch or a shortener/hosting site report. These sites MUST be reported by clicking their respective links.
• I read and understand the policy about what is a valid filter issue.
• I verified that this issue is not a duplicate. (Search here to find out.)
• I did not remove any of the default filter lists, or I have verified that the issue was not caused by removing any of the default lists.
• I did not enable additional filter lists, or I have verified that the issue still occurs without enabling additional filter lists.
• I do not have custom filters/rules, or I have verified that the issue still occurs without custom filters/rules.
• I am not using uBlock Origin along with other content blockers.
• I have verified that the web browser's built-in content blocker/tracking protection, network wide/DNS blocking, or my VPN is not causing the issue.
• I have verified that other extensions are not causing the issue.
• If this is about a breakage or detection, I have verified that it is caused by uBlock Origin and isn't a site issue.
• I did not answer truthfully to ALL the above checkboxes.

URL(s) where the issue occurs.

https://gov.fgtgr.buzz/

Description

Fake domain, is being sent via SMS to Greek users pretending to be gov.gr, specifically pretending to be AADE (tax service).

Other extensions used

none

Screenshot(s)

Screenshot(s)

Configuration

Details

[ExtRIELICi]

It turns out there are a large number of domains used for this specific, complex scam. Here are a few more I found, though it seems there are many others according to Greek news articles. Is there a way to block all of them using regex or something?

https://gov.rvgr.buzz/
https://gov.scoigr.buzz/
https://gov.hisgr.buzz/
https://gov.carngr.sbs/

@stephenhawk8054

[ExtRIELICi]

https://gov.carngr.sbs/
.sbs TLD seems to be used as well

[ExtRIELICi]

@stephenhawk8054 More domains like these have been found, using different TLDs. Could you please update the regex to include these TLDs as well, so they can be blocked effectively?

GitHub issue with more info about the issue

domains.txt file, containing 751 NRDs, which are potentially, and in my opinion almost certainly, affiliated with this particular scam.

Official warning by the General Secretariat of Public Revenue of Greece (ΑΑΔΕ) regarding this scam