+

+ the first signal was not a scanner or a threat feed. it was an SMS. someone close to alex + received a message claiming there was a parking fine and pointing them at + q-park.web.id. that domain + was pretending to be related to Q-Park, a real parking operator, and it leaned on the same + boring urgency that makes parking-fine phishing work: you owe a small amount, pay now, + don't think too hard. +

+ +

the lure

+

+ the page started by asking the visitor to enter a license plate. after that, it showed a + supposed outstanding parking payment of 17 DKK. the amount was small enough to feel + plausible and annoying enough that a tired person might just pay it to make the message go + away. +

+

+ the license plate lookup was fake. there was no meaningful validation. you could enter a + real Danish plate, but you could also enter 1111, random letters, or basically + anything, and the site would still claim there was a 17 DKK charge waiting. that was the + first obvious tell: it was not checking a real parking database. it was just a funnel. +

+ +

what the funnel wanted

+

+ after the fake plate step, the site moved toward payment-card collection. the interface was + built to look like a normal small parking payment, but the goal was credential and card data + theft. i kept the public writeup away from reusable implementation details, but the private + evidence bundle included the landing page, headers, scripts, hashes, screenshots, DNS, + hosting information, registrar path, and collection behavior. +

+ +

what i did

+

+ i mapped the infrastructure behind the domain, identified where the site was hosted, checked + the registrar and nameserver path, and captured enough evidence that abuse teams would not + have to ask for another round of proof. the reporting went to the infrastructure provider, + registrar-side abuse channel, browser protection channels, and the impersonated brand. +

+

+ while the reports moved through the system, i monitored the site for state changes. when it + stayed down, the monitors were retired instead of being left around wasting memory. the point + was to end the campaign, not build a shrine to it. +

+ +

result

+
    +
  • confirmed q-park.web.id was impersonating Q-Park Denmark
    • +
  • documented the SMS-to-site flow and fake 17 DKK parking-fine lure
    • +
  • verified the license plate field accepted bogus values like 1111
    • +
  • captured technical evidence: page, headers, scripts, hashes, screenshots, DNS, host, and registrar path
    • +
  • submitted reports to the parties able to take action
    • +
  • monitored the campaign until it stayed down, then retired the monitors
    • +
+ +

lesson

+

+ the useful lesson is that small-payment phishing is optimized for boredom. 17 DKK is not a + scary number. that's why it works. the victim is not supposed to investigate; they're + supposed to sigh, type their plate, and pay. good takedown work counters that with boring + evidence: exact domain, exact flow, exact infrastructure, exact proof. +

+