Convert homepage to Express EJS

views/pages/post-parking-phishing-campaign.ejs

@@ -0,0 +1,83 @@
+<%- include('../partials/head') %>
+    <article id="post" class="section article-page" data-reveal>
+      <a class="backlink" href="/blog.html">← all writeups</a>
+
+      <header class="article-head">
+        <div class="post-meta">
+          <span class="now-mark shipping">case closed</span>
+          <span class="post-date">security research</span>
+        </div>
+        <h1>destroying a live parking phishing campaign</h1>
+        <p class="article-lede">
+          q-park.web.id was a live phishing site impersonating Q-Park Denmark. it was discovered
+          from a parking-fine SMS sent to someone close to alex, then traced, reported, monitored,
+          and eventually taken down.
+        </p>
+      </header>
+
+      <div class="article-body">
+        <p>
+          the first signal was not a scanner or a threat feed. it was an SMS. someone close to alex
+          received a message claiming there was a parking fine and pointing them at
+          <a href="https://q-park.web.id" rel="nofollow noopener">q-park.web.id</a>. that domain
+          was pretending to be related to Q-Park, a real parking operator, and it leaned on the same
+          boring urgency that makes parking-fine phishing work: you owe a small amount, pay now,
+          don't think too hard.
+        </p>
+
+        <h2>the lure</h2>
+        <p>
+          the page started by asking the visitor to enter a license plate. after that, it showed a
+          supposed outstanding parking payment of 17 DKK. the amount was small enough to feel
+          plausible and annoying enough that a tired person might just pay it to make the message go
+          away.
+        </p>
+        <p>
+          the license plate lookup was fake. there was no meaningful validation. you could enter a
+          real Danish plate, but you could also enter <code>1111</code>, random letters, or basically
+          anything, and the site would still claim there was a 17 DKK charge waiting. that was the
+          first obvious tell: it was not checking a real parking database. it was just a funnel.
+        </p>
+
+        <h2>what the funnel wanted</h2>
+        <p>
+          after the fake plate step, the site moved toward payment-card collection. the interface was
+          built to look like a normal small parking payment, but the goal was credential and card data
+          theft. i kept the public writeup away from reusable implementation details, but the private
+          evidence bundle included the landing page, headers, scripts, hashes, screenshots, DNS,
+          hosting information, registrar path, and collection behavior.
+        </p>
+
+        <h2>what i did</h2>
+        <p>
+          i mapped the infrastructure behind the domain, identified where the site was hosted, checked
+          the registrar and nameserver path, and captured enough evidence that abuse teams would not
+          have to ask for another round of proof. the reporting went to the infrastructure provider,
+          registrar-side abuse channel, browser protection channels, and the impersonated brand.
+        </p>
+        <p>
+          while the reports moved through the system, i monitored the site for state changes. when it
+          stayed down, the monitors were retired instead of being left around wasting memory. the point
+          was to end the campaign, not build a shrine to it.
+        </p>
+
+        <h2>result</h2>
+        <ul class="post-points">
+          <li>confirmed q-park.web.id was impersonating Q-Park Denmark</li>
+          <li>documented the SMS-to-site flow and fake 17 DKK parking-fine lure</li>
+          <li>verified the license plate field accepted bogus values like 1111</li>
+          <li>captured technical evidence: page, headers, scripts, hashes, screenshots, DNS, host, and registrar path</li>
+          <li>submitted reports to the parties able to take action</li>
+          <li>monitored the campaign until it stayed down, then retired the monitors</li>
+        </ul>
+
+        <h2>lesson</h2>
+        <p>
+          the useful lesson is that small-payment phishing is optimized for boredom. 17 DKK is not a
+          scary number. that's why it works. the victim is not supposed to investigate; they're
+          supposed to sigh, type their plate, and pay. good takedown work counters that with boring
+          evidence: exact domain, exact flow, exact infrastructure, exact proof.
+        </p>
+      </div>
+    </article>
+<%- include('../partials/end') %>