the first signal was not a scanner or a threat feed. it was an SMS. someone close to alex received a message claiming there was a parking fine and pointing them at q-park.web.id. that domain was pretending to be related to Q-Park, a real parking operator, and it leaned on the same boring urgency that makes parking-fine phishing work: you owe a small amount, pay now, don't think too hard.

the lure

the page started by asking the visitor to enter a license plate. after that, it showed a supposed outstanding parking payment of 17 DKK. the amount was small enough to feel plausible and annoying enough that a tired person might just pay it to make the message go away.

the license plate lookup was fake. there was no meaningful validation. you could enter a real Danish plate, but you could also enter 1111, random letters, or basically anything, and the site would still claim there was a 17 DKK charge waiting. that was the first obvious tell: it was not checking a real parking database. it was just a funnel.

what the funnel wanted

after the fake plate step, the site moved toward payment-card collection. the interface was built to look like a normal small parking payment, but the goal was credential and card data theft. i kept the public writeup away from reusable implementation details, but the private evidence bundle included the landing page, headers, scripts, hashes, screenshots, DNS, hosting information, registrar path, and collection behavior.

what i did

i mapped the infrastructure behind the domain, identified where the site was hosted, checked the registrar and nameserver path, and captured enough evidence that abuse teams would not have to ask for another round of proof. the reporting went to the infrastructure provider, registrar-side abuse channel, browser protection channels, and the impersonated brand.

while the reports moved through the system, i monitored the site for state changes. when it stayed down, the monitors were retired instead of being left around wasting memory. the point was to end the campaign, not build a shrine to it.

result

lesson

the useful lesson is that small-payment phishing is optimized for boredom. 17 DKK is not a scary number. that's why it works. the victim is not supposed to investigate; they're supposed to sigh, type their plate, and pay. good takedown work counters that with boring evidence: exact domain, exact flow, exact infrastructure, exact proof.