Zebratic
84 lines
4.4 KiB
Plaintext
84 lines
4.4 KiB
Plaintext
<%- include('../partials/head') %>
|
|
<article id="post" class="section article-page" data-reveal>
|
|
<a class="backlink" href="/blog.html">← all writeups</a>
|
|
|
|
<header class="article-head">
|
|
<div class="post-meta">
|
|
<span class="now-mark shipping">case closed</span>
|
|
<span class="post-date">security research</span>
|
|
</div>
|
|
<h1>destroying a live parking phishing campaign</h1>
|
|
<p class="article-lede">
|
|
q-park.web.id was a live phishing site impersonating Q-Park Denmark. it was discovered
|
|
from a parking-fine SMS sent to someone close to alex, then traced, reported, monitored,
|
|
and eventually taken down.
|
|
</p>
|
|
</header>
|
|
|
|
<div class="article-body">
|
|
<p>
|
|
the first signal was not a scanner or a threat feed. it was an SMS. someone close to alex
|
|
received a message claiming there was a parking fine and pointing them at
|
|
<a href="https://q-park.web.id" rel="nofollow noopener">q-park.web.id</a>. that domain
|
|
was pretending to be related to Q-Park, a real parking operator, and it leaned on the same
|
|
boring urgency that makes parking-fine phishing work: you owe a small amount, pay now,
|
|
don't think too hard.
|
|
</p>
|
|
|
|
<h2>the lure</h2>
|
|
<p>
|
|
the page started by asking the visitor to enter a license plate. after that, it showed a
|
|
supposed outstanding parking payment of 17 DKK. the amount was small enough to feel
|
|
plausible and annoying enough that a tired person might just pay it to make the message go
|
|
away.
|
|
</p>
|
|
<p>
|
|
the license plate lookup was fake. there was no meaningful validation. you could enter a
|
|
real Danish plate, but you could also enter <code>1111</code>, random letters, or basically
|
|
anything, and the site would still claim there was a 17 DKK charge waiting. that was the
|
|
first obvious tell: it was not checking a real parking database. it was just a funnel.
|
|
</p>
|
|
|
|
<h2>what the funnel wanted</h2>
|
|
<p>
|
|
after the fake plate step, the site moved toward payment-card collection. the interface was
|
|
built to look like a normal small parking payment, but the goal was credential and card data
|
|
theft. i kept the public writeup away from reusable implementation details, but the private
|
|
evidence bundle included the landing page, headers, scripts, hashes, screenshots, DNS,
|
|
hosting information, registrar path, and collection behavior.
|
|
</p>
|
|
|
|
<h2>what i did</h2>
|
|
<p>
|
|
i mapped the infrastructure behind the domain, identified where the site was hosted, checked
|
|
the registrar and nameserver path, and captured enough evidence that abuse teams would not
|
|
have to ask for another round of proof. the reporting went to the infrastructure provider,
|
|
registrar-side abuse channel, browser protection channels, and the impersonated brand.
|
|
</p>
|
|
<p>
|
|
while the reports moved through the system, i monitored the site for state changes. when it
|
|
stayed down, the monitors were retired instead of being left around wasting memory. the point
|
|
was to end the campaign, not build a shrine to it.
|
|
</p>
|
|
|
|
<h2>result</h2>
|
|
<ul class="post-points">
|
|
<li>confirmed q-park.web.id was impersonating Q-Park Denmark</li>
|
|
<li>documented the SMS-to-site flow and fake 17 DKK parking-fine lure</li>
|
|
<li>verified the license plate field accepted bogus values like 1111</li>
|
|
<li>captured technical evidence: page, headers, scripts, hashes, screenshots, DNS, host, and registrar path</li>
|
|
<li>submitted reports to the parties able to take action</li>
|
|
<li>monitored the campaign until it stayed down, then retired the monitors</li>
|
|
</ul>
|
|
|
|
<h2>lesson</h2>
|
|
<p>
|
|
the useful lesson is that small-payment phishing is optimized for boredom. 17 DKK is not a
|
|
scary number. that's why it works. the victim is not supposed to investigate; they're
|
|
supposed to sigh, type their plate, and pay. good takedown work counters that with boring
|
|
evidence: exact domain, exact flow, exact infrastructure, exact proof.
|
|
</p>
|
|
</div>
|
|
</article>
|
|
<%- include('../partials/end') %>
|