Listen to this Post
Introduction:
A sophisticated phishing campaign is specifically targeting tradesmen through a fake job recruitment website designed to harvest sensitive personal and financial information. This attack leverages a professional-looking facade on a Cloudflare-hosted `.dev` domain to appear legitimate, exploiting a potential blind spot in abuse reporting. Understanding the technical indicators of such scams is crucial for both individuals and security professionals to prevent data theft.
Learning Objectives:
- Identify the key red flags of a phishing website, including domain registration anomalies and SSL certificate details.
- Utilize open-source intelligence (OSINT) tools to investigate and verify the legitimacy of suspicious domains.
- Implement protective DNS configurations and browser security settings to block access to known malicious sites.
You Should Know:
1. Domain Investigation with WHOIS
Verifying domain registration details is a first step in identifying potential scams. Legitimate companies typically have well-established domains, while phishing sites are often recently created with minimal information.
whois tradesmenportal.pages.dev
Step-by-step guide:
This command queries the WHOIS database for the domain’s registration record. Run this in a terminal. You will likely find that the domain was created very recently (a strong indicator of a scam), the registrar is “Cloudflare, Inc.”, and the registrant’s contact information is hidden or generic. The use of a `.pages.dev` subdomain is also a common tactic for attackers using free or low-cost hosting services to appear credible quickly.
2. SSL Certificate Analysis
Phishing sites often use SSL certificates to appear secure (showing the padlock icon in browsers). However, analyzing the certificate can reveal inconsistencies.
openssl s_client -connect tradesmenportal.pages.dev:443 -servername tradesmenportal.pages.dev < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
Step-by-step guide:
This command initiates a connection to the server and fetches its SSL certificate. The output will show the certificate’s `subject` (who it was issued to), the `issuer` (the Certificate Authority that issued it), and the `validity` dates. For a scam site, the subject may not match the expected company name, and the certificate is likely a free, domain-validated one (e.g., from “Let’s Encrypt” or “Cloudflare Inc ECC CA-3”), which is trivial for attackers to obtain.
3. Hostile Domain Blocking via DNS
Protecting entire networks or systems can be achieved by configuring DNS to block known malicious domains.
For a Pi-hole or similar DNS sinkhole, add the domain to the blacklist sudo pihole -b tradesmenportal.pages.dev Alternatively, on a Windows machine, modify the hosts file to block it Run Notepad as Administrator, open C:\Windows\System32\drivers\etc\hosts, and add: 0.0.0.0 tradesmenportal.pages.dev
Step-by-step guide:
The first command adds the malicious domain to a Pi-hole’s blacklist, preventing any device using that DNS server from resolving the domain. The second method involves editing the local `hosts` file on a Windows PC, redirecting the domain to a non-routable address (0.0.0.0), effectively blocking access from that single machine.
4. Browser-Based Security with HSTS Preloading
Forcing HTTPS and preventing downgrade attacks can be enforced at the browser level for added security.
Example of a strict HTTP Strict Transport Security (HSTS) header sent by a web server Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Step-by-step guide:
While this is a server header, users can preload HSTS for major sites in their browser. In Chrome/Edge, go to chrome://net-internals/hsts. In the “Add domain” section, enter `pages.dev` and select “Include subdomains for STS” and click “Add”. This tells your browser to only use HTTPS for `pages.dev` and all its subdomains, mitigating some SSL-stripping attacks. Note: This is an advanced setting.
5. Network Traffic Analysis with Curl
You can probe a suspicious website without loading it in a browser to examine its initial response headers, which can reveal clues about its hosting infrastructure.
curl -I -L --max-redirs 3 "https://tradesmenportal.pages.dev"
Step-by-step guide:
This command sends a HEAD request (-I) to the URL and follows redirects (-L), limiting them to 3 hops (--max-redirs 3). Examine the output headers. Look for `Server:` (e.g., cloudflare), X-Powered-By:, or `Set-Cookie:` headers. While not definitive proof of malice, headers inconsistent with a professional job portal (e.g., default server banners) can be a red flag.
6. Automated Scam Detection with URLScan.io
URLScan.io is a free service that analyzes websites and provides a detailed report on their behavior, connections, and reputation.
While there isn't a direct command-line tool, you can use the API via curl:
curl -X POST "https://urlscan.io/api/v1/scan/" -H "Content-Type: application/json" -d '{"url": "https://tradesmenportal.pages.dev", "public": "on"}'
Step-by-step guide:
This command submits the suspicious URL to URLScan.io for analysis. The response will contain a UUID. You can then view the results by visiting `https://urlscan.io/result/
7. Phishing Kit Detection on the Server Side
If you have access to a compromised server, you can search for common phishing kit filenames and structures.
Linux commands to find common phishing kit components
find /var/www/html -name ".php" -exec grep -l "mail()" {} \; Find PHP files using the mail function
find /var/www/html -name "login.php" -o -name "admin.php" Find common phishing page names
ls -la /var/www/html/ Check for recently modified files or suspicious directories
Step-by-step guide:
These commands help identify potential phishing kits uploaded to a web server. The first command searches PHP files for the `mail()` function, often used to exfiltrate stolen data. The second looks for common phishing script filenames. The third lists all files in the web root with details; look for files with recent timestamps or unusual names. This is critical for webmasters to clean up compromised sites.
What Undercode Say:
- The .dev Discrepancy: The use of a Cloudflare `.dev` domain is a double-edged sword. It provides an aura of legitimacy due to Cloudflare’s reputation and the HTTPS requirement for `.dev` domains, but as highlighted in the Excedo Networks comment, it also points to a potential enforcement gap. Attackers exploit the scale of such platforms, knowing that takedown requests may be slow, allowing their campaigns to run longer.
- Social Engineering Precision: This campaign is not a broad, generic phishing attempt. It demonstrates targeted social engineering by focusing on a specific profession (tradesmen) who may be actively seeking work and potentially less suspicious of job-related communications. The request for bank name information is a critical escalation beyond typical credential harvesting, setting the stage for highly personalized follow-up fraud.
The technical execution is simple but effective. The scam relies entirely on social engineering rather than complex malware or exploits. The primary defense lies in user education and proactive verification. For security teams, this incident underscores the need for robust OSINT capabilities and the importance of understanding the abuse policies of major infrastructure providers like Cloudflare to expedite takedowns when necessary.
Prediction:
This targeted phishing approach will become more prevalent. We predict a rise in “vertical phishing”—highly tailored scams aimed at specific industries, professions, or even companies. Attackers will continue to leverage reputable infrastructure services (like Cloudflare, GitHub Pages, Netlify) to host their campaigns, forcing a cat-and-mouse game between security researchers and abuse departments. Furthermore, the initial data harvest (name, phone, bank name) will be used to fuel more convincing AI-powered vishing (voice phishing) and smishing (SMS phishing) attacks, where the scammer already has context about the victim, making the fraud significantly more persuasive and dangerous.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Nguyen Nguyen – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
