Antiphishing.biz – Proactive phishing detection for cybersecurity and network protection

The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards

A new phishing campaign is specifically targeting sellers on Discogs, the popular music marketplace and database. Attackers have constructed a multi‑page deception that begins with a fake human verification check and ends with a cloned Stripe payment form. The screenshots provided document this attack in detail. Understanding each step of the scam is the only way to avoid becoming a victim.

The Three‑Stage Deception

The scam uses a carefully choreographed sequence of web pages, each designed to lower suspicion and increase urgency.

Stage 1 – The Fake CAPTCHA

Threat Intel: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the dangerous destination URL has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform. — Figure 1: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

The victim lands on a page that displays “Just a moment…” and a small widget that says “Verify You’re Human” with a checkbox labelled “I’m Not a Robot”. The page is branded with “Powered by XCaptcha · Secure & Private”. In reality, XCaptcha is not a legitimate CAPTCHA provider. This is a classic trick: the attacker creates a fake bot check to make the user believe the site is security‑conscious. Clicking the checkbox does not perform any real verification. Instead, it either triggers the next page or simply records that the user is willing to interact with the fraudulent interface.

Stage 2 – The Discogs‑Branded Notice

Actual screenshot 2 of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform. — Figure 2: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

After passing the fake CAPTCHA, the user sees a page styled to resemble an official Discogs notification. The header reads “Discogs > Account Settings & Access > Verification”. The message states: “Welcome to Discogs! To continue selling on our platform, you need to complete the verification process. This step ensures the security of our community.”

A fake support chat window is embedded on the same page. The chat text explains: “You will need to enter your card details to verify it and, subsequently, receive payment from your customer.” It reassures the user that “all your personal data is protected by our security department and remains confidential” and that “customer service operators are always online to help you.”

A large button labelled “Proceed to Verification” leads to the final stage.

Stage 3 – The Cloned Stripe Payment Form

Actual screenshot 3 of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform. — Figure 3: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

The third page is a near‑perfect imitation of a Stripe payment interface. The domain shown in the URL bar is discogs.page25479.lat/merchant/order/DaFsEh. The page displays the Stripe logo and a form requesting:

Card number (with a placeholder 1234 1234 1234 1234)
Month and year of expiry
CVV code (labelled “CV” on the screenshot)
Cardholder name (“Full name on card”)

A “Verify” button completes the action.

Why This Scam Is Particularly Dangerous for Discogs Sellers

Discogs is a platform where independent sellers list vinyl records, CDs, and music memorabilia. Many sellers are private individuals who do not have formal business training in cybersecurity. They are often motivated by the desire to sell a few items from their personal collection. This profile makes them ideal targets: they expect to provide payment information to receive money from buyers, and they may not immediately recognise that a request for card details is the opposite of what a legitimate selling platform would require.

The scam exploits a fundamental confusion between “verifying identity” and “providing payment credentials”. No legitimate marketplace asks a seller to enter their own credit card number as a way to verify their seller account or to receive payments. Payments from buyers are deposited into a seller’s linked bank account or PayPal account – not drawn from the seller’s card.

The presence of the fake support chat adds a dangerous layer of psychological manipulation. The chat creates an illusion of live, human assistance. A worried seller might be tempted to ask questions, and the automated responses (or a real criminal on the other end) would reinforce the legitimacy of the request. The phrase “customer service operators are always online to help you” is designed to prevent the victim from seeking help elsewhere.

Expert Analysis: Technical and Behavioural Red Flags

Cybersecurity professionals who have examined similar phishing kits identify several consistent patterns. This campaign exhibits all of them.

The URL is the most immediate red flag. The page is hosted on discogs.page25479.lat. The domain page25479.lat has no connection to Discogs. The real Discogs website uses discogs.com. Attackers register cheap, often free subdomains on obscure top‑level domains (.lat, .top, .xyz, etc.) to mimic legitimate addresses. Any URL that contains the platform’s name but is followed by a random string or an unfamiliar TLD should be treated as hostile.

The CAPTCHA page serves no technical purpose. Real CAPTCHAs (such as Google’s reCAPTCHA) are used to block automated bots from accessing forms or content. They are never used as a gateway to a subsequent page that then asks for payment card information. If a site shows you a “Verify You’re Human” widget and then immediately presents a financial form, you are looking at a phishing page.

The fake support chat is a behavioural exploit. Research into online fraud shows that users are more likely to comply with a request when they believe they have a safety net – someone to ask for help. The chat window creates that false safety net. In reality, the “operator” is either a script or a criminal whose only goal is to keep you on the page until you submit your data.

The Stripe form is a direct copy of a legitimate payment interface, but with a critical omission: there is no transaction context. A real Stripe payment form appears when you are actively purchasing something, and it shows the merchant name and the amount to be charged. This form shows neither. It asks for your card “to verify it and, subsequently, receive payment” – a nonsensical statement. Receiving money requires you to provide bank account or PayPal details, not your credit card number.

The Financial Impact: What Happens After You Submit

If a seller enters their card information into this form, the data is sent directly to the attacker. Within minutes, the attacker will test the card with a small authorisation (often $0.00 or $1.00) to confirm it is active. Then they will either:

Make high‑value purchases of digital goods that can be resold quickly.
Withdraw cash from ATMs if the card is a debit card and the attacker has cloned it.
Sell the full card details (number, expiry, CVV, cardholder name) on underground markets for others to abuse.

The seller may not notice the fraudulent transactions until days later, by which time the money is gone and the card is compromised.

How to Protect Yourself: Expert Recommendations for Discogs Users

The following advice is based on standard security practices and the specific tactics revealed in this phishing campaign.

Never initiate account actions from links in unsolicited messages. If you receive an email, direct message, or any notification that claims you need to verify your account, do not click embedded links. Open a new browser tab, type discogs.com manually, and log in to your account. Any legitimate verification requirement will be displayed inside your account dashboard or communicated through the platform’s official messaging system.

Understand how Discogs actually handles seller payments. Discogs itself does not process payments directly. Sellers on Discogs typically use PayPal or Stripe as separate payment gateways. To receive money from a buyer, you provide the buyer with your PayPal email address or a Stripe payment link. You are never asked to enter your credit card number into a Discogs page for the purpose of receiving funds. If a page asks for your card to “verify” your seller status, it is a scam.

Look at the browser’s address bar before entering any information. Legitimate Discogs pages always have a URL starting with https://www.discogs.com/ or https://discogs.com/. If you see a domain like discogs.something.lat or discogs-verify.xyz, close the tab immediately.

Do not trust on‑page chat windows that appear in unsolicited verification flows. Real customer support chats are accessible only after you log into your account and navigate to the help section. A chat that appears unbidden on a verification page is a manipulation tool.

Enable two‑factor authentication on your Discogs account. This will not prevent a phishing page from stealing your card, but it will prevent an attacker from taking over your Discogs account even if they later obtain your password through another method. Use an authenticator app (Google Authenticator, Authy) rather than SMS when possible.

Use virtual or single‑use card numbers for online transactions. Many banks and services (such as Privacy.com, Revolut, or Citi’s Virtual Account Numbers) allow you to generate a temporary card number linked to a spending limit. If you ever encounter a suspicious verification request, using a virtual card with a $1 limit would reveal the scam immediately: the charge would be rejected or you would see an unauthorised attempt.

Monitor your card transactions daily. Set up SMS or push notifications for every transaction. The sooner you spot a fraudulent charge, the faster you can report it to your bank and limit your liability.

What to Do If You Have Already Entered Your Card Details

If you recognise that you have submitted your payment information to a page similar to the one described, act immediately.

Contact your bank or card issuer using the phone number on the back of your card. Do not use any contact information found on the suspicious page. Request that the card be blocked and replaced. Ask the bank to review recent transactions for unauthorised activity.

File a report with your local police. In many jurisdictions, online fraud is a criminal offence. A police report may help you dispute fraudulent charges with your bank.

Change your Discogs password. Even if the phishing page did not explicitly ask for your password, the attacker may have captured it if you used the same device or if the page was part of a wider compromise. Use a strong, unique password.

Report the phishing URL to Discogs. Send an email to their support team with the full URL and screenshots. This helps the platform take down the fraudulent site and warn other users.

Final Words

Phishing attacks that target platform sellers are becoming more sophisticated. They no longer rely on obvious spelling mistakes or generic greetings. They clone the look and feel of legitimate services, add fake CAPTCHAs to create an illusion of security, and embed simulated support chats to disarm critical thinking.

The single most effective defence is a simple rule: never enter your credit card details on a page that claims to be verifying your identity or unlocking your seller status. Real verification uses passwords, two‑factor codes, or identity documents – not payment instruments.

Share this analysis with anyone who sells on Discogs. The more sellers understand these tactics, the harder it becomes for attackers to profit.

How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users

A growing number of cybercriminals are creating fake account verification pages designed to steal financial data from users of shared accommodation platforms such as Flatmates.com.au, flatmate.com, and similar services. The scam begins with an urgent message claiming a user’s account has been restricted and requires identity verification within a strict time limit. The message is designed to create panic. The victim is then directed to a fraudulent web page that mimics a legitimate verification portal.

The attacker’s goal is simple: trick users into entering credit card details, bank account information, or other sensitive data. Once the information is submitted, criminals can drain bank accounts or use the stolen data to commit identity fraud.

Understanding how this scam operates and knowing exactly what to look for is the difference between keeping your money and losing it.

The Anatomy of the Attack: What the Screenshots Reveal

The phishing kit used in this campaign consists of several distinct but interconnected pages, each designed to lower the victim’s defences step by step.

Phase 1: The Urgent Account Restriction Notice

The first screen presents itself as an official notification from the platform. It reads: “Your account is temporarily restricted. You need to verify your identity to remove all the restrictions. You need to confirm your bank details within 24 hours.” The message includes a “Status: Verification required” field and a prominent “Verify” button.

Security Notice: This spoofed page was logged, cross-checked, and neutralized firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users" phishing interface captured during link moderation on our platform. — Figure 1: Live screenshot of the active phishing operation captured during routine moderation.

This approach directly mimics the urgent account verification scams that cybersecurity researchers have documented across multiple industries. As noted in analyses of such attacks, these fake messages claim an account needs checking due to strange activity or security measures and warn that if verification is not completed, the service might stop working. The entire structure is designed to create panic and bypass rational thought.

Phase 2: The Fake Payment Information Form

After clicking the verification link, the victim is directed to a second page that appears to be a bank card addition form. The page displays logos for VISA, American Express, Discover, PayPal, Apple Pay, and Google Pay in an attempt to appear trustworthy and legitimate.

Actual screenshot 2 of "How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users" phishing interface captured during link moderation on our platform. — Figure 2: Live screenshot of the active phishing operation captured during routine moderation.

The form itself explicitly requests the following data:

Full card number (with a placeholder reading “Kaartnummer” meaning “Card number”)
Expiry date (MM/JJ representing month/year)
CVV code (placed directly next to the expiry field with the label “123”)
Cardholder name (“Naam op de kaart”)

The page concludes with a “VERZENDEN” (Send/Submit) button and claims that all operations comply with PCI DSS (Payment Card Industry Data Security Standard). The PCI DSS logo is a fraudulent addition included solely to give the page an air of legitimacy. No legitimate service would request a full card number, expiry date, CVV, and cardholder name together in a single unsecured form. Genuine platforms use tokenised payment systems where this sensitive data never touches their own servers.

The Expert Analysis: Why This Scam Is Particularly Dangerous

From a technical and psychological perspective, this phishing operation demonstrates a high level of sophistication in its design and execution. Several factors make it especially threatening to users who may not be technically sophisticated.

The use of an artificial 24-hour deadline is a classic social engineering tactic. When a user believes an account is at risk of being permanently restricted or losing access to funds, the urgency overrides critical thinking. Criminals exploit this vulnerability systematically.

Including payment method logos on the page builds false credibility. The presence of well-known brand marks such as VISA, PayPal, and Google Pay subconsciously signals to the user that the page is secure and authenticated. In reality, these logos can be copied by anyone from publicly available sources.

The explicit request for a CVV code alongside the card number is a critical red flag. CVV codes are explicitly designed to verify that the cardholder is physically in possession of the card during a transaction. While some legitimate recurring payment setups may request a CVV for initial authorisation, they do so in an isolated, one-time context and never as part of a standalone identity verification form. Any service that requests CVV together with the full card number and expiry date in a single form intended for “verification” is almost certainly fraudulent.

Key Red Flags: A Checklist for Users

To help users identify this and similar scams in the future, security experts have compiled a set of actionable indicators. Any page exhibiting the following characteristics should be treated as an immediate threat:

Urgency language and time limits: If a page threatens account restriction or service termination unless verification is completed within a specified time window, it is almost certainly a phishing attempt. Authentic platforms rarely use such tactics and would instead direct users to complete verification through their official app or website.

Requests for payment card information as identity verification: No legitimate accommodation or service platform uses a payment card as a means of identity verification. Identity verification involves government-issued identification, two-factor authentication codes sent to registered email or phone numbers, or biometric authentication. Entering card details into a page that claims to verify identity is equivalent to handing a stranger the keys to your bank account.

Poor grammar, inconsistent language, or mixed languages on the same page: The screenshot shows a mix of English (“Verification”) and Dutch (“Bankkaart toevoegen,” “Kaartnummer,” “Verzenden”). While some legitimate services operate in multiple languages, phishing pages frequently mix languages because they are copied from translated templates that were never properly localised.

Absence of specific platform branding or logos: The screenshots reference the platform name only in the URL and the initial restriction message. The verification pages themselves omit the platform’s official logo, colour scheme, or footer information. Legitimate verification processes are fully integrated into the platform’s branded interface.

PCI DSS compliance claim without visible SSL certificate or security verification: Displaying a logo that claims PCI DSS compliance does not make a page secure. True compliance involves a range of backend security measures. Without an active, verified SSL certificate and transparent data protection policies, the claim is meaningless.

Request for CVV in a standalone verification form: As noted previously, this is the most specific and damning indicator of a phishing page.

Expert Advice: What to Do If You Encounter This Scam

Security professionals and accommodation platforms have issued consistent guidance for handling such threats.

Never click verification links in unsolicited messages. If you receive an email, text message, or social media direct message claiming your account is restricted and requiring immediate action, do not click any links contained within the message.

Navigate directly to the platform. Instead of clicking any link, open a new browser tab and manually type the official domain of the accommodation platform you use. If you are a user of Flatmates.com.au, type “flatmates.com.au” directly into the address bar. Navigate to your account dashboard. Any legitimate verification requirement will be displayed there. If no such notice appears, the original message was a fraud.

Contact support through official channels. If you are unsure whether a message is legitimate, contact the platform’s support team directly using the contact information listed on the official website. Do not use the contact details provided in the suspicious message itself.

Enable two-factor authentication (2FA) on all accounts. Two-factor authentication adds a critical layer of security by requiring a code from your phone or an authenticator app in addition to your password. This prevents attackers from accessing your account even if they steal your login credentials.

Monitor your financial accounts. If you have already entered card details into a suspicious page, contact your bank or card issuer immediately. Request a new card number and review recent transactions for unauthorised charges.

The Broader Implications: Why Accommodation Platforms Are Targeted

The increasing targeting of shared accommodation platforms by cybercriminals reflects a broader trend in how phishing attacks are distributed. As noted in fraud prevention literature, flatmate scams operate by creating fake profiles to gather personal information such as email addresses, phone numbers, and even financial details. The shift toward standalone phishing pages that appear to originate directly from the platform itself represents an escalation of the threat.

Unlike rental listing scams that rely on fake properties or overpayment schemes, this approach directly requests the financial data that enables large-scale account theft. By compromising a single user’s payment card, attackers can not only drain that user’s account but also use the stolen credentials to register on other services, conduct fraudulent transactions, or sell the information on dark web marketplaces.

The platforms themselves have taken steps to combat this threat. Official guidance from Flatmates.com.au advises users to be wary of potential phishing sites by checking the URL prior to logging in or providing information. The platform states, “We only use the domain flatmates.com.au” and directs users to safety resources for step-by-step instructions on how to protect themselves. However, platform security measures are only effective when users actively recognise and avoid fraudulent pages.

Final Recommendations

Every user of shared accommodation platforms should adopt the following practices as a matter of routine:

Maintain a single consistent process for all account-related actions. When any notification claims action is required, pause. Open the official application or website manually. Do not trust links in messages. Do not trust QR codes. Do not trust phone numbers provided in the body of emails.

Regularly review your account activity. Check for unfamiliar login locations, unrecognised linked payment methods, or changes to your profile details. Report any suspicious activity to the platform immediately.

Stay informed about current phishing techniques. Scammers adapt their tactics rapidly. Following cybersecurity resources and platform-specific safety guides helps maintain awareness of evolving threats.

Remember that account verification and identity confirmation on legitimate platforms happens through the platform’s own secure interface, typically within the application or website you originally signed up for. No legitimate service will ask for your full payment card details through a standalone web page reached by clicking an external link.

If you believe you have already provided payment information to a fraudulent page, contact your financial institution without delay. Time is critical. The longer stolen card data remains active, the greater the potential for financial loss.

11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)

By Cybersecurity Analyst Team
May 2026

If you sell clothes, electronics, or collectibles on Poshmark, Mercari, eBay, or Depop, you are a prime target for a new wave of sophisticated phishing attacks. The screenshots below show a real-time scam that attempts to drain your bank account – not by hacking, but by tricking you into handing over your payment credentials.

We analyzed a live phishing page that perfectly mimics Poshmark’s verification flow. Here’s how it works, the 12 warning signs you need to memorize, and expert advice to keep your hard-earned money safe.

How the Scam Unfolds (Based on Real Screenshots)

Step 1 – The fake urgency timer
The victim lands on a page that looks like Poshmark’s support interface. A countdown timer (23:58:35) creates panic: “You have 24 hours to complete verification. After this time, your order will be automatic.”

Incident Report: This spoofed page was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the dangerous destination URL has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)" phishing interface captured during link moderation on our platform. — Figure 1: Visual proof of the ongoing fraudulent campaign intercepted by our security systems.

Step 2 – Fake live chat “operator”
A chat window shows a friendly “Operator” saying: “Good news – you’re almost done. Just one final step left to complete the process.” This mimics real customer support to lower your guard.

Step 3 – Redirect to “secure verification”
Clicking the “Verify Account” button leads to a second page – a near-perfect clone of a Stripe bank verification form, asking for:

Full card number (with placeholder 1234 1234 1234 1234)
Expiry date (MM/YY)
Cardholder name
Billing address (street, city)

Actual screenshot 2 of "11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)" phishing interface captured during link moderation on our platform. — Figure 2: Visual proof of the ongoing fraudulent campaign intercepted by our security systems.

Step 4 – Theft
Once you submit, the data goes directly to attackers. They will drain your card within minutes – often using small test transactions first, then larger purchases or cash withdrawals.

11 Red Flags That Give Away the Phishing Attack

#	Red Flag	What You See (from screenshots)
1	Artificial time pressure	“Verification Time Limit” with a 23‑hour countdown – real platforms never lock orders behind a timer.
2	In‑page “support chat” that feels scripted	The operator repeats generic phrases like “Scroll down” and “Good news — you’re almost done” – no real interaction.
3	Verification requires payment card data	No legitimate marketplace asks for your credit card number to verify your identity. They use email, SMS, or 2FA.
4	Fake Stripe branding	The page says “Securely connect to your bank account through the Stripe system” – but Stripe never embeds full card entry forms this way without an official redirect.
5	The URL is not the real marketplace domain	(Not visible in screenshots but crucial) – attackers use domains like `poshmark-verify.xyz` or random subdomains. Always check the address bar.
6	No way to log into your real account	The fake page has no “sign in” link to your existing Poshmark profile. It’s a standalone form.
7	Poor grammar and capitalization	Example: “Your order will be automatic.” (missing “cancelled” or “processed”) and inconsistent spacing.
8	The “company” footer doesn’t link to real pages	Footer shows “About”, “Our Community”, “Blog” but links are dead or point to `#`. Real marketplaces have live, functional footers.
9	Transaction ID & contact data mismatch	The scam shows a fake Transaction ID and dummy contact data (`[email protected]`, `(201) 555-0123`) – these are placeholders, not your real info.
10	No ability to skip or cancel verification	Real platforms let you decline verification or complete it later via official app. The fake page forces you forward.
11	Request for billing address + card + name + expiry – all on one page	That’s the full magnetic stripe data. No legitimate service needs the entire set just to verify your account.

Expert Advice: How Sellers Can Keep Their Money Safe

Do this immediately

Never enter card details for “identity verification” – on any platform. Use the official app’s built-in payment methods only.
Open a separate browser tab – manually type poshmark.com (or your platform’s real URL) and log in. If there is a real verification pending, it will show there. If not, the page is a scam.
Enable two-factor authentication (2FA) on your selling account and your email. This prevents attackers from resetting your password even if they steal your login.
Use a virtual credit card or payment service – for any online selling, use privacy.com, Revolut virtual cards, or Apple Pay with dynamic security codes. Never expose your main debit card.

If you already entered your card details

Call your bank immediately – tell them your card details were compromised. Request a block and a new card.
Check your recent transactions – look for $0.00 authorizations, $1.00 test charges, or any small amounts. Report them as fraud.
Change your marketplace password – even if you didn’t enter it, the attacker may try to reuse your email/password combination.

Share this warning with other sellers

Many sellers are targeted via fake “buyer messages” that say “I tried to buy your item but you need to verify your account” – always ignore and report such messages.

Final thought

Phishing has evolved. It no longer looks like a poorly written email from a Nigerian prince. It looks like Poshmark’s chat support. It looks like Stripe. It uses real brand logos and psychological pressure (timers, operators, security badges).

The only thing that protects you is a habit: stop, check the URL, and never type your card into a page you did not reach by typing the official domain yourself.

If you found this article helpful, share it with every marketplace seller you know. Together we can make these scams unprofitable.

Have you spotted a similar phishing attempt? Report the URL to [email protected]

Operation Syndicate: Multi-Language Live Chat Exploitation via Rogue Gambling Portals

Security Notice: This deceptive layout was logged, cross-checked, and neutralized firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the phishing source domain has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

This entry documents a live, multi-jurisdictional cybercrime node operating via ephemeral ASPX chat frameworks (7mmon3ss.com). The intercept reveals a highly structured customer service gateway utilized by Southeast Asian syndicates to manage illicit gambling platforms and fraudulent asset-extraction schemes under the brand RM98.

Technical Dissection of the Compromised Session

The captured interface provides absolute forensic verification of human-in-the-loop (HITL) fraud operations orchestrated through decentralized architecture:

Sovereign Telemetry and Targeting: The core user-facing copy is written natively in Burmese, confirming a localized financial targeting campaign within the Myanmar demographic. The infrastructure baits victims with synthetic daily login credits (94,000 Ks) and multi-level referral incentives (50,000 Ks) to enforce high engagement and manipulate user retention.
Underlying Chinese Administrative Infrastructure: While the operator engages the victim in Burmese, the automated platform system logs—including queue entry, inactivity warnings, and session termination alerts—are rendered in simplified Chinese text (“访客已离开聊天”). This provides technical confirmation that the web-chat routing engine is managed via turn-key software infrastructure provided by Chinese-speaking threat syndicates operating across regional border enclaves.
Cross-Platform Funnel Escalation: The session log exposes the direct deployment of secondary persistence channels. The rogue operative explicitly directs the victim to exit the browser framework and join a secure, unmonitored Telegram distribution node via a unique invitation hash (+kXaoayooYxY0MjI9). This maneuver ensures communication persistence if the primary short-lived domain is terminated by edge security filters.

Defensive Infrastructure Mandate

Shortener architectures encountering automated chat-routing endpoints must deploy cascade verification triggers. When a domain displays high-risk DGA structural patterns, masks server location via regional proxies, and serves multi-language onboarding paths designed to transition web assets into private encrypted networks, it represents a verified core operations vector. The root entity must be completely neutralized across all network edge blocks.

Interactive Investment Phishing: Exploitation of Live Shareholder Registries

Threat Intel: This deceptive layout was intercepted, verified, and locked down firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the dangerous destination URL has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

This image captures an active, highly targeted corporate asset hijacking portal hosted via developer cloud infrastructure (myrights-app-8hkj4.ondigitalocean.app). The interface demonstrates a sophisticated evolution in credential harvesting, utilizing a live, interactive database to verify victim telemetry in real time rather than deploying static phishing layouts.

Actual screenshot 2 of "Interactive Investment Phishing: Exploitation of Live Shareholder Registries" phishing interface captured during link moderation on our platform. — Figure 2: Actual screenshot of the active phishing operation isolated on our infrastructure.

Infrastructure and Dynamic Exploitation Analysis

The fraudulent portal directly impersonates the identity of Meristem Registrars, an established stock registrar entity. The technical execution of this data harvesting operation functions through several critical components displayed in the compromised panel:

Live Database Infiltration and Search Queries: The interface features a functional, dynamic search module allowing users to query records by Name, RAN (Registrar Account Number), Email, Phone, or CHN. A live query for the term “john” demonstrates the processing of an active database containing at least 276 authentic records of high-value corporate shareholders.
Psychological Validation Mechanisms: The display of actual shareholder names alongside genuine assigned RAN identifiers (e.g., 3842, 11730) creates immense cognitive trust for the target. To reinforce the illusion of a secure, compliant banking system, the architecture strategically masks partial phone numbers and email addresses, mimicking official corporate data protection standards.
The Call-to-Action Theft Vector: The interactive elements labeled “Download” and “Subscribe” serve as the direct monetization nodes. Once a victim identifies their name in the registry and initiates interaction, the platform prompts the user to input unmasked clearing house numbers, multi-factor authentication tokens, and direct bank routing codes to fraudulently redirect dividends and equity ownership parameters.

Actual screenshot 3 of "Interactive Investment Phishing: Exploitation of Live Shareholder Registries" phishing interface captured during link moderation on our platform. — Figure 3: Actual screenshot of the active phishing operation isolated on our infrastructure.

Strategic Mitigation Protocols

This instance demonstrates that modern phishing campaigns leverage robust backend databases to execute highly localized corporate fraud. Web routing engines must implement immediate, absolute pattern blocking on the exact sub-domain string. The presence of dynamic lookup tables targeting sovereign financial registries on completely unverified SaaS application instances constitutes a definitive sign of active cyber-financial warfare and requires systematic blacklisting across all secure edge proxies.

Advanced Fiat Drainer: Automated Brand Impersonation on Peer-to-Peer Marketplaces

This entry documents a live, multi-stage financial phishing and asset draining operation hosted on transient infrastructure (chilw-order.lat). The interface targets regional consumers of major Japanese classifieds and peer-to-peer marketplaces, specifically cloning the infrastructure of Jimoty (jmty.jp).

Analysis Memo: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the dangerous destination URL has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Figure 1: Verified screenshot of the live scam infrastructure intercepted by our security systems.

Figure 2: Verified screenshot of the live scam infrastructure intercepted by our security systems.

Figure 3: Verified screenshot of the live scam infrastructure intercepted by our security systems.

The Attack Vectors and Social Engineering Heuristics

The vector utilizes a sophisticated deployment of manufactured account urgency to neutralize user suspicion. The attack relies on three distinct technical phases embedded within a single dynamic web layout:

Manufactured Account Restriction (KYC Baiting): Victims are routed to the page under the false pretext of an urgent security lock. The interface displays an official-looking “Account Restriction Notice,” claiming that compliance with Japan’s Financial Services Agency (FSA) regulations requires immediate verification. It displays pre-completed technical stages (such as email and phone validation) to establish a false baseline of trust.
Balance-Targeted Extraction Mechanics: The core billing script requests not only full primary account numbers (PAN), expiration dates, and card verification values (CVV) but explicitly mandates the submission of the card’s exact current available balance in JPY. This field allows the threat actors to dynamically calibrate their backend merchant API requests to initiate a single-draw transaction optimized to completely drain the victim’s account parameters.
Real-Time 2FA Bypass Framework: The backend system acts as an active reverse-proxy, processing input validation dynamically. It utilizes specific sub-interfaces to capture incoming SMS One-Time Passwords (3D Secure tokens) and instructs the victim to approve secondary mobile banking push notifications. Concurrently, the platform attempts device webcam activation under the guise of biometrical verification to defeat modern banking anti-fraud parameters.

Defensive Matrix Deployment

Due to the localized nature of the script, filters should deploy string-matching regex parameters targeting combinations of specific localized keywords like account restriction alerts combined with standardized unverified payment interfaces. The entity chilw-order.lat shows zero footprints of indexing or corporate legitimacy and should be systematically terminated across all routing proxies.

A phishing campaign targeting Depop sellers

This set of screenshots shows a phishing campaign targeting Depop sellers. The scam uses a fake “orders suspended” notification and a counterfeit support chat to trick victims into providing full credit/debit card details and billing information.

Threat Analysis: Depop Phishing – Fake “Orders Suspended” & Card Harvesting

How the scam works:

Fake Suspension Notice (1st screenshot)
The victim is told that orders in their account are temporarily suspended and they must “verify” their payment details to restore store operations. A “Verify” button leads to the next step.

Security Notice: This scam layout was intercepted, verified, and locked down firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Actual screenshot of "A phishing campaign targeting Depop sellers" phishing interface captured during link moderation on our platform. — Figure 1: Live screenshot of the active phishing operation isolated on our infrastructure.

Fake Support Chat with “Amelia” (2nd screenshot)
A fake live chat window opens with a message from “Amelia” (posing as customer support). The message claims that the victim needs to provide card details for verification, that the process is secure and only done once, and that “Amelia is a real person, not a robot.” This social engineering trick is designed to lower the victim’s guard.

Actual screenshot 2 of "A phishing campaign targeting Depop sellers" phishing interface captured during link moderation on our platform. — Figure 2: Live screenshot of the active phishing operation isolated on our infrastructure.

Card & Billing Details Form (3rd screenshot)
The victim is taken to a page that asks for:

Full card number
Expiration date (MM/JJ, shown as MM/YY)
CVV
Name on the card
Billing address (street, city, postal code) The page displays logos of Visa, American Express, and Discover, and claims “All transactions comply with PCI DSS” – a fake security badge.

Actual screenshot 3 of "A phishing campaign targeting Depop sellers" phishing interface captured during link moderation on our platform. — Figure 3: Live screenshot of the active phishing operation isolated on our infrastructure.

The goal:
The attacker collects:

Full credit/debit card details (number, expiry, CVV)
Cardholder name and billing address
Postal code and city

With this data, the attacker can:

Make fraudulent online purchases
Clone the card or sell the information on criminal markets
Use the personal details for identity theft

Red flags to watch for:

Suspicious URL: The page is hosted on a domain like depop.securedirect.cfd – not the official Depop domain (depop.com). The .cfd TLD is unusual for a legitimate site.
Fake chat support that initiates contact: Real customer support does not automatically send a pre‑scripted message explaining that you need to provide card details.
Request for full card details (including CVV) to “verify” a suspended account: Depop never asks for your card security code to restore account access. Such verification is done through official payment methods within the app, not by entering raw card data on a third‑party page.
Threat of lost orders / store suspension: Creates urgency to pressure the victim.
PCI DSS claim and payment logos: These are copied from legitimate sites to appear trustworthy, but the page itself is a phishing site.
Poor grammar / language inconsistencies: The English is slightly awkward, and the Dutch text appears in some screenshots (the target is likely a mix of English and Dutch speakers, or the template was copied).

What to do if you encounter this:

Do not click “Verify” or enter any card details.
Do not interact with the fake chat.
If you are a Depop seller, always log into your account by typing depop.com directly into your browser. Check your account status and any notifications from the official app.
If you have already entered card details, contact your bank immediately to block the card and dispute any unauthorized charges.
Report the phishing page to Depop’s security team.

Protective measures:

Never click links in unsolicited messages claiming your seller account is suspended.
Always type the official Depop URL directly into your browser or use the official app.
Never trust a pop‑up chat that asks for card details – legitimate support will never request that information.
Enable two‑factor authentication on your Depop account and email.
Check the URL carefully – look for misspellings, extra words, or unusual top‑level domains (.cfd, .top, .xyz).

Tise.com fake page detected

Anatomy of a Marketplace Phishing Scam: The Scamsite Intermediary Method

This image captures a live instance of a highly convincing phishing campaign targeting users of Tise (tise.com), a popular Norwegian and Nordic second-hand marketplace. The layout mimics an official security notification, utilizing precise brand elements to manipulate the victim under a manufactured state of urgency.

Incident Report: This deceptive layout was logged, cross-checked, and neutralized firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the dangerous destination URL has been safely deactivated within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Actual screenshot of "Tise.com fake page detected" phishing interface captured during link moderation on our platform. — Figure 1: Visual proof of the live scam infrastructure captured during routine moderation.

The Vector of Attack

The scam typically originates directly within the official marketplace chat infrastructure or via a smishing (SMS phishing) message. A fraudulent buyer expresses interest in an item listed by the victim, claims to have made a payment, and sends a short link to “confirm the sale” or “receive the funds.”
Once clicked, the link routes the victim through a shortener or intermediate proxy to mask the toxic domain from automated defensive scanners, landing them on this deceptive interface.

The Deceptive Interface Analysis

The attackers built an accurate visual clone of the platform to exploit user familiarity and neutralize suspicion:

Brand Impersonation (The Identity Theft): The page perfectly replicates the official typography, logo formatting, search bar layout, and corporate color palette of Tise. It uses flawless Norwegian text to maximize credibility among local targets.
Artificial Urgency (The 24-Hour Lockdown): The heading reads: “Hei, din Tise-konto er midlertidig begrenset” (Hi, your Tise account is temporarily restricted). The copy states that the seller account has been locked and demands the user confirm their identity and bank details within 24 hours (“innen 24 timer”). This psychological pressure forces immediate action, hindering the victim from double-checking the technical architecture.
The Payment Gateway Trap: The call-to-action button “Verifiser nå” (Verify now) does not lead to an identity verification portal. It acts as a gateway to a credential and credit card harvesting script. Clicking it opens a form designed to capture complete credit card numbers, expiration dates, CVV codes, and BankID codes, allowing the perpetrators to initiate unauthorized wire transfers immediately.

Key Red Flags for Fraud Detection

Unaffiliated Domain Structure: The address bar reveals the domain ordernzt.net, which has absolutely no legal or infrastructure relation to the official platform (tise.no or tise.com). Attackers buy cheap, generic domains to host transient infrastructure.
Reverse Verification Logic: Legitimate marketplaces never demand a seller enter full credit card and banking details to receive funds for a sold item. Payments are handled natively through pre-linked bank accounts (IBAN/BIC) without requiring secondary authentication.
Mismatched Technical Indicators: While the page title in the browser tab attempts to mimic authenticity by displaying “Tise | TISE.NO”, the actual underlying URL and the lack of official security certificates tied to the actual company prove the site is an entirely fraudulent entity.

Tech Support / Flight Booking Scam

Anatomy of a High-Tier Support & Billing Scam: The Trapped Invoice Method

Threat Intel: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

Actual screenshot of "Tech Support / Flight Booking Scam" phishing interface captured during link moderation on our platform. — Figure 1: Actual screenshot of the active phishing operation intercepted by our security systems.

This image captures a live instance of an aggressive, targeted financial fraud operation known as a “Tech Support / Flight Booking Scam.” Unlike generic mass phishing, this method relies heavily on multi-channel social engineering and highly customized billing infrastructure to bypass traditional security detection.

The Vector of Attack

The deception begins before the victim ever encounters this payment gateway. Typically, the target receives an urgent email or SMS notification masquerading as an automated receipt from a well-known enterprise—frequently an airline, travel agency, or tech corporation.
The notification states that a substantial charge (in this case, $1,278) has already been authorized on their account for an item they never purchased (“Seats”). To create a state of panic, the message explicitly avoids containing a direct refund link. Instead, it provides a toll-free customer assistance number: 1-860-616-0240 (which the perpetrators subtly embedded directly into the URL path of the website).

The Call Center Intervention

When the panicked victim dials the provided number, they do not reach an automated enterprise system. They are connected directly to a fraudulent call center operative. The operative acts as a “support agent,” verifies the fake invoice number (31654), and assures the victim that they can reverse the pending transaction.
To “process the cancellation,” the operative generates a single-use, highly customized short link via an API and sends it to the victim via SMS or chat.

The Deceptive Interface Analysis

The screenshot reveals why this specific landing page is highly effective at exploiting human psychology and bypassing baseline technical automated defenses:

Pre-Filled Immobilization (The JWT Exploit): Under “Transaction Details,” every field—including the victim’s full legal name, private email address, phone number, and exact target amount—is permanently hardcoded and locked. The fields are completely uneditable (editable: false inside the technical token). This creates an illusion of a secure, formal system that already “knows” who they are, reinforcing the false legitimacy of the support agent.
The “Process Payment” Inversion: The psychological core of the trap relies on an absolute inversion of reality. The operative tells the victim that they are entering their payment details into a “secure cancellation portal” to verify their identity and receive a reverse credit. In reality, the victim is filling out a standard merchant billing portal. Clicking the blue button executes a live charge, immediately pulling $1,278 out of the victim’s account.
Exploitation of Third-Party Trust: The page embeds official merchant integration styles for Google Pay and Apple Pay alongside a standard reCAPTCHA widget. The presence of these secure, recognizable global tech components lowers the victim’s critical suspicion, making them feel as though they are interacting with a heavily audited payment architecture.

Key Red Flags for Fraud Detection

The Inversion of Refunds: Legitimate companies never require a customer to input a full credit card number, expiration date, and CVV code on a web form to receive an automated refund or cancellation.
Raw IP and Unverified Domain Chains: The payment form relies on a completely unverified, external payment routing domain (mypayvault.com) that has no structural or legal affiliation with the company the victim initially believed they were contacting.
URL Embedded Directives: Finding a phone number or consumer identifier hardcoded straight into the URL structure (/Airtickt240-860-6160) is a definitive technical marker of an automated campaign infrastructure rather than a standardized corporate billing route.

Fake Xfinity Login Pages

We have discovered a phishing campaign that uses fake Xfinity pages to steal your login credentials. Below is how the attack works, based on real screenshots.

How the Scam Works

Step 1 – The “Thanks for choosing xfinity” lure
The victim lands on a simple page with an Xfinity logo, a “Thanks for choosing xfinity” message, and a button that says “click here to continue”.

Incident Report: This scam layout was intercepted, verified, and locked down firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the hostile origin link has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "Fake Xfinity Login Pages" phishing interface captured during link moderation on our platform. — Figure 1: Visual proof of the active phishing operation isolated on our infrastructure.

This page has no real function – its only purpose is to make you click the button and move to the fake login form.

Step 2 – The fake sign‑in page
After clicking, you are taken to a second page that mimics Xfinity’s real login screen.

Actual screenshot 2 of "Fake Xfinity Login Pages" phishing interface captured during link moderation on our platform. — Figure 2: Visual proof of the active phishing operation isolated on our infrastructure.

It asks for:

Email / mobile / username
Password (not shown in the screenshot, but the next field is implied)

The page includes fake legal text: “By signing in, you agree to our Terms of Service and Privacy Policy.”
There is a “Let’s go” button to submit your data.

Step 3 – Credential theft
When you enter your Xfinity ID and password, the information is sent directly to the attackers. They can then:

Access your Xfinity account (TV, internet, billing)
Change your plan or order services
Use the same email/password combination to attack other accounts (email, banking, social media)

Red Flags You Should Notice

Real Xfinity login page	This phishing page
URL starts with `https://login.xfinity.com/` or `customer.xfinity.com`	Suspicious, unrelated domain (often `github.io`, free hosting, or misspelled domains)
Shows a green lock icon and valid security certificate	No visible security indicators, or a certificate not issued to Comcast
Has “Forgot password?” or “Create an account” links	Missing standard account recovery options
Professional, consistent design	Simple, stripped‑down design – often only the logo and a form
No “click here to continue” intermediate page	Uses an unnecessary extra click to lower your guard

How to Protect Yourself

Never click links in unexpected emails, SMS, or social media messages – even if they look official.
Always type the address manually into your browser: xfinity.com or customer.xfinity.com.
Check the URL carefully before entering any password. Look for misspellings (e.g., xfinity-login.xyz) or unusual domains.
Enable two‑factor authentication (2FA) on your Xfinity account – it blocks attackers even if they have your password.
If you already entered your credentials – go to the real Xfinity website immediately, change your password, and check for unauthorized changes to your account.

Share This Warning

Phishing pages like these are hosted on many different domains. If you see a page that looks like the screenshots above – do not enter any information. Instead, report it to Xfinity (Comcast) and help others by sharing this warning.