HIGH RISK / SCAM
A sophisticated phishing campaign originated in Algeria, targeting the French business sector. Scammers used Google Share links to bypass email security filters, redirecting victims to a temporary Atoms.dev deployment. The site impersonated a fake Spanish trade entity, “Pro Lite Stock,” offering fraudulent import/export services for premium Algerian products.
Threat Intel: This spoofed page was detected, analyzed, and contained firsthand by the
Antiphishing.bizsecurity team during our daily link moderation procedures. To protect the public, the hostile origin link has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.
Technical Breakdown
- Vector: Google Share Redirects (
share.google) - Hosting:
Atoms.dev(Serverless Phishing) - Identity Theft: Fake Spanish entity “Pro Lite Stock” (Non-existent in Spanish Mercantil Registry).
- Goal: B2B Credential Harvesting and Invoice Fraud.
Key Facts Table
- Attacker Origin: Algeria (DZ)
- Traffic Target: France (FR)
- Infrastructure: Obfuscated deployment on
atoms.dev - Status: Neutralized (Domain and IP Cluster Blacklisted)
Expert Advice for French Businesses (Conseil aux Entreprises)
Scammers often impersonate European entities to gain trust. Before interacting with any “Trade Offer” or “Logistics Portal,” take these three steps:
- Verify NIF/CIF (Spain) or SIRET/SIREN (France): Any legitimate European company must display its official registration number. The “Pro Lite Stock” entity failed to provide a valid CIF (Código de Identificación Fiscal). You can verify Spanish companies for free via the Registro Mercantil Central.
- Inspect the Hosting Infrastructure: No established international trade firm hosts its official portal on developer subdomains like *.
atoms.devor *.vercel.app. These are red flags for temporary, throwaway infrastructure. - Cross-Check the Domain History: Use tools like WHOIS to check the domain age. If a company claims to be a “Trusted Global Partner” but their website was created 14 days ago, it is 100% a scam.