Every so often a single domain turns out to be a loose thread, and pulling it unravels an entire operation. This is one of those cases. It started with one look-alike domain — odido-factuur.sbs, impersonating the Dutch telecom brand Odido with a fake “factuur” (invoice) theme — and ended with a months-long, multi-brand phishing and payment-fraud campaign spanning dozens of domains.
Here is what was inside, how it works, and every indicator you need to hunt for it.
One host, a whole toolbox
The odido-factuur.sbs host was not a single phishing page — it was a threat actor’s staging and tooling server. Among the archives it exposed:
- An Odido “factuur” phishing kit. A pixel-clone of Odido’s login flow that harvests e-mail address, password, and the one-time passcode (OTP), then exfiltrates each field in real time to a Telegram bot. The flow is deliberately staged: login → a fake “loading” screen → OTP prompt → redirect to the real
odido.nl, so the victim never notices. - A payment-fraud backend. This is the interesting part (below).
- A “Gizzo” bundle — additional kits for Eneco, Essent, Vattenfall (energy) and ICS (cards), a copy of the SendBlaster bulk-mailer, letter templates, a list of 3,000+ Dutch target e-mail addresses, and a Windows executable (
NM34_x64.exe). - A Finnish banking kit targeting Aktia — with 1,232 per-victim folders and a full multi-step capture flow (login / SMS / PIN / PIN-TAN / card / QR-code / key-list), each stage wrapped in an anti-bot filter and a 300 KB
.htaccessblocklist of security-vendor IP ranges. - A control panel (a re-skinned “uAdmin” install with a Jabber/XMPP plugin).
The iDEAL twist: fraud, not just theft
Most phishing kits stop at stealing credentials. This one goes further. After the fake login, the kit asks the victim to pick their bank, then posts the bank’s BIC code to an attacker-controlled backend:
http://145.249.109.214:5000/run-payment
That backend returns a genuine iDEAL payment URL. The victim is redirected into a real iDEAL transaction and authorises it in their own banking app — moving money directly to the fraudster. A static twin of this logic embeds a signed iDEAL payload and a dictionary mapping every major Dutch bank (ABN AMRO, ING, Rabobank, SNS, bunq, N26, Revolut, Knab, Triodos, RegioBank, ASN, Van Lanschot, Yoursafe) to its official iDEAL deep-link. In other words: the credential theft is the warm-up; the iDEAL payment request is the payout.
From one domain to a cluster
Feeding the seed into Matrix (our newly-registered-domain monitoring platform) and pivoting on the naming grammar — <Dutch-brand>-factuur / facturatie / betaling / klant / portaal / helpdesk.sbs — surfaced a 78-domain cluster, of which 25 were live at the time of writing. Impersonated brands include Odido, Vattenfall, Ziggo, KPN, ASN Bank, bunq, Klarna, Bitvavo, CM.com, International Card Services, plus generic netfactur invoice domains and a klant- series — and the UK bank Halifax.
The oldest cluster domain dates to November 2025; odido-factuur.sbs itself was registered the day before this analysis. The campaign has been rotating brands steadily for roughly eight months:
2025-11-21 ziggo-factuur.sbs 2025-12-01 international-card-helpdesk.sbs 2026-01-07 kpn-betaling.sbs 2026-04-28 vattenfall-factuurbureau.sbs 2026-06-08 factuur-odido.sbs 2026-07-03 odido-facturatie.sbs 2026-07-22 odido-factuur.sbs
Infrastructure and attribution
- Registrars are deliberately spread across Hostinger, NameSilo, OwnRegistrar, Global Domain Group, WebNIC and NiceNIC — resilience against single-registrar takedowns rather than one bulk order.
- DNS pivot: the
netfactur*group shares the nameserver set10210.dns1-4.managedns.org, tying those domains to a single operator account. - Every backend lives on Globconnex. The public phishing pages hide behind Cloudflare, but every server-side component sits on AS Globconnex (
abuse@globconnex.com): the iDEAL C2 (145.249.109.214), the payload host (81.19.140.142, servingsetp.exe/sci-frieb), the Finnish-kit exfil gate (85.208.139.108/quicksupport/gate.php), and a live phishing domain (klant-beheer-ji.sbs,87.120.222.56). Globconnex is the single most effective takedown target for the whole operation. - An operator’s calling card. Buried in a bulk-mailer kit was an
info.txtholding the actor’s SendBlaster license e-mail —darthraid@hotmail.com— its license key, a spoofed ICS-card sender (server.icscardveillig@planet.nl), and ablinks.toshortlink. Pivoting thedarthraidhandle in Matrix surfaces likely persona domains:darthraider.net,darthraiders.com,darthraidr.com. - Rotating, shared, multi-scam. The same
.sbspool has also served an “Odido data-breach collective-claim” scam (on.nldomains), a USDT/AML crypto page, and even a German tax-refund redirect (steuerruckerstattung.sbs). Treat this as shared infrastructure — not necessarily a single operator across every domain.
Defensive takeaways
- iDEAL / open-banking payment-request abuse is a growing pattern: the victim authorises a real transaction, so classic “don’t enter your password” advice is not enough. Warn users that a genuine banking-app prompt appearing right after an “invoice” link is a red flag.
- OTP does not save you here — it is phished and relayed in real time. Push-based, phishing-resistant authentication (passkeys) is the durable fix.
- Newly-registered
.sbsdomains carrying brand +factuur/betaling/klanttokens are a high-signal hunt; the whole cluster was invisible to automated classification when found.
Indicators of Compromise
Network & payload
| Type | Value |
|---|---|
| iDEAL fraud backend (C2) | http://145.249.109.214:5000/run-payment (AS Globconnex) |
| Payload host | http://81.19.140.142/setp.exe, /sci-frieb (AS Globconnex) |
| Finnish-kit exfil gate (C2) | http://85.208.139.108/quicksupport/gate.php (AS Globconnex) |
| Co-hosted phishing domain | klant-beheer-ji.sbs → 87.120.222.56 (AS Globconnex) |
| Telegram exfiltration bot | 7046363890:AAHmFxm-MdLL9OykMzhvNBKS2NmV6zUQDgM (chat 5976060042) |
| Signed iDEAL payload | tx.ideal.nl/2/AZ77YSPTSDRHGTOSFOW5QUT45LQ?sig=BGBCQEII… |
| Operator e-mail | darthraid@hotmail.com (SendBlaster license holder) |
| SendBlaster license key | 55D6-255E-3D76-27B7-7B69 |
| Spoofed sender (ICS phish) | server.icscardveillig@planet.nl |
| Shortlink redirector | blinks.to/icscards-verify |
| Actor persona domains | darthraider.net, darthraiders.com, darthraidr.com |
| Cloaking / redirect domains | ics-helpdesk.sbs, steuerruckerstattung.sbs |
| Malware sample | NM34_x64.exe — SHA-256 3a443055a478384ddd184c39a7b1acea9f213719d26e93204f782cb14dfb562a |
| Spam tool | SendBlaster 3.1.6 |
Domain cluster (78)
Live at time of writing (25):
odido-factuur.sbs odido-factuur.online odido-dashboard.xyz odidobreach.com odidoclaim.com odidoclaim.help odidoclaim.nl odidoclaimactie.nl odidodatalek.com odidofactuur.info odidoiptv.online odidolek.nl odidopo.top odidospam.nl odidostoring.xyz odidoza.top international-card-helpdesk.sbs klant-beheer-ji.sbs klantportaal-mijnaccount.sbs klarna-klantenservice.sbs klarna-klantenservices.sbs 2dehandsbetalingpay.sbs be-betalingssysteem.sbs betaling-verzoek.sbs verwerkingsverzoek-klantpagina.sbs
Odido (other):
odido-facturatie.sbs odido-factuurafdeling.sbs facturatie-odido.sbs facturatiebureau-odido.sbs factuur-odido.sbs factuurafdeling-odido.sbs factuurbureau-odido.sbs factuurincasso-odido.sbs odido-betaling.help odido-claim.nl odido-klant.com odido-verificatie.help odido-wifi.com odidochecker.nl odidodatalek.top odidonline-2026.com odidord.icu odidosimkaart.com odidoverzicht.net
Other brands & generic:
vattenfall-factuurbureau.sbs vattenfall-betalingsfactuur.sbs ziggo-factuur.sbs kpn-betaling.sbs klant-asnb.sbs klant-lcscards.sbs bitvavo-klantportaal.sbs bunqklantenservice.sbs cm-klantportaal.sbs cmportaal-klantpagina.sbs mijnfluv-klantportaal.sbs helpdesk-halifax-notifications.sbs internationalservice-klantportaal.sbs klant-account-beveiliging.sbs klant-bezoeknummer182823.sbs klant-bezoeknummer833893.sbs klant-bezoeknummer4987543.sbs online-betalingen.sbs factuur-betalen.sbs netfactur.sbs netfactur4.sbs netfactur5.sbs netfactur6.sbs netfactur7.sbs netfactur8.sbs netfactur9.sbs netfactur10.sbs netfactur11.sbs netfactur12.sbs netfactur13.sbs netfactur14.sbs netfactur15.sbs netfactur16.sbs netfactur17.sbs
Note: some .nl “datalek/claim” domains and opportunistic pages above share infrastructure but may be run by a distinct, related operator. Domains are published as hunting indicators.
Analysis performed with Matrix. If you operate one of the impersonated brands or an abused network and want the full technical report, get in touch.
Emiliano Carlesi's blog 