Disclosure: this investigation was performed — and this article written — by an AI agent, running under human direction, per the RULES.md constraints of the Matrix workspace. The supervising analyst reviewed every finding and IOC before publication. This was 100% static source-code review of a locally-provided dump: no live infrastructure was probed, and no third-party service (urlscan.io, VirusTotal, etc.) was contacted.
TL;DR
A directory-listing-enabled host, homess[.]web[.]id, was exposing three ZIP archives in plain sight, containing the full PHP source of a small phishing operation: two near-identical “anti-bot gate” redirectors (each keyed to a commercial bot-detection-as-a-service) chained in front of a multi-step Amazon phishing/carding kit. The kit harvests email/password, full billing PII (name, address, DOB, phone, and a Social Security Number field), and payment card data — including a “double-card” trick that always declines the first card submitted to coerce the victim into typing a second, real one. A cached geolocation file left inside the kit shows it was live and actively harvesting real victims (US, Belgium, France, Indonesia) on 13 July 2026.
1. What Was Exposed
The web root of homess[.]web[.]id had Apache/LiteSpeed-style directory autoindex enabled, listing three archives:
scliemkontolribet.zip 3.5M 2026-07-13 22:08 <- the phishing/carding kit shortkontil.zip 28K 2026-05-06 15:24 <- anti-bot redirector gate xantibotfixxxx.zip 29K 2026-07-04 11:48 <- anti-bot redirector gate (different SaaS)
All three were downloaded and reviewed as extracted source trees — no execution, no network contact with the operators’ infrastructure or the third-party anti-bot APIs.
2. The Gate: Two Anti-Bot Redirectors
xantibotfixxxx and shortkontil are functionally identical “smart link” gates, almost certainly built from the same template:
- They filter out cPanel-style subdomains (
mail.,cpanel.,webmail.,webdisk.,autodiscover., …) and any request whose query string contains.jpg— likely an evasion against scanners that fetch links ending in an image extension. - Each maintains a local cache file
ipbot.txtof IPs already classified as bots, to avoid re-querying the paid API.xantibotfixxxx‘s cache already held 364 IPs. - Each calls out to a commercial IP/bot-detection API, keyed with a hard-coded key:
xantibotfixxxx->hxxps://xantibot[.]net/api/ip-antibot(apikey0a657a76193779fd2cba4038b27733c2)shortkontil->hxxps://gobot[.]su/api/v1/blocker(apikey7b1d2a9ae6e279ef93a4a428db08f03c)- Visitors classified as “bot” are redirected to
127.0.0.1(a black hole) and cached; visitors classified as “human” are redirected to whatever URL is stored in a localurl.txtfile. - Both gates also expose a bare, unauthenticated “admin” page: a single hard-coded password (
sayangdia12, no rate limiting, no CSRF token) lets the operator rewriteurl.txt— i.e. repoint the entire campaign to a new landing page on demand, from any browser that knows the password.
Critically, xantibotfixxxx/url.txt on disk contained:
hxxps://agency-assist[.]web[.]id/?thai
The thai query parameter is not incidental — it matches exactly the ENTRY_PARAM_NAME required by the Amazon kit described below, directly linking this gate to that kit’s entry point.
3. The Payload: An Amazon Phishing & Carding Kit
scliemkontolribet is a small PHP MVC-style framework simulating the Amazon flow Sign-in -> “Account on hold” (billing) -> Add a payment method -> Done, built specifically to harvest credentials, PII, and payment cards.
3.1 Configuration and hard-coded secrets
config.php defines the operational parameters in plain text:
RECIPIENT_EMAIL = freeusers2121@hotmail[.]com ENTRY_PARAM_NAME = thai (required GET param to reach the site root) REQUIRED_PARAM_NAME = reff (per-visit fingerprint token, anti-sharing/anti-replay) ADMIN_ACCESS_PARAM = bercdjhgt3engan ADMIN_ACCESS_SECRET = baytr23ng312 BOT_GOBOT_API_KEY = 6755a090dc9183ae1f303cc7aae0be7c (another gobot[.]su key) CC_DOUBLE_CARD = true
storage/admin_auth.php stores the admin panel credentials in clear text: username bar327suj2waga, password damw72sjwan3312.
3.2 Multi-layer cloaking
The .htaccess and system/core.php implement several stacked defenses against automated inspection:
- Blocks requests whose Referer matches a long list of search engines and social platforms (Google, Facebook, Bing, Yahoo, PhishTank, …), and an IP blacklist explicitly commented as “ported from NGENSKUY” — evidence this is a recycled/shared toolkit within an actor community, not a bespoke build.
- Blocks a long list of crawler User-Agents — notably including
gptbot,claude-web,anthropic, andperplexitybot, i.e. deliberate evasion of LLM-based crawling/analysis, not just traditional search bots. - Enforces a fixed whitelist of valid paths (
/signin,/billing,/cc,/done,/api/,/admin); anything else returns a silent 404 before even reaching the bot-detection call, hiding the existence of hidden endpoints from generic scanners. - Delegates the final human/bot decision to the same
gobot[.]suAPI used by the redirector gate; confirmed bots are pushed to127.0.0.1and cached inipbot.txt(94 entries observed), confirmed humans are cached in a separate local whitelist file.
3.3 Data harvesting flow
Step Endpoint Data collected
-------- ------------------- -------------------------------------------------
Sign-in views/*/signin.php Email, password
-> api/login.php
Billing views/*/billing.php Full name, address, city, state, ZIP, phone,
-> api/billing.php date of birth, Social Security Number field
Payment views/*/cc.php Card number, expiry, CVV/CID (Amex-aware),
-> api/cc.php BIN lookup to identify issuing bank
Wrap-up api/security.php Combines everything into one pipe-delimited
"Full Data" record ready to paste elsewhere
The “double-card” trick (CC_DOUBLE_CARD = true) is the most notable piece of tradecraft: the first card submitted is always shown a “declined, please try another card” message and silently stored, while the flow only completes — and redirects to a real Amazon URL as a trust-building touch — once a second card is entered. This maximizes the number of valid payment cards extracted per victim.
Harvested data is emailed via PHP’s mail() function with a spoofed sender batak@gobot[.]com and subject lines such as Setoran Ceceh (“cash deposit” in Indonesian slang) — one more data point, alongside the “NGENSKUY”/”JASUN” comments in the code, suggesting the kit originates from an Indonesian-language cybercrime community and was reused/rebranded for this campaign.
3.4 Evidence of real victims
storage/geo_cache.json, left behind inside the kit, contains real geolocation lookups for dozens of distinct IP addresses across the United States, Belgium, France, and Indonesia, all timestamped between 13 July 2026, 16:00 and 22:00 UTC — a roughly six-hour live window during which the kit was actively fingerprinting visitors. stats.json and visitor_logs.json were found empty/reset, suggesting the operator cleared counters before this snapshot was taken, but the geolocation cache alone is sufficient evidence that the kit was operational and reached real people, not just test traffic.
4. Assessment
This is a low-cost, template-driven Amazon phishing/carding operation, distributed through a disposable “smart link” gate layer that outsources bot-detection to a paid third-party SaaS rather than implementing it in-house. The redirector-to-kit chain (agency-assist[.]web[.]id/?thai -> the scliemkontolribet Amazon flow) demonstrates the actor’s standard operating pattern: cheap, swappable landing infrastructure behind a reusable gate, with the actual credential/PII/card harvesting logic kept in a separate, more valuable kit. The explicit blocking of AI-crawler user agents shows the toolkit’s authors are actively adapting cloaking rules to newer classes of automated visitors.
5. Indicators of Compromise (defanged)
Domains / URLs: homess[.]web[.]id - host exposing the kit archives via open directory listing agency-assist[.]web[.]id/?thai - landing page linked from the anti-bot gate's url.txt gobot[.]su - bot-detection SaaS used by shortkontil and scliemkontolribet xantibot[.]net - bot-detection SaaS used by xantibotfixxxx Exfiltration / drop: freeusers2121@hotmail[.]com - recipient of harvested credentials/PII/card data batak@gobot[.]com - spoofed "From" address on outgoing harvest emails Third-party API keys (attacker-controlled accounts, not victims): 0a657a76193779fd2cba4038b27733c2 - xantibot[.]net apikey (xantibotfixxxx gate) 7b1d2a9ae6e279ef93a4a428db08f03c - gobot[.]su apikey (shortkontil gate) 6755a090dc9183ae1f303cc7aae0be7c - gobot[.]su apikey (scliemkontolribet kit) Kit-internal static credentials/parameters: bar327suj2waga / damw72sjwan3312 - scliemkontolribet admin panel username/password bercdjhgt3engan / baytr23ng312 - scliemkontolribet admin access param/secret sayangdia12 - shared gate "login" password (xantibotfixxxx, shortkontil) thai - required entry query parameter for the Amazon kit
PII note: the geolocation cache and other kit artifacts contain real-looking third-party data points (IP addresses, ISPs, approximate locations of individuals who interacted with the phishing pages). These are not republished in full here beyond what is necessary to demonstrate the kit was operational; underlying raw logs are retained only for internal analysis.
Methodology Note
This was a static source-code review of ZIP archives retrieved from an open directory listing. No script or binary from the kit was executed, no HTTP request was made to homess[.]web[.]id, agency-assist[.]web[.]id, gobot[.]su, or xantibot[.]net, and no submission was made to urlscan.io, VirusTotal, or any other third party. All findings come from reading the PHP/JS source, .htaccess rules, and the JSON/text artifacts (config.json, ipbot.txt, geo_cache.json, stats.json, visitor_logs.json, admin_auth.php) shipped inside the archives themselves.
—
— Written by an AI agent; verified and approved by the human it works for.
Emiliano Carlesi's blog 