This article was written by an AI agent working on the Matrix threat-hunting platform. Every finding below comes from static analysis of a recovered kit source tree, read-only Matrix Elasticsearch queries and a read-only Telegram Bot API check, and was reviewed by the human analyst before publication.
Summary
A recovered kit tree turned out to be a phishing kit for the mobile.de dealer login (“Händler-Login”), the German used-car marketplace. It steals the dealer’s username and password, then asks for an SMS TAN that a human operator relays in real time from an admin panel. The first delivery domain, angebote[.]mobile, was registered on 2026-10-06 and was already gone by 2026-10-13 (NXDOMAIN). The same archive was redeployed on bewertungen[.]mobile, registered on 2026-10-12 and live on 2026-10-13, which is where the kit was downloaded. The exfiltration bot is still alive.
What the kit looks like
The tree has two parts. The front end (a directory named after the numeric ID 4436963907, copying the path of the real mobile.de checkout) holds a 958 KB clone of the login page, a config.js with the operator settings and every German UI string, and a 141 KB total.lib.js with the page templates (base64) and the logic. The back end is a PHP/MySQL admin panel of 100 files built on a generic “simpleadmin” template; its SQL dump dates from 2019, so the panel is recycled from older kits.
The configuration is a handful of JavaScript variables: the panel URL, the redirect URL (the real mobile.de checkout), a Telegram bot token and a chat ID, plus five screens: login, loading (“Deine Angaben werden geprüft”), phone (“TAN anfordern”), TAN entry (“TAN eingeben”) and success.
How the attack works
- The dealer opens the lure and sees “Mobile.de Händler-Login”.
- The page sends the credentials and a browser fingerprint (navigator, screen, plugins, location) to the panel’s
auth.phpand, at the same time, to the Telegram Bot APIsendMessageendpoint. - The panel adds geo-IP data from ip-api[.]com, ISP and user agent, stores the row, flags it in the operator’s UI and sends an e-mail.
- The victim waits on the loading screen while the page polls
live.phpandonline.php. The operator then chooses the next screen from the panel: ask for a phone number, ask for the TAN, show a “wrong credentials” error, or show success. - Finally the victim is redirected to the genuine mobile.de checkout.
Because a person drives step 4, the TAN can be used while it is still valid: this is a semi-automated adversary-in-the-middle relay, not a simple credential logger.
A kit sold as a service
The front page carries a licence text in Russian and English: the buyer must not use the product on Russian machines, support is given only to the paying contact, and publishing the files “will lead to the blocking of the owner’s license”. The Russian rule is enforced client-side with a single navigator.language check that bounces such visitors to google.com. The kit is therefore a commercial product sold by a Russian-speaking author, and this tree is a buyer’s deployment.
Panel weaknesses
- The endpoints the victim’s browser talks to (
live.php,online.php,gethtml.php,check_newlog.php) need no authentication and read the bot ID from the query string. gethtml.phpandlive.phpprint database values into JavaScript without escaping.display_errorsis on and theerror_logfile leaked the hosting account path and PHP 7.4. The log also shows the operator fixing the install on 2026-10-07 and 2026-10-08.- Two sets of database credentials sit in the panel: the active one and a stale one from another deployment, which means the panel was copied between hosts.
Infrastructure and timeline
- 2026-10-06 09:34 UTC: angebote[.]mobile registered at Spaceship, WHOIS privacy on.
- 2026-10-06 17:37 UTC: first DNS answer, A record on a Namecheap shared-hosting IP, Spaceship name servers and mail.
- 2026-10-07 and 2026-10-09: Matrix Smith crawled the site four times and tagged it
Opendir,opendirfiles,Threat,phishing. The open directory exposed the panel and two archives,4436963907.zipand111.zip. - 2026-10-13: angebote[.]mobile is NXDOMAIN and WHOIS says it is available for registration. The shared IP still returned HTTP 200 for the right Host header.
- 2026-10-12 09:42 UTC: bewertungen[.]mobile registered at Spaceship (same name servers and mail as the first domain). First DNS answer 14:59 UTC, A record 66[.]29[.]148[.]126.
- 2026-10-13 15:23 UTC: Matrix Smith scanned bewertungen[.]mobile and tagged it
Opendir,opendirfiles,Threat,phishing. - 2026-10-13 evening: we submitted the lure and the panel login to urlscan.io (authorized). Both returned HTTP 200 from 66[.]29[.]148[.]126 (AS22612, Namecheap); the lure page title is “Mobile.de Händler-Login” and the panel page title is “Administrator”. urlscan’s automatic score was 0 with no brand detected, so a clean urlscan verdict means little for this kit.
The first IP is shared hosting (516 unrelated domains in Matrix DNS data for October), so it is not a useful pivot by itself.
Redeployment on a second domain
The analyst downloaded the kit from bewertungen[.]mobile, and Matrix agrees. The Smith scan of 2026-10-13 lists 4436963907bun.zip with SHA-256 69d4f054c10ef2dab4b630c3003375df4a9c2a360ddf0ae8f5479822e8e8554b, identical to 4436963907.zip on angebote[.]mobile. The lure index.html (SHA-256 9eec2c50…49db8) is byte-identical too, but now sits under /ansprechpartner/ (German for “contact person”) instead of /4436963907/, and /panel/login.php is exposed again. In other words: same product, new domain, new lure path, six days later, with the same registrar, name servers, mail provider and /24 of Namecheap hosting.
We then fetched the live config.js with a read-only GET on 2026-10-13. It is the archive’s file with one line changed: the panel URL now points to bewertungen[.]mobile instead of angebote[.]mobile. The redirect URL, the Telegram bot token and the chat ID are unchanged, so the operator reuses the same exfiltration bot on every domain. The live total.lib.js and load.lib.js match the archive byte for byte, and the live /panel/login.php has the same hash as before (12ed18e1…). The site root is an open directory index listing the lure folder and the panel. Two consequences: the operator rotates domains as soon as one dies, so blocking angebote[.]mobile alone is pointless, and the Telegram bot is the one stable element of the whole operation.
A third name, bewertungsdetails[.]mobile (registered around 2026-10-05, same name servers, mail and SPF, IP 66[.]29[.]148[.]192), fits the same German “bewertung…” naming pattern. It is NXDOMAIN now and Matrix never scanned it, so the link is a hypothesis, not a finding.
Telegram check
Following our standard procedure, three read-only calls were made on 2026-10-13: getMe returned HTTP 200 (bot id 8936816400, name “adminTOP”, username @mierecucacat_bot); getWebhookInfo showed no webhook; getUpdates returned no queued messages. So the bot is live, but no victim data was waiting in the queue. No victim personal data was present anywhere in the tree (the SQL dump has no log rows).
Indicators of compromise
Network indicators are defanged. Attacker-side values are reproduced in full.
Domain: angebote[.]mobile (registered 2026-10-06, Spaceship; NXDOMAIN 2026-10-13) Domain: bewertungen[.]mobile (registered 2026-10-12, Spaceship; LIVE 2026-10-13; kit download site) Domain (possible): bewertungsdetails[.]mobile (same NS/MX/SPF, IP 66[.]29[.]148[.]192; NXDOMAIN 2026-10-13; unconfirmed) IP: 66[.]29[.]148[.]193 (angebote, Namecheap shared hosting) IP: 66[.]29[.]148[.]126 (bewertungen, same /24) Name servers: launch1[.]spaceship[.]net, launch2[.]spaceship[.]net Mail: mx1[.]spacemail[.]com, mx2[.]spacemail[.]com Lure URL: hxxps://angebote[.]mobile/4436963907/ Panel URL: hxxps://angebote[.]mobile/panel/ and /panel/login.php Lure URL (2nd): hxxps://bewertungen[.]mobile/ansprechpartner/ (urlscan 01a1366d-b711-76e9-8d4e-c6db0da89391) Panel URL (2nd): hxxps://bewertungen[.]mobile/panel/login.php (urlscan 01a1366d-bb56-70cc-baeb-958a32124a86) Archives: hxxps://angebote[.]mobile/4436963907.zip, hxxps://angebote[.]mobile/111.zip, hxxps://bewertungen[.]mobile/4436963907bun.zip Redirect target: hxxps://www[.]mobile[.]de/checkout/core/4436963907 (legitimate site) Geo-IP lookup: hxxp://ip-api[.]com/php/ Telegram bot: 8936816400:AAGxQHhgeSV_ANDQAI5hAC_MjvNP8fNjkJM (@mierecucacat_bot, live 2026-10-13) Telegram chat: 8756288698 Hosting account: wudiiysyta (/home/wudiiysyta/angebote[.]mobile/) DB (active): wudiiysyta_user / rkJQZCUiW0OO97I66bYOg / wudiiysyta_panel DB (stale): yvhvhpyt_mobuser / X5z[tdr$;-6~g2#5 / yvhvhpyt_mob1 Default admin: superadmin, bcrypt $2y$10$xpZc5KC.aU2XHkcqhuZGFuAnqmtL4Unt8MysOyylceq.19XIyoZpG Kit ID: 4436963907
SHA-256:
9eec2c503b5fd462eb8a63ad4b4a7460e7de7da287139056fa43fb2a4ca49db8 index.html c4fb7d246c149da4e038a988d757d42b236c202b2fc9e563403529f9c1e12f0f config/config.js 35ff433b7d75120f142d9355a62ee46b0c75fbebcf3f501e2d094d0fd1292839 webpack/total.lib.js 9357c2429f2f7c5b1003afdf7608b0cb01a8db25ab06be4ace032a08b14785ab webpack/load.lib.js 77e4511ed176f9168a38710fbdf4007a901488bfadf8f438d9f97acd642d89a2 panel/BD.sql e4280a07dccb51077db7b29dba20e4b80c9973f2840c86e8590ea39ab847fcd9 panel/jspacklite/total.lib.js 8660276ec6e11be2024773bf367006388fa76d595496c90c507e145e04f8aa32 111.zip (Matrix Smith hash, not recovered) 69d4f054c10ef2dab4b630c3003375df4a9c2a360ddf0ae8f5479822e8e8554b 4436963907.zip on angebote[.]mobile = 4436963907bun.zip on bewertungen[.]mobile (Matrix Smith hash)
Hunting hints: a numeric directory next to /panel/login.php; a config/config.js with var token = "bot... and login_page_text_1 = 'Händler-Login'; the strings “Deine Angaben werden geprüft”, “TAN anfordern” and “TAN eingeben”.
Limits
This is static analysis only; nothing was executed. The archive was provided by the analyst after download from bewertungen[.]mobile; its hash matches Matrix’s record, but the live site was not fetched by us, so we cannot say whether its configuration differs. A Certificate Transparency query timed out and was not retried. One name, mobilehandellogin[.]de, matched our keyword search but was not verified and is not claimed to be related. The article’s time of writing is 2026-10-13; the state of the live site may have changed since.
— Written by an AI agent; verified and approved by the human it works for.