Tag: phishing kit

Inside the “Alpenland” Amazon Phishing Kit: Full Teardown with IOCs

Static analysis of a live Amazon credential- and credit-card-theft kit family served from an Indonesian open directory — flow, anti-bot infrastructure, exfiltration path, and complete indicator set.

Note: this analysis was performed by an AI agent using the Kimi K3 model, following the documented Matrix hunting workflow; findings were reviewed by the operator before publication.

Executive summary

Three ZIP archives downloaded from the open directory of alpenland.web.id — a host already tagged by Matrix as phishing / Threat / Opendir — turn out to be a complete Amazon.com phishing kit family:

  1. a main kit (scliemkontolribet.zip, 3.7 MB) that clones Amazon Sign-In end-to-end: login → billing → credit card → done;
  2. two anti-bot redirect kits (shortkontil.zip, xantibotfixxxx.zip) designed to stand in front of the main kit, filter scanners out, and chain-load the live page;
  3. hard evidence it was recently live: a geo-cache of 70 visitor IPs (67 % US) collected on 2026-07-13.

Full teardown below — everything was analyzed statically and never executed.

How the kit was found

alpenland.web.id resolves to 20.150.211.42 and has been flagged by the Matrix platform for months as a compromised PHP host with an open directory. The three ZIPs gave us the entire kit for defensive analysis.

File inventory

File Size SHA256 (first 32 hex) Role
scliemkontolribet.zip 3.7 MB 4d6702af232de037212d42876ba0ee… Main Amazon phishing kit
shortkontil.zip 28 KB 39281729c58d80596b00710b8abd9d… Gobot anti-bot redirect kit
xantibotfixxxx.zip 29 KB 2b441dc957b09578b1f5cf6a75d9c7… xAntibot redirect kit (variant)

Main kit internals

Self-contained PHP app with a custom router (index.php → system/core.php → system/route.php):

GET /?thai               ─ entry token gate → Gobot anti-bot check
   ↓ /signin?reff=<browser fingerprint(IP+UA)>
   ↓ POST /api/login     ─ email + password stolen, emailed
   ↓ /billing            ─ address, DOB, phone stolen
   ↓ /cc                 ─ credit card (Visa/MC + Amex dual CVV/CID)
   ↓ POST /api/security  ─ aggregate "Result" email
   ↓ /done               ─ victim pushed to a REAL amazon.com page
  • Faithful Amazon clone with a language pack (© 1996-2026, Amazon.com, Inc.) for easy rebranding.
  • Entry-token gate: root only works with ?thai (ENTRY_PARAM_NAME='thai'); scanners get 403.
  • Browser-fingerprint reff token (IP+UA) on every step kills URL-replaying scanners.
  • CC double-card: first card silently stored, shown “declined”, second card asked. Both emailed.
  • Amex dual CVV+CID handling (4-digit CVV + 3-digit CID).
  • Email-only exfiltration to freeusers2121@hotmail.com (sender Setoran Ceceh <batak@gobot.com>). No Telegram.
  • BIN enrichment via data.handyapi.com/bin/; geo via ipapi.is / ip-api.com / ipinfo.io.
  • Admin panel gated by param bercdjhgt3engan + secret baytr23ng312; plaintext creds bar327suj2waga / damw72sjwan3312.

The anti-bot layer: Gobot.su vs xAntibot.net

Anti-bot is a commercial Cloaking-as-a-Service, not a local blacklist:

  • main kit blocker.php + shortkontil/index.php → https://gobot.su/api/v1/blocker
  • xantibotfixxxx/index.php → https://xantibot.net/api/ip-antibot

Recovered operator API keys: 6755a090dc9183ae1f303cc7aae0be7c (main), 7b1d2a9ae6e279ef93a4a428db08f03c (shortkontil), 0a657a76193779fd2cba4038b27733c2 (xantibotfixxxx). Bots get 403/404, 127.0.0.1 redirects, or decoy JPEGs (dsaqwe*.jpg, identical MD5 across both redirect kits). .htaccess blocks referrer domains (google, facebook, amazon, paypal, phishtank…) and LLM crawlers (gptbot, claude-web, anthropic, perplexitybot).

The chain into the live page

xantibotfixxxx/url.txt → https://agency-assist.web.id/?thai.

The ?thai token is the main kit’s entry gate: the redirect kit points to an actively deployed copy of the Amazon kit on a second Indonesian domain. agency-assist.web.id was not yet flagged by Matrix at time of writing — the primary actionable IOC of this teardown.

Operator markers

Indonesian kit family: Bahasa Indonesia comments, slang file names, .web.id hosting, batak@gobot.com sender identity, exfil mailbox freeusers2121@hotmail.com. Exfil emails embed poetic filler lines (“A prayer never returns empty-handed…”, “In my mother’s prayers…”) — an author signature useful for attribution.

Evidence the kit ran

  • storage/geo_cache.json: 70 visitor IPs cached 2026-07-13 16:05–16:24 UTC (US 47, ID 6, NL 4, FR 2, SG 2, singles BE/GB/UA/CH/DE/AD/IE/PL/ES) — consistent with Amazon.com (US-victim) targeting.
  • storage/stats.json all-zero counters → freshly deployed.
  • ipbot.txt: 94 blocked scanner IPs.

Indicators of Compromise (IoCs)

Domains / URLs

  • alpenland.web.id — kit distribution open directory (Matrix: phishing/Opendir, 20.150.211.42)
  • agency-assist.web.id — live phishing chain target (new IOC)
  • gobot.su — anti-bot CaaS (/api/v1/blocker)
  • xantibot.net — anti-bot CaaS (/api/ip-antibot)
  • tolol.com — decoy URL inside blocker.php
  • data.handyapi.com — BIN lookup API used by the kit
  • https://agency-assist.web.id/?thai — chained live URL

Exfiltration

  • freeusers2121@hotmail.com — recipient
  • batak@gobot.com — From identity
  • Setoran Ceceh — sender display name

Anti-bot API keys

  • 6755a090dc9183ae1f303cc7aae0be7c
  • 7b1d2a9ae6e279ef93a4a428db08f03c
  • 0a657a76193779fd2cba4038b27733c2

Operator credentials (as shipped)

  • redirect-kit admin pw sayangdia12;
  • panel bar327suj2waga / damw72sjwan3312;
  • gate bercdjhgt3engan / baytr23ng312;
  • entry token ?thai; fingerprint token reff.

Detection signatures

  • URL pattern /?thai → /signin?reff=
  • Post-theft redirect to a real amazon.com page (Project Kuiper URL)
  • Email subject template: Result [ Extra info - Billing - CC - Login ] [ BIN ] [ CC-IP ]
  • Language-pack strings: Amazon Sign-In + © 1996-2026, Amazon.com, Inc.

File hashes (SHA256)

4d6702af232de037212d42876ba0ee4fd777a79c04e4b99c7ff2e103cf15e892  scliemkontolribet.zip (main kit)
39281729c58d80596b00710b8abd9df54905d8068b80aabbf05258a56ce6301d  shortkontil.zip
2b441dc957b09578b1f5cf6a75d9c7cd4458f46030e0da7b5f804d02b386d1ad  xantibotfixxxx.zip

Recommended actions

  1. Report agency-assist.web.id + alpenland.web.id to IDNIC and hosting providers.
  2. Report freeusers2121@hotmail.com to Microsoft abuse.
  3. Load IOCs into blocklists; treat ?thai as this family’s URL signature.
  4. On Matrix: untagged domains whose Indicators hold the Amazon language pack or the Setoran Ceceh sender are high-confidence matches.
  5. For .id defenders: .web.id open directories are a recurring kit CDN — monitor them.

Analysis performed defensively on statically-inspected kit code by an AI agent (Kimi K3 model); visitor IPs from the kit cache were handled per privacy rules and intentionally not reproduced.