Category: Phishing Emails

Ongoing Phishing Campaign Abusing Google Cloud Storage to Redirect Users to Multiple Scam Pages

Anurag GawandeLeave a comment

A few days ago, I published a blog analyzing a phishing campaign abusing Google Cloud infrastructure:

Analysis of an Integrated Phishing Campaign Utilizing Google Cloud Infrastructure

While continuing to monitor the infrastructure used in that campaign, I discovered several additional URLs hosted on Google Cloud Storage (storage[.]googleapis[.]com) that appear to be part of the same ecosystem. These pages act as intermediate redirectors, sending victims to a wide variety of phishing and scam sites hosted primarily on the .autos TLD.

What is interesting is that a single Google Cloud Storage page appears to function as a central redirect hub, distributing victims across multiple scam themes such as fake surveys, reward scams, antivirus alerts, job offers, and account storage warnings.

Newly Observed Google Cloud Storage URLs

The following URLs were identified during the investigation:

storage[.]googleapis[.]com/whilewait/successcomes.html
storage[.]googleapis[.]com/sndrr/strow.html
storage[.]googleapis[.]com/noonchi/noon.html
storage[.]googleapis[.]com/sndrr/hmd.html
storage[.]googleapis[.]com/wetaobao/taobao.html
storage[.]googleapis[.]com/savelinge/goforward.html
storage[.]googleapis[.]com/lithesome/stepupnow.html

One particular page stood out during analysis:

This page appears to function as a traffic distribution page, redirecting visitors to multiple phishing sites depending on campaign configuration.

storage[.]googleapis[.]com/whilewait/successcomes.html

I also shared an earlier observation on X (Twitter):

Traffic Redirection to .autos Phishing Domains

The redirector page was observed sending users to various phishing domains, most of which are hosted under the .autos top-level domain.

These phishing sites are themed around different scams designed to lure victims into providing personal or financial information.

Below are the different campaign themes identified.

Netflix Reward Phishing Pages

Some pages impersonate Netflix reward programs, claiming users have won prizes or special promotions.

Domains involved:

digital-shift-us-bin[.]autos
searchonboardloadingrock[.]autos
mailanalyticsvolseries[.]autos
verifieddreamseriesultimate[.]autos
goldavgpenb[.]autos
alt-dig-gold-tab[.]autos
bio-easy-pe-loading[.]autos
analytics-mail-post-quite[.]autos
favouritebiochoicelife[.]autos

Additional domains were also shared by an X user @skocherhan quoting my earlier post:

Additional domains observed:

goldavgpenb[.]autos
alt-dig-gold-tab[.]autos
bio-easy-pe-loading[.]autos
analytics-mail-post-quite[.]autos
favouritebiochoicelife[.]autos

These pages typically present users with messages claiming they have been selected for a Netflix reward or promotional giveaway, encouraging them to complete a short survey to claim their prize.

Like the other scams in this campaign, the pages ultimately attempt to collect personal or payment information, often under the pretext of paying a small shipping fee or verifying eligibility.

Fake Dell Laptop Giveaway Survey

Another variation promotes a Dell laptop giveaway, typically claiming that users can win a Dell 16 DC16250 laptop worth $699.99.

Domains hosting these pages include:

avgeasyposttips[.]autos
searchonboardloadingrock[.]autos
alt-dig-gold-tab[.]autos
gold-avg-pe-nb[.]autos
tra4fficjumpchoiceclever[.]autos
digprtdreamavg[.]autos
shifttra4fficcapsmatch[.]autos
digitalshiftusbin[.]autos
spacevertabnb[.]autos
rot-digital-fly-f2f[.]autos

These pages typically:

  • Ask the victim to answer a few survey questions.
  • Display a congratulatory message.
  • Request credit card details to pay for shipping fees.

Fake “AI Data Assistant – Earn $500/day” Job Lure

Another theme used in this campaign promotes a fake online job opportunity, claiming users can earn $500 per day as an AI data assistant.

Observed domains:

verifieddreamseriesultimate[.]autos
pushbuttonsystem[.]net
lifeverifiedfavouritever[.]autos
mailanalyticsvolseries[.]autos
spacevertabnb[.]autos

These pages typically claim:

  • No experience required
  • High daily earnings
  • Work from home opportunities

Users are often redirected through several steps designed to collect personal information or push affiliate offers.

“Antivirus Subscription Expired” Phishing Pages

Another set of pages impersonates security alerts, claiming the user’s antivirus subscription has expired.

Domains observed:

safepremiumfreeriskfree[.]autos
nationalrecommendsafesmart[.]autos
deviceriskfreesafe[.]autos
freespeedpopular[.]autos
guardpopularinstalldevice[.]autos
speeddeviceboostfast[.]autos
programeffectivespeedfast[.]autos

These pages typically:

  • Display fake security warnings
  • Urge users to renew antivirus protection
  • Redirect victims to payment or affiliate pages.

“Cloud Storage Full” Phishing Pages

Another variation of this campaign uses cloud storage warnings, claiming the user’s storage account is full.

Observed domains:

stairs-table-fire.autos
tablewordstairs[.]autos
ceilwordinteriorbowl[.]autos
safe-premium-free-riskfree[.]autos
nationalprotectsmartfree[.]autos
guardpopularinstalldevice[.]autos
ceil-word-interior-bowl[.]autos
free-speed-popular-guard[.]autos
device-safe-clean-boost[.]autos
boost-premium-recommend-effective[.]autos
trk[.]independent-teacher-strength-nails[.]run

Additional domains were also shared by an X user quoting my earlier post:

These pages often mimic services such as:

  • Google Drive
  • iCloud

The goal is to scare victims into clicking through fake upgrade or security alerts.

Fake Walmart Survey Scam

Several phishing domains impersonate Walmart survey reward campaigns, often promising a free gift or prize in exchange for completing a short survey.

Domains observed:

jumpdiganalyticsprt[.]autos
avgeasyposttips[.]autos
cleververifieddigitalmatch[.]autos
altbio[.]autos
alt-dig-gold-tab[.]autos
matchstarsrotchoice[.]autos
directvolcapsus[.]autos
digprtdreamavg[.]autos

These pages typically display messages such as:

  • “Congratulations! You have been selected to receive a reward”
  • “Complete a short Walmart survey to claim your prize”

After the survey is completed, victims are usually asked to pay a small shipping fee, where credit card information is harvested.

Key Observation

One of the most notable aspects of this campaign is the central role of the Google Cloud Storage page:

storage[.]googleapis[.]com/whilewait/successcomes.html

During testing, this page was observed redirecting users to multiple phishing domains across different scam themes.

This suggests it is functioning as a traffic distribution or redirect infrastructure, allowing attackers to rotate phishing destinations while keeping the initial delivery URL stable.

Using Google Cloud Storage also adds a layer of trust, as the domain belongs to a legitimate cloud provider.

Another interesting observation is that a single .autos domain can serve multiple phishing page themes after redirection from the Google Cloud Storage page. Depending on the redirection path or parameters, the same domain may host different scams such as:

  • Fake surveys
  • Reward scams
  • Storage full alerts
  • Antivirus subscription warnings
  • Job offer lures

This behavior indicates that the attackers are likely using a shared phishing kit or centralized backend infrastructure, allowing them to quickly rotate scam themes while reusing the same domains.

Another observation is the high volume of phishing emails currently being distributed using this infrastructure. Over the past few days, I have been receiving around 40–50 phishing emails within a 24-hour period, many of which contain links to Google Cloud Storage pages that act as redirectors to the phishing ecosystem described in this report.

URLs repeatedly observed in these emails include:

storage[.]googleapis[.]com/whilewait/successcomes.html
storage[.]googleapis[.]com/savelinge/goforward.html

Indicators of Compromise (IOCs)

Google Cloud URLs

storage[.]googleapis[.]com/whilewait/successcomes.html
storage[.]googleapis[.]com/sndrr/strow.html
storage[.]googleapis[.]com/noonchi/noon.html
storage[.]googleapis[.]com/sndrr/hmd.html
storage[.]googleapis[.]com/wetaobao/taobao.html
storage[.]googleapis[.]com/savelinge/goforward.html
storage[.]googleapis[.]com/lithesome/stepupnow.html

Phishing Domains

digital-shift-us-bin[.]autos
searchonboardloadingrock[.]autos
mailanalyticsvolseries[.]autos
verifieddreamseriesultimate[.]autos
goldavgpenb[.]autos
alt-dig-gold-tab[.]autos
bio-easy-pe-loading[.]autos
analytics-mail-post-quite[.]autos
favouritebiochoicelife[.]autos
goldavgpenb[.]autos
alt-dig-gold-tab[.]autos
bio-easy-pe-loading[.]autos
analytics-mail-post-quite[.]autos
favouritebiochoicelife[.]autos
avgeasyposttips[.]autos
searchonboardloadingrock[.]autos
alt-dig-gold-tab[.]autos
gold-avg-pe-nb[.]autos
tra4fficjumpchoiceclever[.]autos
digprtdreamavg[.]autos
shifttra4fficcapsmatch[.]autos
digitalshiftusbin[.]autos
spacevertabnb[.]autos
rot-digital-fly-f2f[.]autos
verifieddreamseriesultimate[.]autos
pushbuttonsystem[.]net
lifeverifiedfavouritever[.]autos
mailanalyticsvolseries[.]autos
spacevertabnb[.]autos
safepremiumfreeriskfree[.]autos
nationalrecommendsafesmart[.]autos
deviceriskfreesafe[.]autos
freespeedpopular[.]autos
guardpopularinstalldevice[.]autos
speeddeviceboostfast[.]autos
programeffectivespeedfast[.]autos
stairs-table-fire.autos
tablewordstairs[.]autos
ceilwordinteriorbowl[.]autos
safe-premium-free-riskfree[.]autos
nationalprotectsmartfree[.]autos
guardpopularinstalldevice[.]autos
ceil-word-interior-bowl[.]autos
free-speed-popular-guard[.]autos
device-safe-clean-boost[.]autos
boost-premium-recommend-effective[.]autos
trk[.]independent-teacher-strength-nails[.]run
jumpdiganalyticsprt[.]autos
avgeasyposttips[.]autos
cleververifieddigitalmatch[.]autos
altbio[.]autos
alt-dig-gold-tab[.]autos
matchstarsrotchoice[.]autos
directvolcapsus[.]autos
digprtdreamavg[.]autos

This campaign demonstrates how attackers continue to abuse trusted cloud infrastructure such as Google Cloud Storage to host redirectors that distribute victims to multiple phishing pages.

By using legitimate cloud services as part of the attack chain, threat actors can increase credibility and reduce the likelihood of immediate blocking.

The use of large numbers of disposable .autos domains further allows attackers to rotate phishing pages frequently while keeping the delivery infrastructure intact.

In addition, the system appears to restrict repeated access attempts from the same IP address. After a user successfully reaches a phishing page through the redirector, subsequent attempts to access similar URLs from the same IP may result in the page failing to load or redirecting to unrelated sites. This behavior suggests the presence of IP-based filtering or traffic distribution logic, commonly used in malicious traffic distribution systems (TDS) to control how often a visitor can access the phishing infrastructure.

Beware of “Your Account Has Been Hacked. You need to unlock” Scam Emails: Stay Safe Online

Anurag Gawande2 Comments

Scam emails claiming that your account has been hacked are alarmingly common. These emails exploit fear, embarrassment, and urgency to pressure victims into transferring money, often in the form of cryptocurrency. A common scam starts with the subject line: “Your account has been hacked. You need to unlock.”

What Does the Scam Look Like?

Subject: Your account has been hacked. You need to unlock

Sender: Billy Harrington <info@azurepavillion>

Hello!

I have to share bad news with you. Approximately a few months ago, I gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities.

Here is the sequence of events:

Some time ago, I purchased access to email accounts from hackers (nowadays, it is quite simple to buy it online).

I have easily managed to log in to your email account. One week later, I have already installed the Cobalt Strike "Malware" on the Operating Systems of all the devices you use to access your email.

It was not hard at all (since you were following the links from your inbox emails). All ingenious is simple.

This software provides me with access to all your devices controllers (e.g., your microphone, video camera, and all on it).

I have downloaded all your information, data, photos, videos, documents, files, web browsing history to my servers.

I have access to all your messengers, social networks, emails, chat history, and contacts list.

My virus continuously refreshes the signatures (it is driver-based) and hence remains invisible for antivirus software.

Likewise, I guess by now you understand why I have stayed undetected until this letter.

While gathering information about you, I have discovered that you are a big fan of adult websites.

You love visiting porn websites and watching exciting videos while enduring an enormous amount of pleasure.

Well, I have managed to record a number of your dirty scenes and montaged a few videos, which show how you masturbate and reach orgasms.

If you have doubts, I can make a few clicks of my mouse, and all your videos will be shared with your friends, family, and relatives.

Considering the specificity of the videos you like to watch (you perfectly know what I mean), it will cause a real catastrophe for you. I also have no issue at all with making them available for public access (leaked and exposed all data).

General Data Protection Regulation (GDPR): Under the rules of the law, you face a heavy fine or arrest. I guess you do not want that to happen.

Here is what you need to do - transfer the Bitcoin equivalent of 12000 USD to my Bitcoin account (that is rather a simple process, which you can check out online in case if you do not know how to do that).

Below is the Bitcoin account information (Bitcoin wallet):
1HLn1GNBvENxZH5r2mNAgEVwjySyRTZGKQ

Once the required amount is transferred to my account, I will proceed with deleting all those videos and disappear from your life once and for all.

Kindly ensure you complete the abovementioned transfer within 50 hours (2 days +).

I will receive a notification right after you open this email, hence the countdown will start.

Trust me, I am very careful, calculative and never make mistakes. If I discover that you shared this message with others, I will straight away proceed with making your private videos public.

Good luck!

  1. Fake Claims of Hacking
    The scammer alleges that they have gained access to your email account and devices through malware or by purchasing access from other hackers.
  2. Threats to Expose Sensitive Information
    They claim to have recorded compromising activities (often fabricated) using your webcam or other devices and threaten to share this material with your contacts.
  3. Demand for Payment
    The email demands a payment, typically in Bitcoin, to prevent the supposed release of your private information. A countdown is often given to create urgency.
  4. Technical Details to Appear Credible
    The email may mention malware like “Cobalt Strike” or other tools to intimidate recipients and make the threat seem legitimate.
  5. Warnings Against Reporting
    Scammers caution victims against sharing the email with anyone, claiming they will release the sensitive information if the email is reported.

What is Cobalt Strike?

Cobalt Strike is a cybersecurity tool designed for penetration testing. It helps security professionals simulate real-world cyberattacks to test the resilience of networks. The software provides features like payload generation, command and control (C2) communication, and post-exploitation tools to mimic the actions of hackers.

However, cybercriminals often misuse it for malicious purposes. They use Cobalt Strike to deliver malware, maintain access to compromised systems, and exfiltrate data. Its stealth features, such as evading detection by antivirus software, make it a popular choice among attackers. Originally meant for ethical hacking, it highlights the fine line between testing defenses and exploiting vulnerabilities.

Email Header Analysis

Understanding email headers is crucial for identifying the source of scam emails. Here’s an analysis of the header details from the scam email:

Source Server: The email originated from static-185-95-84-74.sunucuhub.com with the IP address 185.95.84.74. This server appears to belong to a suspicious or unverified host.

Helo Address: The sender’s system introduced itself as static-84-74.corelux.net, which may be a fake or compromised server.

Relaying Server: The email was relayed through vps2.webfruit.space using secure email transmission (esmtpsa) with TLS encryption (TLS1.2).

Envelope Sender: The email claims to be from <info@azurpavillon.com>, but this could easily be spoofed.

Sender IP address VirusTotal Score: 8/94

The sender’s IP address, 185.95.84.74, has a VirusTotal score of 8/94, indicating that 8 out of 94 security vendors flagged it as malicious or suspicious. A score of 8 is a strong indication that this IP is associated with potentially harmful activities, such as phishing or malware distribution. This reinforces the likelihood that the email is part of a scam. Always verify suspicious IP addresses using tools like VirusTotal to assess their reputation and avoid engaging with emails originating from flagged sources.

Why You Shouldn’t Fall for It

  1. No Evidence of Actual Hacking
    The email lacks concrete proof, such as a specific password or verifiable detail about you. The threats are generic and designed to instill fear.
  2. Claims Are Technically Improbable
    • Modern operating systems and antivirus software make it difficult for malware to remain undetected for months as described.
    • Webcam access typically requires explicit permission, making the claims of recorded activities suspect.
  3. Bitcoin Transactions Are Irrecoverable
    Scammers use cryptocurrency because it is hard to trace and impossible to reverse once sent.

What to Do If You Receive Such an Email

Step 1: Do Not Panic
Remember, this email is likely a phishing attempt and not evidence of an actual security breach.

Step 2: Do Not Reply or Pay
Responding or paying only validates your email address as active, making you a target for future scams.

Step 3: Verify Your Account Security

  • Change your email password and enable two-factor authentication (2FA).
  • Scan your devices with updated antivirus software to ensure no malware is present.

Step 4: Blog the Sender
Mark the email as spam and block the sender’s address.

Bitcoin Wallet Address

The Bitcoin address provided in the scam email has been verified and shows no transactions to date. This suggests that the scammer’s attempt to extort money may not have been successful yet. It is also possible that the scammer is using this address as part of a broader campaign, hoping to intimidate multiple victims into making payments. The absence of transactions does not diminish the threat, as such tactics are designed to exploit fear and urgency. Verifying cryptocurrency addresses can provide insights into scam campaigns, and reporting them helps prevent potential victims from falling into the trap.

Final Thoughts

Scam emails like “Your account has been hacked. You need to unlock” prey on fear and lack of technical knowledge. Staying calm, taking practical steps, and understanding how these scams operate can protect you from falling victim. Always prioritise account security, and never hesitate to report scams to the authorities. Stay safe online!