Overview
During analysis of a phishing URL chain, I observed a fake Cloudflare Turnstile verification page acting as an intelligent traffic filtering gate. Rather than protecting a website, this page selectively blocks, redirects, or allows access based on geolocation, proxy usage, and browser fingerprinting.
This phishing infrastructure demonstrates Traffic Distribution System like behavior commonly used in modern phishing and scam operations to evade security researchers, sandboxes, and automated crawlers while delivering payloads only to high-confidence victims.
Redirection Chain
The Cloudflare page is not legitimate and does not load any official Turnstile JavaScript. Instead, it is a static imitation combined with heavy client side fingerprinting.
Fake Cloudflare Verification Page
The landing page is designed to closely mimic a legitimate Cloudflare interstitial, creating a false sense of trust for the victim. It displays the French language title “Un instant…“, along with Cloudflare style branding and logos to appear authentic. A fake human verification checkbox labeled “Vérifiez que vous êtes humain” is presented, imitating Cloudflare’s Turnstile challenge, despite performing no real validation. The page also shows a fabricated Ray ID, a detail commonly associated with genuine Cloudflare error or verification pages. To further reinforce legitimacy, the attackers include links pointing to real Cloudflare policy and documentation pages, a tactic intended to reduce suspicion and bypass casual scrutiny by users and automated scanners alike.
However, no real Turnstile challenge exists. All logic is client side JavaScript + server side decision APIs, not Cloudflare infrastructure.
Browser Fingerprinting & Bot Detection
Once the page loads, the script silently collects a detailed browser fingerprint, including:
- navigator.userAgent
- navigator.webdriver (Selenium / automation detection)
- Headless browser indicators
- Plugin count and language settings
- WebGL vendor and renderer (VM / sandbox detection)
- LocalStorage and SessionStorage availability
- Timezone information
- Honeypot fields (website, email-confirm) to detect autofill bots
All of this data is packaged and exfiltrated to backend endpoints such as:
/_internal/base/validation/collect_info.php
/_internal/api/dashboard.php
Geo Blocking and Proxy Detection
Using Fiddler with different exit locations, the server’s decision engine responses were captured. These responses clearly show country based blocking and proxy detection logic.
This confirms explicit detection of hosting providers, VPNs, and proxy infrastructure, even when traffic originates from France.
Decoy Redirect Behavior
If a visitor is classified as blocked or suspicious, the page redirects to:
hxxps://www.mediapart.fr
This serves multiple purposes:
- Makes the site appear benign during casual inspection
- Misleads analysts and automated scanners
- Prevents security tools from accessing the real phishing content
Only approved traffic (likely residential French IPs, real browsers) proceeds to the malicious landing page.
Why France?
Several indicators strongly suggest that this phishing infrastructure is specifically oriented toward French users. The landing page content and interface are fully localized in French (fr_FR), indicating deliberate language targeting rather than generic reuse. Access behavior appears to follow a country based allow list model, where visitors from non-French regions are blocked or redirected. When access conditions are not met, the site redirects to a well-known French news outlet as a decoy, helping the infrastructure appear benign during casual checks. Additionally, all CAPTCHA elements and user interface text are presented entirely in French, reinforcing the assessment that this setup is designed to blend seamlessly into a French browsing context and evade suspicion among local users.
Infrastructure Observations
Both domains involved in the redirect chain were newly registered on 2026-01-06.
Detection And Hunting Notes
Defenders should look for:
- Fake Cloudflare Turnstile pages without official Cloudflare JS
- Hidden honeypot form fields
- /collect_info.php or /dashboard.php?action=visit patterns
- Conditional redirects to legitimate news sites
- Different behavior between residential vs proxy IPs
Confirmed malicious phishing traffic distribution system.
This is not a Cloudflare protection page.
It is a selective traffic gate designed to evade analysis and deliver phishing content only to real victims.
Source
