UNCLASSIFIED // TLP:AMBER TLP:AMBER
SMISHING-ZOYIOSHO-2026-0310

Smishing Threat Actor Investigation

zoyiosho.my.id — Phishing-as-a-Service Campaign Analysis
Date: 2026-03-10 Engine: CorvusEngine v2.0.0 Analyst: CorvusPrime v2.1.0 Classification: UNCLASSIFIED // TLP:AMBER
1 — Executive Summary
0.82
Confidence Score
3
Encryption Layers
7
Domains Found
11
ATT&CK Techniques
70%
Attribution Conf.
22
Tools Deployed

A smishing campaign using the domain zoyiosho.my.id was identified distributing phishing links via Twitter/X t.co shortener, targeting Spanish mobile users (CF-Ray Madrid PoP).

The phishing kit employs three layers of encryption (AES-128-GCM, custom PRNG-XOR-ROT cipher with eval(), XOR form data) and presents a fake CAPTCHA UI ("Polite Hold in Place") as Stage 1 before credential harvesting. The backend is Laravel PHP on cPanel shared hosting at PT Beon Intermedia (Indonesia, AS55688) behind Cloudflare reverse proxy (AS13335).

Infrastructure and TTP analysis points to a Smishing Triad / Lighthouse PhaaS affiliate with 70% attribution confidence. The group operates a $200/month Phishing-as-a-Service platform responsible for 194,000+ domains across 121 countries with estimated revenue exceeding $1 billion.

CAMPAIGN ACTIVE equity.zoyiosho.my.id
2 — Attack Flow
Kill Chain — 11 Steps
1
SMS Received
Victim receives smishing SMS on mobile device with shortened link
2
Twitter/X Shortener
https://t.co/in5dy63sCm — URL shortener abuse for legitimacy
3
JS Redirect
location.replace() + <noscript> meta refresh fallback
4
HTTP Landing
http://zoyiosho.my.id/PiLcgSf@L86IDXnT/ — @ symbol for URL parser confusion
5
307 HTTPS Redirect
Cloudflare upgrades to HTTPS via temporary redirect
6
Active Phishing Page
https://equity.zoyiosho.my.id/PiLcgSf@L86IDXnT/ — HTTP 200, Laravel backend ACTIVE
7
Client-Side Decryption
AES-128-GCM decryption via Web Crypto API — 13,182 bytes → 9,270 bytes plaintext
8
Fake CAPTCHA Display
"Polite Hold in Place" — card UI mimicking Cloudflare/hCaptcha verification with SSL/v3.0 badges
9
User Interaction
Click checkbox → spinner (0.9s) → checkmark animation → "Verified Successfully" + progress bar
10
Campaign ID Exfiltration
XOR-encrypted campaign identifier submitted via hidden POST form (form id: tu0, field: yd6)
11
Stage 2: Credential Harvester
Laravel backend processes POST → serves credential harvesting form (not yet captured)
3 — Phishing Kit Analysis
Triple-Layer Encryption
Layer 1 — Outer
AES-128-GCM — Full Page Encryption
Encrypts the entire phishing page HTML. Prevents static analysis by WAF, antivirus, HTTrack, wget.
Key: wUgGAWmO35BkVktQXe3cfA==
IV: px89rtFJcpVi32Xl
Tag: /OxuIekfNAuwb68CMpWuvA==
Ciphertext: 9,272 bytes → Plaintext: 9,270 bytes
Layer 2 — Inner
Custom PRNG-XOR-ROT Cipher → eval()
Anti-analysis JavaScript payload. Bot detection, DevTools traps, debugger timing.
Seed: 321103 — Formula: (seed * 9301 + 49297) % 233280
Hash: 791c3e2e
Executes via Symbol.toPrimitive → eval() chain
Layer 3 — Form
XOR with MD5 Key — Campaign Identifier
Campaign/session ID encrypted before POST submission.
XOR Key MD5: 1d5abbdd7e22c041d7f6c51f07e9b57d
Decrypted Value: 23798794727476c48ab0369c83cb532b
Anti-Analysis Techniques (9 Detected)
  • AES-GCM encryption of entire page content
  • Custom PRNG cipher for eval'd JavaScript
  • Bot detection: navigator.webdriver, window.callPhantom, window._phantom
  • Puppeteer detection: User-Agent contains purp
  • DevTools detection: F12, Ctrl+Shift+I/J/C/K, Ctrl+U disabled
  • Right-click context menu disabled
  • Debugger timing trap: setInterval + performance.now()
  • Anti-analysis redirect to alibaba.com on detection
  • XOR encryption of form POST data with MD5 key
Fake CAPTCHA UI Details
Visual Design
  • Title: Polite Hold in Place
  • Heading: "Continue now"
  • Prompt: "Please verify to continue to the protected resource"
  • Checkbox: "Show you're human"
  • Badges: SSL, v3.0
  • Footer: "This step helps keep automated bots away from the site"
  • Width: 320px (mobile-optimized card)
Interaction Sequence
  • 1. Page loads with random Y offset
  • 2. User clicks checkbox
  • 3. Spinner animation (0.9s)
  • 4. Checkmark + "Verified Successfully"
  • 5. Progress bar fills to 100%
  • 6. Hidden form submits after 3s delay
  • 7. POST to Laravel backend (same URL)
4 — Infrastructure Map
Network Topology
flowchart TD
    V["Victim
Spanish mobile user"]
    SMS["SMS Smishing
Delivery vector"]
    TCO["t.co Shortener
Twitter/X"]
    CF["Cloudflare Proxy
AS13335 · Madrid PoP"]
    DNS["Cloudflare DNS
reza.ns / sid.ns"]
    ORIG["Origin Server
cPanel/Apache"]
    HOST["PT Beon Intermedia
AS55688 · Surabaya, ID"]

    V --> SMS
    SMS --> TCO
    TCO -->|"JS redirect"| CF
    DNS -.->|"wildcard A"| CF
    CF -->|"reverse proxy"| ORIG
    ORIG --- HOST

    classDef victim fill:#d4a73a22,stroke:#d4a73a,stroke-width:2px
    classDef delivery fill:#3d9ebe22,stroke:#3d9ebe,stroke-width:2px
    classDef infra fill:#e0525222,stroke:#e05252,stroke-width:2px
    classDef origin fill:#e0904022,stroke:#e09040,stroke-width:2px
    classDef dns fill:#3db87822,stroke:#3db878,stroke-width:1.5px

    class V victim
    class SMS,TCO delivery
    class CF infra
    class DNS dns
    class ORIG,HOST origin
Subdomains Discovered (7)
  • equity.zoyiosho.my.id ACTIVE PHISHING
    Banking/financial theme, Laravel cookies
  • colab.zoyiosho.my.id CF FLAGGED
    Google Colab impersonation
  • www.equity.zoyiosho.my.id ALIAS
  • cpanel.zoyiosho.my.id MGMT
  • mail.zoyiosho.my.id UNUSED
  • webmail.zoyiosho.my.id UNUSED
TLS Certificates
  • Google Trust Services WE1 (Current)
    CN: zoyiosho.my.id + *.zoyiosho.my.id
    Valid: 2026-03-04 → 2026-06-02
    ECDSA P-256, Wildcard
  • Let's Encrypt R12 (Origin/cPanel)
    CN: cpanel.zoyiosho.my.id + 8 SANs
    Reveals cPanel shared hosting origin
    SHA256: 32F12D3B...
  • Let's Encrypt E7 (t.co delivery)
    CN: t.co — TLS 1.3, AES_128_GCM
DNS Configuration
A: 188.114.96.5, 188.114.97.5
AAAA: 2a06:98c1:3120::5, 3121::5
NS: reza.ns.cloudflare.com, sid.ns.cloudflare.com
SOA: reza.ns.cloudflare.com (serial: 2398331862)
HTTPS/SVCB: h3, h2, ECH enabled
Wildcard DNS: YES — ALL subdomains resolve
MX/TXT/SPF/DMARC/DKIM: NONE
DNSSEC: UNSIGNED
5 — Domain Intelligence
Property Value
Domainzoyiosho.my.id
Registry ID19108480_DOMAIN_ID-ID
RegistrarPT Beon Intermedia / JagoanHosting
Created2026-01-03 23:58:28 UTC
Updated2026-01-04 16:09:15 UTC
Expires2027-01-03 23:59:59 UTC
DNSSECUNSIGNED
TLD AbuseHIGH RISK .my.id — #1 most abused SLD in Indonesia (1,215+ abuse cases Q3 2024). Free registration available.
Registrar Abusecare@jagoanhosting.id / abuse@jagoanhosting.com
Technical ContactFarid Rahman (om.team@jagoanhosting.com)
Hosting ASNAS55688 — 23 IPv4 prefixes, 5,888 addresses
Spam Rate1.85% (13/701 active IPs)
Abuse TrendESCALATING 20 events Feb 2026, 17 in March 2026
BGP AnomalyAS55688 announces bogons (abnormal BGP behavior)
LocationJl. Jemur Andayani 50, Surabaya, Indonesia
6 — MITRE ATT&CK Mapping (v15)
TA0042
Resource Development
T1583.001 Acquire Infrastructure: Domains
T1583.003 Acquire Infrastructure: VPS
T1608.005 Stage Capabilities: Link Target
T1588.006 Obtain Capabilities: Web Services
TA0001
Initial Access
T1566.002 Phishing: Spearphishing Link
TA0002
Execution
T1204.001 User Execution: Malicious Link
TA0009
Collection
T1056.003 Input Capture: Web Portal Capture
TA0005
Defense Evasion
T1665 Hide Infrastructure
T1027.013 Obfuscated Files: Encrypted/Encoded File
T1027.007 Obfuscated Files: Dynamic API Resolution
TA0011
Command and Control
T1102.002 Web Service: Bidirectional Communication
7 — Diamond Model
Adversary
Smishing Triad Affiliate / Lighthouse PhaaS Customer
Chinese-speaking eCrime group (probable). Operating as PhaaS consumer/affiliate rather than core group.
70% CONFIDENCE
Infrastructure
Domain: zoyiosho.my.id + wildcard subdomains
Proxy: Cloudflare (AS13335, Madrid PoP)
Origin: cPanel/Apache shared hosting
Backend: Laravel PHP
Delivery: t.co URL shortener
Registrar: JagoanHosting (AS55688, Indonesia)
Capability
Kit: 3-layer encrypted phishing kit
Stage 1: Fake CAPTCHA / human verification
Anti-Analysis: Bot + DevTools + debugger detection
Evasion: AES-GCM, subdomain rotation, Cloudflare proxy
Campaigns: banking/equity, tech/colab, unknown/PiLcgSf
Victim
Spanish Mobile Users
Targeting: CF-Ray MAD (Madrid), es-ES locale
Delivery: SMS smishing + Twitter/X t.co shortened links
Lure: Fake verification/CAPTCHA page → credential harvesting
8 — Threat Actor Profile
Smishing Triad / Lighthouse PhaaS
Attribution
70% — MEDIUM-HIGH
Origin
Chinese-speaking eCrime
Active Since
2023
Model
PhaaS — $200/month (Telegram)
Scale
194,000+ FQDNs
Root Domains
136,933
Active / 8 days
25,000 domains
Countries
121 targeted
Revenue Est.
$1 billion+ (3 yrs)
Cards Compromised (US)
15–100 million
Legal Actions
Google RICO lawsuit (Nov 2025)
Tool
Lighthouse phishing kit
Matching TTPs (13)
  • Cloudflare DNS proxy usage (34.6% of FQDNs)
  • Cheap disposable TLD (.my.id)
  • cPanel shared hosting as origin
  • Wildcard certificate for subdomain rotation
  • Multiple simultaneous campaign themes (banking, tech)
  • No email infrastructure (web-only phishing)
  • Indonesian registrar infrastructure
  • Spain targeting (CF-Ray MAD PoP)
  • URL path obfuscation with @ symbol
  • AES-encrypted phishing pages (anti-analysis)
  • Fake CAPTCHA/verification UI as first stage
  • Laravel PHP backend
  • t.co URL shortener for delivery
Divergent Indicators (3)
  • .my.id TLD not in documented 187 Smishing Triad TLDs
  • JagoanHosting registrar vs typical Dominet (HK) Limited (68%)
  • Indonesian hosting vs typical Tencent/Alibaba infrastructure

These divergences suggest an affiliate/customer using Lighthouse kit on independent infrastructure rather than core Smishing Triad operations.

9 — Investigation Timeline
Domain Registration
Certificate Issuance
Phishing Activity
Investigation
2026-01-03 23:58 UTC
Domain zoyiosho.my.id registered at JagoanHosting
2026-01-04 16:09 UTC
DNS nameservers pointed to Cloudflare (reza/sid)
2026-01-04 20:20 UTC
cPanel AutoSSL certificate issued (Let's Encrypt R12) — reveals origin hosting
2026-01-04
Wildcard cert + Cloudflare Universal SSL issued
2026-03-04
Subdomain equity.zoyiosho.my.id first observed (AlienVault OTX)
2026-03-04
Cloudflare Universal SSL certificate renewed (Google Trust Services WE1)
2026-03-07
Subdomain colab.zoyiosho.my.id first observed
2026-03-07
New Let's Encrypt E8 wildcard certificate issued
2026-03-08
equity.zoyiosho.my.id last observed in OTX
2026-03-10 14:56 UTC
HTTrack mirror attempt failed (SSL error)
2026-03-10 18:37 UTC
URLscan scan via t.co shows 404 on apex domain
2026-03-10 19:16 UTC
CorvusEngine investigation — Cloudflare phishing interstitial on root domain
2026-03-10 19:25 UTC
URLscan confirms HTTP 200 on equity subdomain with Laravel ACTIVE
2026-03-10 19:29 UTC
Phishing page downloaded from equity subdomain (13,182 bytes encrypted)
2026-03-10 19:30 UTC
AES-GCM payload decrypted — fake CAPTCHA page with anti-analysis revealed
2026-03-10 19:35 UTC
Inner eval() payload decrypted — bot detection + DevTools traps identified
10 — Indicators of Compromise
Type Value Context
DOMAINzoyiosho.my.idPrimary phishing domain
DOMAINequity.zoyiosho.my.idACTIVE phishing subdomain (banking)
DOMAINcolab.zoyiosho.my.idPhishing subdomain (Google Colab)
DOMAINwww.equity.zoyiosho.my.idSubdomain alias
DOMAINcpanel.zoyiosho.my.idHosting management panel
DOMAINmail.zoyiosho.my.idMail subdomain (unused)
DOMAINwebmail.zoyiosho.my.idWebmail subdomain (unused)
IPv4188.114.96.5Cloudflare proxy (AS13335)
IPv4188.114.97.5Cloudflare proxy (AS13335)
IPv4188.114.96.3Cloudflare proxy alt (URLscan)
IPv4104.21.20.103Historical Cloudflare (theHarvester)
IPv4172.67.192.85Historical Cloudflare (theHarvester)
IPv62a06:98c1:3120::5Cloudflare proxy (IPv6)
IPv62a06:98c1:3121::5Cloudflare proxy (IPv6)
URLhttps://zoyiosho.my.id/PiLcgSf@L86IDXnT/Primary phishing URL (404)
URLhttps://equity.zoyiosho.my.id/PiLcgSf@L86IDXnT/Active phishing URL (200)
URLhttps://t.co/in5dy63sCmDelivery vector (Twitter/X)
CERT10E2A1644E72B364117FF7535276D310Cloudflare Universal SSL serial
CERT06E50BF736B0A1754E38241FEF5EEF3CF0B4cPanel AutoSSL serial (origin)
SHA25632F12D3BA5C15D2F42F94425EFC35EB97E7E5AB18E501853396BA40646E3DCDAcPanel cert fingerprint
MD51d5abbdd7e22c041d7f6c51f07e9b57dXOR key for form encryption
MD523798794727476c48ab0369c83cb532bDecrypted campaign identifier
AES KEYwUgGAWmO35BkVktQXe3cfA==Page encryption key (AES-128)
AES IVpx89rtFJcpVi32XlInitialization vector
NSreza.ns.cloudflare.comAuthoritative nameserver
NSsid.ns.cloudflare.comAuthoritative nameserver
REDIRECThttp://alibaba.comAnti-analysis redirect target
SITEKEY0x4AAAAAABDaGKKSGLylJZFACloudflare Turnstile sitekey
30 IOCs — 7 domains, 7 IPs, 3 URLs, 3 certs, 2 hashes, 2 AES keys, 2 NS, 2 misc
11 — Evidence Files
File Size Description
investigation_zoyiosho.json28 KBComplete investigation JSON report with all findings
DECRYPTED_phishing_page.html9.3 KBAES-GCM decrypted phishing page (fake CAPTCHA)
DECRYPTED_eval_payload.js2.5 KBDecrypted inner JavaScript anti-analysis payload
equity_phishing_page.html13.2 KBRaw encrypted phishing page from equity subdomain
root_page.html5.1 KBCloudflare "Suspected Phishing" interstitial page
tco_redirect.html312 BTwitter/X t.co redirect page source
phishing_page.html355 BInitial page capture (404 response)
headers_equity_phish.txt1.5 KBHTTP headers from active phishing page (Laravel cookies)
headers_phishing.txt494 BHTTP headers from primary phishing URL
headers_root.txt635 BHTTP headers from root domain
headers_tco.txt1.0 KBHTTP headers from t.co shortener
headers_equity.txt643 BHTTP headers from equity subdomain
headers_colab.txt643 BHTTP headers from colab subdomain
urlscan_screenshot_equity.png2.0 KBURLscan.io screenshot of active phishing page
urlscan_screenshot_original.png10 KBURLscan.io screenshot of 404 page via t.co
hts-log.txt1.1 KBHTTrack mirror log (SSL failure)
Location: /home/kali/Desktop/zoyiosho/ — 16 evidence files
12 — Recommendations
Immediate Actions
  • Report t.co link (t.co/in5dy63sCm) to Twitter/X for takedown
  • Report equity.zoyiosho.my.id to Cloudflare abuse portal
  • Report to registrar: care@jagoanhosting.id / abuse@jagoanhosting.com
  • Submit to PANDI/IDADX: idadx.id/report
  • Submit to Google Safe Browsing, PhishTank, URLhaus
  • Flag URLscan scan IDs as confirmed phishing
Next Investigation Steps
  • Complete POST form submission to identify Stage 2 credential harvester
  • Discover origin server IP via SecurityTrails / Censys / Shodan cPanel cert search
  • Search for Twitter/X account that posted the t.co link
  • Analyze Laravel session tokens for additional campaign infrastructure
  • Monitor CT logs for new certificates on *.zoyiosho.my.id
  • Correlate AES key and MD5 hashes with known Lighthouse kit samples
  • Search for other .my.id domains registered at JagoanHosting on 2026-01-03
Detection Signatures
  • Alert on AES-GCM encrypted HTML pages with crypto.subtle.decrypt in source
  • Alert on fake CAPTCHA pages with "Polite Hold in Place" title
  • Block t.co links redirecting to .my.id domains
  • Monitor for Laravel sessions from equity/colab subdomains of .my.id
  • Detect XOR-encrypted form POST values with MD5-structured keys
13 — Intelligence Sources
20 Sources Used
WHOIS (PANDI registry)
DNS (Google + Cloudflare)
crt.sh (CT logs)
AlienVault OTX
RIPE WHOIS
URLscan.io API (2 scans)
Shodan InternetDB
Cloudflare Headers (CF-Ray MAD)
nmap v7.98
wafw00f v2.3.2
WhatWeb
theHarvester v4.9.2
openssl s_client
Python cryptography (AES-GCM)
Silent Push Research
Palo Alto Unit42
KrebsOnSecurity
SecurityWeek
IDADX Statistics
Sublime Security
Kali Tools (16)
dig, whois, nmap, curl, openssl, wafw00f, whatweb, theHarvester, dnsrecon, traceroute, python3, base64, HTTrack, grep, jq, file
Web APIs (6)
URLscan.io, Shodan InternetDB, crt.sh, AlienVault OTX, Wayback Machine CDX, WebSearch OSINT
UNCLASSIFIED // TLP:AMBER
Generated by CorvusEngine v2.0.0 / CorvusPrime v2.1.0
Investigation ID: SMISHING-ZOYIOSHO-2026-0310
7 modules executed · 22 tools deployed
2026-03-10