This Criminal Will Think Twice Before Scamming Again 🗝️🔒

I don’t know about you, but lately it seems like scam messages are chasing me. One after another, trying to sneak into my inbox to steal my banking details. This time, I got one so shabby I couldn’t resist. Mind you, first of all, I’ve censored the URL in the image, I’m not giving these thieves a shred of publicity.

Normally, I ignore these things. Block and move on. But that spark of curiosity (and a bit of spite, let’s be honest) made me think: What if I investigate a little more? So, with my Sherlock vein turned on, I got down to work in a safe environment, of course.

The first surprise: It doesn’t work on PC? What a trick!

When opening the URL from the computer… nothing, zero, page down. “Wow!”, I thought, “they beat me to it and the site is already taken down”. But something didn’t add up. I had a gut feeling, so I tried entering from my mobile.

Bingo! The page worked perfectly from the mobile.

This was getting interesting. It turns out these evil geniuses had configured the web so that, if it detected you were entering from a computer, it would return a nice 404 error. But from the mobile, the scam was still running full throttle.

Ingenious, huh? Now it wasn’t just curiosity, it was a challenge. And I wasn’t going to stop until I discovered how they had done it.

The master plan (or so I thought at first)

The first step was clear: simulate that my PC was a mobile. I changed the user agent to pass myself off as an iPhone and… 404 again. Okay, the game was getting serious.

I tried everything: First simple scripts with Playwright,

const { webkit } = require('playwright');

(async () => {
  const browser = await webkit.launch();
  const context = await browser.newContext({
    viewport: { width: 375, height: 812 },
    userAgent: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148"
  });
  const page = await context.newPage();
  await page.goto('https://url.com/');
  console.log(await page.content());
  await browser.close();
})();

But nothing…

Then with mobile proxies with BrightData, I gave it a chance because I had a free trial

const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');

// Activate stealth mode to avoid bot detections
puppeteer.use(StealthPlugin());

(async () => {
  // Configure the proxy with your credentials
  const PROXY_SERVER = 'https://brd.superproxy.io:9222'; // Proxy address
  const PROXY_USERNAME = '';
  const PROXY_PASSWORD = '';

  // Initialize the browser with the configured proxy
  const browser = await puppeteer.launch({
    headless: false, // To see the browser in action. Change to true to hide it.
    ignoreHTTPSErrors: true,
    args: [
      `--proxy-server=${PROXY_SERVER}`,
      '--no-sandbox',
      '--disable-setuid-sandbox',
      '--disable-dev-shm-usage',
      '--disable-accelerated-2d-canvas',
      '--disable-gpu',
      '--allow-insecure-localhost',    // Allows insecure SSL on localhost
      '--ignore-certificate-errors',   // Ignores certificate errors
      '--ignore-certificate-errors-spki-list'  // Ignores HSTS and SPKI
    ]    
  });

  const page = await browser.newPage();

  // Authentication in the proxy
  await page.authenticate({
    username: PROXY_USERNAME,
    password: PROXY_PASSWORD
  });

  // Configure the User-Agent to simulate an iPhone
  await page.setUserAgent("Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148");
  await page.setViewport({ width: 375, height: 812 });

  // Navigate to the desired URL
  await page.goto('https://malicious web', { waitUntil: 'networkidle0' });

  // Wait a few seconds for dynamic content to load
  await new Promise(resolve => setTimeout(resolve, 5000));

  // Get the HTML of the page content
  const content = await page.content();
  console.log(content);

  // Save the content to an HTML file for analysis
  const fs = require('fs');
  fs.writeFileSync('abanca-page.html', content);

  // Close the browser
  await browser.close();
})();

And it didn’t work either…

I even got into BrowserStack to simulate a connection from an iPhone in the cloud (damn free tier that didn’t let me use the iPhone!). Nothing worked. These guys had done a fine job.

I was about to give up when I thought: What if I analyze the requests from my own mobile? Bingo. That was the key.

Capturing the trail with a proxy (spy level activated)

The idea was simple: use a proxy to intercept my mobile’s requests and see what on earth was happening there.

I installed mitmproxy and configured it on my iPhone.

To install it I used

brew install mitmproxy

and started its web version

mitmweb

I could have made a script to capture the web I wanted, but it wasn’t necessary, with the web version I had enough.

To configure it on the iphone it was simple, first I connected to the proxy from the wifi settings (it is important to be on the same network) and then I installed the mitmproxy ssl certificate itself

After some adjustments and installing the mitmproxy SSL certificate on the mobile, I managed to see all the requests the web was making.

It was like seeing a treasure map! Every call, every cookie, every check they made to verify I was a “legitimate” user. I even discovered by looking at the headers that they were using Cloudflare to validate the mobile device with a quite curious CSRF system.

The trick? They relied on a challenge to verify if you were human and, from what I saw, also to check if you were a real mobile.

Here I leave you a video of how I was capturing the requests while sending fake data to the attackers from the mobile

The counterattack: Trolling the scammers

With all the information in hand, I got down to work to teach them a lesson. I used the cookies I had captured and replicated them in a script to send them false, but valid records, thus creating a useless database full of invented data.

I sent them:

• Valid IDs (but that didn’t exist)
• Random passwords
• Fake phone numbers
• And best of all, I filled in a field where they asked for “amount of income” with totally random numbers, so they would get confused calculating the “loot”.

Result? A database full of garbage records that, hopefully, will have annoyed them quite a bit.

And so you see I behave well I leave you the code in case you are curious to see how I and my friend chatgpt did it

GitHub - edunavajas/breaking-malicious-website

Moral (and important warning)

I tell you all this for pure fun, but careful, I do not recommend you do this at home. Entering malicious websites and tinkering can be very dangerous, both for your security and your legality.

If you encounter an online scam, the best thing is to report it. Here I leave you a couple of useful links where I have already reported this site:

• Collaborate with the Police
• Report phishing in Google Safe Browsing

Final reflection: Cybercriminals also innovate (and we must be one step ahead)

The truth is that it was a curious experience. It reminded me that scammers are not left behind and are constantly evolving their methods. Who would have thought they would block access from PC but leave mobile open? Ingenious, yes, but not enough.

This made it clear to me that, to protect ourselves, we have to stay informed and always be one step ahead.

I hope my adventure has served as a warning and, why not, for a laugh. You know, be careful out there!

PS: Yes, ChatGPT helped me with some ideas, but the fun was all mine. 😜

💡You might also like

30 Apr 2025

¿Qué son los servidores MCP? La evolución de la IA en 2025

13 May 2025

Bloquea TODOS los Anuncios de tu Red (¡Incluso sin Raspberry Pi!) | Tutorial AdGuard

27 Sept 2024

No vuelvo a escribir un commit nunca más 🥸