Author: KL3FT3Z
Date: July 31, 2026
Tags: phishing, redteam, cybersecurity, email-security, osint
🇬🇧 English Version
TL;DR: Someone sent me a cPanel verification phishing email from a China Telecom residential IP, using a compromised WordPress site with a URL path that looks like a cat walked across the keyboard. Spam score: 8.3/10. This is not an APT. This is not even a PT. This is a cry for help.
The Delivery
Last Friday, my inbox received a love letter. The subject line screamed urgency: "Verify your b0x@hackteam.red Email Address". The sender? noreply@hackteam.red — a classic envelope-from/header-from mismatch with a display name of support_admin@hackteam.red.
Nothing says "I am a legitimate system administrator" like sending yourself an email from yourself to verify yourself.
Header Forensics: A Disaster in Slow Motion
Let's pop the hood and look at what the mail server actually saw:
Return-Path: <noreply@hackteam.red>
Received: from 059188005118.ctinets.com ([59.188.5.118])
by mx1.example.com with esmtp (Exim 4.95)
From: "support_admin@hackteam.red" <noreply@hackteam.red>
X-Spam-Score: 8.3 (++++++++++)
X-Spam-Report:
VIOLATED_DIRECT_SPF(3.50)
RBL_SPAMHAUS_CSS(2.00)
BAYES_SPAM(1.69)
SUBJECT_ENDS_SPACES(0.50)
MIME_HTML_ONLY(0.20)
ONCE_RECEIVED(0.20)
RCVD_NO_TLS_LAST(0.10)
DMARC_POLICY_SOFTFAIL(0.10)
Translation for non-mail-nerds: This email failed virtually every authentication mechanism known to mankind. SPF softfail, DMARC softfail, no DKIM, no TLS on the final hop, and a single Received header that traces back to 59.188.5.118 — a China Telecom Hong Kong residential/broadband IP with a reverse DNS that looks like a barcode.
If you're going to spoof a domain, at least try to pass SPF. This is like showing up to a bank robbery wearing a name tag with your real name and forgetting to wear pants.
The Infrastructure: rapidcollections.com
The payload lives here:
https://rapidcollections.com/wp-includes/wewewewewewjhdghjkklaslkjhd/b%20b%20d/webmail-cpanel/#?email=b0x@hackteam.red
Let's dissect this masterpiece:
| Component | Analysis |
|---|---|
| Domain |
rapidcollections.com — likely a legitimate small business site, now compromised |
| Path |
/wp-includes/wewewewewewjhdghjkklaslkjhd/ — The attacker couldn't be bothered to generate a realistic directory name. This is what happens when you let a Markov chain name your C2 path. |
| Sub-path |
/b%20b%20d/ — URL-encoded spaces. Professional. Very stealthy. |
| File |
webmail-cpanel — Impersonating cPanel webmail. Original. |
| Anchor |
#?email=b0x@hackteam.red — The only "personalization" in the entire campaign. They scraped a public email and injected it into a hash fragment. |
This is a textbook compromised WordPress site. The attacker gained access (likely via vulnerable plugin, weak admin password, or nulled theme) and dropped a phishing kit into wp-includes — a directory that should never serve HTML to users. WordPress compromises for phishing hosting are so common that Rapid7, Sucuri, and Patchstack publish monthly reports about them.
The phishing kit itself is a lazy cPanel clone with inline styles from 2005, quoted-printable encoding artifacts, and an urgent orange CTA button that screams "CLICK ME BEFORE YOUR BRAIN TURNS ON."
Red Team Scorecard
| Criterion | Score | Commentary |
|---|---|---|
| Deliverability | 2/10 | Caught by everything. Spam score 8.3 is impressive... in the wrong direction. |
| Authentication | 1/10 | Failed SPF, DKIM, DMARC. No TLS. Single hop from a residential IP. |
| Infrastructure OpSec | 2/10 | China Telecom residential IP. Compromised WordPress. No CDN. No fronting. |
| URL Quality | 2/10 |
/wewewewewewjhdghjkklaslkjhd/ is not a path. It's a seizure. |
| Pretext | 4/10 | "Verify your email" is classic, but zero adaptation to the target. |
| Visual Fidelity | 3/10 | Table-based layout, inline styles, MSHTML generator meta tag. Nostalgic. |
Total: 14/60 — F
This wouldn't pass a first-year red team exercise. I've seen better phishing in my spam folder from "Nigerian princes" who at least proofread their emails.
What a Real Attack Would Look Like
Since we're doing this as a teaching moment, here's how an actual red teamer (or, heaven forbid, a real APT) would execute this:
-
Domain: Register a cousin domain like
hackteann.redorhackteam-red.comwith proper SPF/DKIM/DMARC records. Age it for 30 days. Warm it up with legitimate-looking traffic. - Infrastructure: Send via a compromised Microsoft 365 tenant or a reputable ESP with a warmed-up IP. Use Cloudflare or Azure Front Door for the landing page. No residential IPs in headers.
-
URL:
https://webmail-hackteam-red.com/verify?token=<random>— clean path, HTTPS, valid certificate, no spaces, no keyboard-mashing. - Pretext: Adapt to the target. If the victim has GitHub activity, send a fake "Suspicious sign-in attempt" from GitHub. If they use AWS, send a fake billing alert. Context is king.
- Content: Use the actual brand's CSS. Mirror the real login page pixel-for-pixel. Add a legitimate-looking footer with real addresses. Include a plaintext version to avoid MIME_HTML_ONLY flags.
- OpSec: Use multiple hops. Strip identifying headers. Use bulletproof hosting or compromised legitimate infrastructure. Rotate domains every 48 hours.
IOCs (Indicators of Compromise)
If you're a defender and see this in your environment, block these:
-
IP:
59.188.5.118(China Telecom HK — residential/broadband pool) -
Domain:
rapidcollections.com(compromised WordPress — monitor for/wp-includes/anomalies) -
URL Pattern:
*/wp-includes/*/webmail-cpanel/* -
Sender Pattern:
noreply@<target-domain>with display namesupport_admin@<target-domain> -
SpamAssassin Rules Triggered:
VIOLATED_DIRECT_SPF,RBL_SPAMHAUS_CSS,BAYES_SPAM,MANY_INVISIBLE_PARTS
Conclusion
This email is not a targeted attack. It's not APT. It's not a true hacktivism crew. It's a commodity phishing kit deployed by someone with access to a cheap botnet and a compromised WordPress site. The only "advanced" part is the attacker's ability to copy-paste an email address into a URL parameter.
To the operator behind this campaign: I appreciate the effort, I really do. But next time, maybe run your phishing kit through a spell checker, a URL beautifier, and a basic SPF validator. Also, wewewewewewjhdghjkklaslkjhd is not a directory name. It's what happens when you fall asleep on your keyboard.
Stay safe. Verify your SPF records. And please, for the love of all that is holy, patch your WordPress plugins.
KL3FT3Z is a certified penetration tester and red team operator. When not breaking things professionally, he writes about people who break things unprofessionally.
Top comments (2)
Fun post-mortem, but it raises an interesting question: what if some of this apparent incompetence is actually part of the campaign economics?
Similar to the classic “Nigerian prince” pattern, an obviously suspicious email may filter out security-aware users before the operator spends time on them. Anyone who proceeds despite the broken SPF, strange URL, poor branding, and spam warnings is probably a much higher-conversion target for the next stage. In that model, maximizing deliverability or visual fidelity may matter less than minimizing wasted effort.
There is also a useful distinction between delivery sophistication and backend sophistication. The email and landing page can be terrible while the credential collection, victim classification, account takeover, or resale pipeline behind them is relatively organized.
Did you get a chance to fingerprint the phishing kit itself—JavaScript endpoints, form handlers, Telegram bot tokens, panel paths, reused assets, or infrastructure overlaps? My hypothesis would be that the keyboard-smash directory is disposable noise, while the backend may connect this “amateur” attempt to a much larger commodity phishing operation.
I also suspect this is part of something much bigger; Lazarus-or actors mimicking Lazarus-have already tried to phish me three times. We’ll see if the story develops further or if it’s just a script kiddie messing around. I took a look at the domain and the site-it’s a really poorly made, shoddy phishing page designed to lure in users. I didn’t dig any deeper, though, since I don’t currently have access to the local virtual machines needed for that kind of analysis.