A group we named Bizmakers recently launched dozens of small-business websites. Each one hid a set of credential and one-time-passcode theft pages on innocent-looking subdomains.
This story starts with a florist
Ivy Glen Florist of Louisville, Kentucky, to be exact. Their site has a home page, an About page, a Bouquets page, a Weddings page, and a Contact page. It has an “Order Flowers” button in the top right, a cookie consent banner with links to the cookie policy and privacy policy, a local phone number, and some photography. It looks pretty much like any small business website on the internet. Nothing to see here.
Ivy Glen Florist doesn’t sell flowers, or even exist outside the website. Neither does Emberforge BBQ in Austin, or Bramble Path Vet in Boise. They are part of a set of several dozen fabricated businesses, registered in batches of about a dozen at a time, built by a threat actor for one purpose: to give a phishing kit somewhere to hide. This infrastructure impersonated at least two dozen financial institutions, including banks, credit unions, and investment firms.
The camouflage contained patterns, but you needed to know where to look
“From first consultation to finished results, Ivy Glen Florist delivers florist you can count on.” “Our weddings page highlights how Ivy Glen Florist supports clients who need clear guidance on florist.”
Those are just a couple of the several templated phrases written for a service name to be substituted in, just like an old-school mail merge. When the generator produced them, it left the same artifacts again and again. Every site in the set opens with an identical welcome modal reading “Limited-time offer for new clients this month. Book now and save on your first visit.” A barbecue restaurant and a veterinary clinic ran that same offer, differing only in whether the button said “Order BBQ” or “Book a Visit.”
These weren’t compromised legitimate businesses, which is a common pattern. They were invented, and inventing them took real work: a business name, a city, a category, a color palette, a plausible phone number, and a registrant identity for each domain. That effort went into the operation because it created an air of legitimacy that would make an analyst mark the sites as benign. Because of the pattern of making up businesses, we named this campaign Bizmakers.
The phishing kit lived on a subdomain
The fake business occupied the domain root. The kit sat on a subdomain but rendered only on specific paths, one of which referenced a click from a Microsoft platform, /?msclkid=, another was /verify/. While we never directly observed an ad or SEO-optimized link from Bing pointing to these sites, we received confirmation that at least one victim reached this attack via that path.
When you hit the right URL, you got a copy of a widely deployed online banking login interface. It pulled the real platform’s stylesheets and web components, then rebranded them to the target bank, credit union, or investment firm. After data collection, a final redirect sent the visitor to the victim institution’s real website.
The rebrands were sloppy. Leftover names from other financial institutions were still sitting in the page source, unreplaced. That’s an obvious reused-template fingerprint, and a useful one: the pattern identifies the kit independent of the brand it happens to be wearing, and shows that the kit had already been pointed at other targets. The operator just changed some brand references and missed others.
The backend
Two endpoints were running the show.
/send.php is the exfiltration sink. A GET request returns HTTP 200 with an empty body and sets a fresh PHPSESSID on every hit, the signature of a session-backed handler that only acts on POST. It was keyed on a type parameter: type 1 carried the username and password, type 2 carried the victim’s choice of passcode delivery channel (call, text, or email), and type 3 carried the one-time passcode itself.
/pixel.php has the same signature but a different job. The victim’s browser polled it once per second. We assessed that a human operator wrote a success or error value into the session to advance the victim to the next step or bounce them back with a failure message.
A human was watching each victim in real time
Those two endpoints, plus a session cookie, make this an adversary-in-the-middle attack, commonly called AitM, rather than ordinary credential harvesting.
The sequence works because an operator is present. Credentials arrive at the exfiltration endpoint. The operator enters them at the institution’s real login page. That triggers the institution to send a genuine passcode to the customer through the channel just selected on the fake page. The customer then types it into the phishing page. The operator grabs it and uses it while it’s still valid. Multi-factor authentication completes successfully, and the attacker gains the authenticated session. The one-second polling loop exists so a person can drive the handoff while the victim waits on a spinner.
This is the same outcome as OAuth phishing and device code abuse, reached by a cruder route. It’s also the same category of kit documented in TyKit, with a manual console (TyKit had automation).
One thing we couldn’t recover: the harvested data itself. It left the server out of band, to a chat channel, an email address, or a remote database. We probed more than twenty likely leak paths at both the kit directory and the web root, including backup and editor-swap variants of the exfiltration script, kit archives, exposed version control configuration, and the usual credential sinks. Each returned a 404, and no directory index was open anywhere. This was a moderately careful operator who left no easily world-readable victim data behind.
The tip that connected the dots
We didn’t start with the full picture, and we didn’t get there alone.
Our partners at the National Credit Union ISAO reached out. They had begun uncovering a campaign built around a single registrant email address, and they wanted to collaborate to find the phishing sites behind it. We started working on it together right away.
The first thing that collaboration produced was recognition. We had already seen part of this. Pages from the campaign were sitting in our own detection data as individual findings, with little to indicate they belonged to anything larger. On their own, they were a few unremarkable detections. Paired with a credible signal that a campaign of real scale was running behind them, they became a key starting point.
That is when the dots started to connect. NCU-ISAO had a registrant email address and reason to believe the footprint was wide. We had confirmed phishing pages and the infrastructure metadata underneath them. Neither half was the campaign. Together, they were enough to pivot on, and that pivot produced the big picture.
How we found the rest of the campaign
Working from that combined starting set, the metadata showed a consistent shape. Every domain sat under .us, and every one was registered through the same registrar, Dynadot. All of them used Cloudflare nameservers, and because Cloudflare assigns each account its own distinctive nameserver pair, the pairs told us we were looking at several separate accounts rather than one. Every site resolved to the same hosting provider, ServerAstra.
That last fact turned into a search. We enumerated .us domains resolving inside the network ranges we had identified for that provider, looked for the fabricated-business pattern, and pulled the registrant on every match. Then we pulled every other domain that registrant had ever registered, and ran the same check on those. Each pass surfaced new domains, and new domains surfaced new registrants.
The registrant details were fabricated, each persona paired with its own Gmail address. We identified more than ten distinct personas across the campaign, which is what let the pivot loop keep running. The identities were fake, but they were reused, just the kind of link we were hoping to find.
The domain name was never going to give them away
Name-based detection had nothing to work with here. There was no typosquat, no homoglyph substitution, no combosquatting, no brand string anywhere in any of these domains. A monitor watching registration feeds for lookalike domains sees a florist in Louisville and moves on, correctly, by its own logic.
Domain reputation had nothing either. The sites were live, functional, and not malicious at the root. The phishing was several levels down, only on a subdomain with a path that nothing links to and no crawler can find on its own.
This is a failure mode that peer-reviewed research has already quantified. Analysis of phishing attacks at scale from USENIX Security found that 28.7% of credential phishing URLs contain no deceptive content in the domain name at all, and that a median nine-hour gap separates a phishing site going live from detection, by which point 62.73% of the victims who will be compromised already have been. Bizmakers is what the far end of that distribution looks like, because they built for stealth deliberately. For the banks, credit unions, and investment firms being impersonated, this is bank phishing that traditional detection was never designed to find.
What actually surfaced this campaign was the page itself. Phishing detection at the content layer, rather than the domain layer, is what made the difference. Allure Intelligence evaluates what a page is rather than what its domain is named: the institution’s full branding pattern, its colors, copy, layout, and design language, paired with live data collection. That combination is the signal. The metadata then clustered everything else around it. It’s the same detection thesis behind living off trusted sites and the domain age myth, applied to infrastructure that looks uninteresting instead of compromising an existing trusted site. It’s also why “check the domain” is no longer sufficient advice: the domain here was clean, the site was functional, and the phishing was invisible to anything that stopped at the domain layer.
Ten takedowns ended it
Our SOC Team issued phishing takedowns against about a dozen of the domains. Within a few hours the entire campaign went dark.
That ratio is the interesting part. Disrupting a fraction of the footprint collapsed the whole operation. We speculate that the reason is the concentration the group accepted in order to get its camouflage. One registrar, one top-level domain, one hosting provider, one generator, and one moderately sized pool of reused registrant personas. Once the pattern was documented, the whole thing was enumerable. Since the fabricated businesses were the costly component to set up, standing up two dozen more of them with fresh identities is a rebuild, not a redeploy. That said, we will not be surprised if the same group tries this again on different infrastructure or a different pattern. Perhaps they already are.
Compare that to the Tycoon 2FA disruption, where 330 seized domains returned to baseline volume within days. That operation sold subscriptions, and its infrastructure was designed to be disposable. Bizmakers invested in infrastructure designed to be believable, and believable infrastructure is expensive to replace.
The Bottom Line
Bizmakers spent its real effort on the half of the operation nobody would care about watching. The phishing kit was a borrowed template with other institutions’ names still sitting in the markup, while the camouflage around it was built domain by domain, persona by persona. Any program that decides what to investigate based on whether a domain name, or its contents, resembles the brand will keep missing this, because the resemblance was never there to find. It also took two parties comparing notes to see the shape of it: a registrant address from NCU-ISAO on one side, confirmed phishing pages and infrastructure metadata on ours. The question worth asking of your own detection and takedown coverage isn’t how many lookalike domains it caught last quarter. It’s whether it would have flagged a florist.
Key Takeaways
An adversary-in-the-middle (AitM) phishing attack relays a victim’s credentials and one-time passcode to the real login page in real time, rather than simply storing them for later use. Because the passcode is used inside its validity window, multi-factor authentication completes normally, and the attacker ends up holding an authenticated session. In the Bizmakers campaign, this relay was driven manually: the victim’s browser polled a status endpoint once per second while a human operator advanced or rejected each step.
Bizmakers registered ordinary business domains, built complete websites with navigation, policies, contact details, and photography, and placed the phishing kit on a subdomain under a path nothing links to. We call this approach legitimacy stacking. The domain root serves a functioning business site to anyone who visits it, which means casual inspection, reputation scoring, and registration-feed monitoring all return a clean result.
Lookalike domain monitoring matches new registrations against brand names, looking for typosquats, homoglyph substitutions, and combosquatting. Bizmakers domains contained no brand strings at all, so there was nothing to match. USENIX Security research found that 28.7% of phishing URLs contain no deceptive content in the domain, meaning name-based phishing detection is structurally blind to a large share of phishing infrastructure.
A campaign built to look unremarkable rarely reveals itself to one observer. In the Bizmakers case, NCU-ISAO surfaced a single suspicious registrant email address and suspected a larger campaign behind it, while Allure already held confirmed phishing pages from the same operation that had not yet been linked. Neither view was the campaign on its own. Combining them gave both sides enough to pivot from, and the enumeration that followed produced the full footprint.
