.co.com address, often shaped like [brand][.]co[.]com.Click it and a Cloudflare “Verify you are human” box appears. You check it, and you appear to land on your bank or credit union’s login page. However, if you copy that same address into a fresh tab instead of clicking it, you get a browser error or a parked page for an unrelated business. Click the same Bing result a second time and some of them quietly hand you a bookstore, flower shop, or restaurant site.
This shifting response does two jobs at once. It stays benign for Bing’s crawlers and abuse scanners, which is what keeps it ranked instead of flagged, and it serves the phish to anyone who clicks through from a search. Several pieces have to cooperate for that, and this article walks through each one.
A realistic looking front door
The lure is registered under .co.com. That is not a typo, and it is not a top-level domain. co.com is a privately operated public suffix, in the same family as it.com, uk.com, and ru.com, where the operator has stood up the infrastructure to sell third-level names like yourbrandhere[.]co[.]com through ordinary registrars. The practical consequences are the ones that matter to an attacker. Each [brand][.]co[.]com is independently registrable for a few dollars. At a quick glance, a search-result snippet may visually appear to be a normal .com. And the operator of the suffix is not an ICANN registry, so the usual registry-level abuse obligations do not cleanly apply. For more about public suffixes, and the gray area they can create, see the article Understanding Effective TLDs.
The lure page is also built to rank highly on search engines, and that is a critical part of the operation. View the source and the search-engine optimization is sitting right in the head, the same techniques a legitimate site uses to climb the results:
<meta name="robots" content="index, follow">tells crawlers to index the page and follow its links.- A
schema.org BankOrCreditUnionJSON-LD block provides the engine structured data describing the page as a real financial institution. - OpenGraph and Twitter card tags control the title, image, and description that render in the search and social preview.
<link rel="canonical">points back at the.co.com, consolidating ranking signals on the lure domain.<meta name="msvalidate.01" content="...">, a Bing Webmaster Tools verification tag found on one sample, means the operator proved ownership of the domain in Bing’s own console.
That last item is a big one. The operator registered the domain in Bing’s own webmaster console and provided it structured data to increase its rankings, the same active SEO work a legitimate site would perform. Noticing a trend yet?
That browser error a careful person hits if they paste the address into a fresh tab, rather than clicking the result, is also by design. The back-end web server runs a redirect rule that keeps prepending www. to the host. Browse straight to [brand][.]co[.]com and you get a 302 to www.[brand][.]co[.]com/, then a 302 to www.www.[brand][.]co[.]com//, which resolves to nothing and dead-ends on DNS_PROBE_FINISHED_NXDOMAIN. The kit anticipates the copy-and-paste instinct and breaks it. More on the why below.
The gate
The interstitial page that loads after you click the search result is a gate, and it is selective about who it lets through.
In our own analysis, a request carrying a Bing referrer was served the attack. A request with no referrer was dead-ended. A request whose User-Agent was set to Bingbot was also served, which gives us another piece of the puzzle here.
The referrer check cloaks the page from direct visitors, sandboxes, and researchers who arrive without a Bing click, so the live phish is only ever shown to the audience that matters: people who searched, trusted the ranking, and clicked.
The Bingbot allowance has a different purpose. It grants the Microsoft crawler access so the page can stay indexed and ranked. The gate that hides the attack from security scanners also protects its placement in the results.
This is why a second click sometimes lands you on a book store, flower shop, or restaurant. The kit reveals its real page to you exactly once, and repeat visits get you a decoy site.
"Verify you are human," again
The check itself is a fake Cloudflare Turnstile. The page titles itself “Just a moment…”, renders the “Verify you are human” checkbox, generates a fake Ray ID client-side with Math.random(), and even loads the real Cloudflare beacon script to feign legitimacy.
The favicon next to the heading is the impersonated bank’s, so the “security check” is subtly co-branded with the institution it is about to spoof.
The checkbox has a name. In the markup it is literally id="ohMyBox":
checkbox.addEventListener(“click“, function () {
const targetURL = atob(“aHR0cHM6…“); // base64 of the next hop
window.location.href = targetURL;
});
Readers of this blog may recognize the move. We documented this exact mechanism in April of last year in PsyOps of Phishing: A Wolf in Shepherd’s Clothing, where a fake CAPTCHA decoded a base64 destination with atob() and assigned it to window.location.href, redirecting targets to a phishing site while hiding the clear-text URL from security tools and casual inspection.
The same ohMyBox element, using the same atob-to-window.location.href click-triggered JavaScript redirect, leveraging the same trick of showing the real payload only to the right visitor. The delivery has moved from a text message to the Bing results page, but the kit underneath has not forgotten its roots.
Two more clues came out of analyzing the source. The interstitial page loads Microsoft Clarity, Microsoft’s own session-replay analytics tool, with project IDs like tu25xj2d1s and vesstet8i6. The operators are watching victim sessions on a fake Cloudflare page that ranks on Microsoft’s search engine, using a Microsoft product to do it.
Separately, the kit’s source is commented throughout in Russian /* Чекбокс */, <!-- Спиннер -->, // Фаза 1. That points to a Russian-speaking developer, which is an indicator about who wrote the kit, not proof of who is operating any given campaign. Kits get sold and reused. I would not attribute on code comments alone.
The actual login, and the actual theft
digitvexarion-quorath[.]icu, zelmorandrixu-pavestolqin[.]live, and wexandriolum-parselovent[.]live. The .co.com is the primary, search-ranked domain. The second stage is disposable, and the operators appear to burn more than one of them before the .co.com itself is taken down.The page waiting there is a near-pixel clone of the institution’s real online-banking login, reusing the genuine digital-banking markup down to the routing number in the footer.
The credential handling is not subtle. From the kit’s
login1.js, the form takes a username and password, POSTs them as JSON to /api/login.php, and routes to a loading.php or errlogin.php depending on the response. This is static credential capture. Nothing here relays a live session or defeats a second factor the way an adversary-in-the-middle (AiTM) kit would, and that is the good news for defenders. It is also the crux of the response section below.What others have seen, and what we are adding
The pieces of this are not all new, and the prior work deserves credit. CloudSEK, BlueVoyant, and ScamSniffer have each documented fragments: .co.com abuse, multi-stage finance phishing, and the double-www artifact, the last of these in a campaign aimed at crypto wallets rather than banks. Allure Security’s own earlier coverage of Bing organic-search SEO poisoning and the ohMyBox interstitial in PsyOps of Phishing cover two more.
What we are connecting is the full chain as a single operation aimed at financial institutions, with credit unions hit hardest. Four stages, in the order a victim meets them:
- A Bing-ranked
.co.comfront that carries real SEO signals and, on at least one sample, a Bing Webmaster verification. - A referrer-and-Bingbot gate that hides the malicious sites from everyone but the searcher while keeping the search engine crawler working and the ranking intact.
- The
ohMyBoxfake-Cloudflare interstitial we had already named in a prior blog post. - A rotating second-stage harvester underneath, capturing the credentials.
Tying all four together: the same Russian-commented kit and the same Microsoft Clarity telemetry run through every stage.
What defenders can do
.co.com and the other similar suffixes, which tend to stand up before they are used. When you find one, the takedown path runs through the registry operator behind the suffix, Cloudflare abuse, and Microsoft Bing abuse in parallel, since the search placement is half the attack.For the consumers you protect, the guidance is older than this campaign and still correct. Tell account holders to reach you by typing your address or using a bookmark, not by searching for it on Google or Bing. A genuine login does not route you through a green “are you human” checkbox sitting on a
.co.com host. And because this particular attack chain ends in plain password capture rather than a live MFA relay, phishing-resistant authenticators break it outright. FIDO2 and platform passkeys on the accounts that matter make the stolen password worth nothing, because there is no live session for the operator to co-opt.A
.co.com registration can visually impersonate a real domain, but earning its search rank takes weeks of crawling and reputation, and a fast takedown wipes that investment while cutting off the second-stage pages it was feeding. That disproportionality of effort can be a rare force multiplier in the defender’s advantage.Wrapping up
Analyze the framework of this attack chain and the unnerving parts are the features it borrows. It ranks because it uses the bank’s brand, the user clicks because it abuses Cloudflare’s, and it stays in the index because it leverages Microsoft’s own tooling (Bing’s crawler, Webmaster Tools, and Clarity) to do its analytics. Three trusted names each contributing a critical piece of the campaign.
That is the signal I keep surfacing out of the noise in this series. The signals we have trained users to look for, a .com-looking address, an https lock, a Cloudflare Turnstile, a reassuring green checkmark, are precisely the things this kit forges. The last installment of this story put a fake CAPTCHA in a text message and asked who was verifying whom. This one moved the same question to the first page of your search results.
Allure Security Protection and Mitigation
Allure Security brand and domain protection customers have coverage against this threat through automated monitoring of organic search for malicious results related to their brand and relevant terms.
What to read next
- Signal & Noise: The Search Result You Shouldn’t Have Clicked (Issue 001)
- Signal & Noise: Finding & Applying Phishing Fingerprints that Survive Infrastructure Rotation (Issue 003)
- PsyOps of Phishing: A Wolf in Shepherd’s Clothing — the original
ohMyBox/ fake-CAPTCHA writeup. - When Bing’s Organic Search Results Become Phishing Pages — Allure’s prior Bing SEO-poisoning coverage.
With thanks to the Allure Security research and takedown team. Prior public analyses by CloudSEK, BlueVoyant, and ScamSniffer of related .co.com and multi-stage finance phishing are credited inline and worth reading alongside this post.
