Case 005 — Amazon PhaaS
AiTM OTP Relay · prov.cx · 256+ Deployments
Active adversary-in-the-middle attack targeting Amazon UAE customers. Real-time SMS OTP relay intercepts and replays one-time passwords to take over accounts silently — victim is redirected to amazon.ae after compromise. Platform prov.cx hosts 256+ phishing deployments across 10+ brands including Instagram, TBank, Telegram, and crypto exchanges.
The investigation began with a live URL: amazon-ae-relay.apps.prov.cx. The page presents a pixel-perfect Amazon UAE sign-in clone — correct logo, branding, font, and field layout. HTTP response headers immediately reveal the backend stack.
Stack fingerprint: Python backend served via uvicorn + aiohttp, fronted by a Caddy reverse proxy. This is a deliberate, lightweight async stack — appropriate for real-time OTP relay where latency matters. The page was last built on 29 July 2026.
Inline JavaScript extracted from the page source reveals the complete attack flow. This is not a traditional credential phishing attack that steals a password. It is an Adversary-in-the-Middle (AiTM) real-time OTP relay — it captures active Amazon sessions by relaying a live authentication.
/api/init_login — {phone, country_code}. The attacker's Python backend receives this and immediately triggers a real Amazon login with that phone number. Amazon sends a genuine SMS OTP to the victim's actual phone. Backend returns {success: true, session_id: "xxx"}./api/submit_otp — {session_id, otp}. Attacker relays the OTP to Amazon's real authentication endpoint within seconds. Amazon validates it, creates a session, and returns a valid auth token to the attacker.{success: true, logged_in: true}. Attacker holds a live Amazon session. Page shows "Sign-In complete" for 3 seconds, then redirects victim to https://www.amazon.ae. Victim sees nothing suspicious. Attacker proceeds to harvest order history, payment methods, and personal data.A passive reverse IP lookup on 79.124.58.150 via HackerTarget's public API returned 256 subdomains all hosted on the same server — all under prov.cx. This is not a case of one attacker abusing a shared hosting platform. The naming conventions, uniform stack, and absence of any legitimate content confirm this is a purpose-built phishing-as-a-service (PhaaS) infrastructure.
| Brand Target | Subdomains Found | Attack Type | Example | Status |
|---|---|---|---|---|
| Amazon AE | 4 | AiTM OTP Relay | amazon-ae-relay.apps.prov.cx | LIVE |
| 4 | Account Takeover | ig-login.apps.prov.cx, ig-verify.apps.prov.cx | 404 | |
| TBank (Russian) | 7 | Banking Credential Steal | p-tbank-auth-ae303983.prov.cx | 404 |
| Telegram | 4 | Account Takeover | p-telegram-verify-ru-61fcf0f0.prov.cx | 404 |
| Tether (USDT) | 2 | Crypto Wallet Drain | p-tether-verify-38e45136.prov.cx | 404 |
| Uniswap (DeFi) | 6 | Crypto Wallet Drain | p-uniswap-verify-bc3d46b3.prov.cx | 404 |
| Microsoft | 1 | M365 Credential Steal | p-techcorp-microsoft-l-18c92676.prov.cx | 404 |
| TrustWallet | 3 | Crypto Wallet Drain | trustwallet-verify.apps.prov.cx | 404 |
| Generic (Amazon AE) | 1 | AiTM OTP Relay | p-amazon-ae-verify-8168c243.prov.cx | 404 |
| TechCorp (MS Clone) | 1 | M365 Phishing | p-techcorp-login-8044af69.prov.cx | 404 |
Naming convention analysis: The p-[brand]-[action]-[8-char-hex].prov.cx pattern across dozens of entries indicates automated deployment — each phishing kit is spun up programmatically with a randomized hex suffix, likely via an API or scripted provisioning. This is consistent with PhaaS platforms that allow operators to deploy new campaigns without manual server configuration.
The prov.cx domain is not a legitimate cloud platform being abused by attackers — it is a dedicated, purpose-built phishing platform. Evidence:
- No legitimate content at root:
https://prov.cxreturns a 404 JSON response — there is no company website, no terms of service, no documentation for developers. - Admin panels return 404:
admin.prov.cx,backoffice.prov.cx,console.prov.cxall return 404 — they exist in DNS but are locked behind the backend. - Brand new domain:
prov.cxwas registered 2026-07-07 — just 40 days before this investigation. It has no history as a legitimate service. - Zero non-phishing content in 256 subdomains: Every single identifiable subdomain is a brand impersonation, credential harvester, or crypto drain — no personal sites, no developer projects, no legitimate apps.
- Uniform server stack: Python/3.11 + aiohttp + uvicorn + Caddy is consistent across all checked endpoints — single codebase, single operator.
- CX TLD: .cx is the Christmas Island ccTLD, often registered specifically to avoid mainstream registrar scrutiny. Abuse goes to
abuse@key-systems.net(CentralNic backend).
The platform targets multiple distinct victim demographics simultaneously, each served by purpose-specific phishing kits.
p-telegram-verify-ru with explicit RU suffix. Coordinated Russian-speaking victim targeting.Reporting targets chosen for maximum takedown leverage: platform registrar (kills all 256+ deployments), hosting provider, brand owner (Amazon), and EU law enforcement.
Amazon Security Team
Reported to stop-spoofing@amazon.com. Active AiTM page impersonating Amazon UAE sign-in, performing real-time SMS OTP relay via /api/init_login + /api/submit_otp. Amazon Security can pursue the amazon-ae-relay.apps.prov.cx subdomain via CentralNic and Tamatiya EOOD simultaneously.
CentralNic — Registrar Abuse (prov.cx Domain Suspension)
Reported to abuse@key-systems.net. prov.cx is registered via CentralNic (Key-Systems backend). A single domain suspension of prov.cx would take offline all 256+ phishing deployments simultaneously. This is the highest-leverage single action available — one registrar request, 256 pages gone.
Tamatiya EOOD — Hosting Abuse
Reported to noc@4vendeta.com. All 256 deployments are hosted on a single /24 block (79.124.58.0/24) operated by Tamatiya EOOD, Bulgaria. IP block blacklisting would complement the registrar action.
EC3/Europol — Coordinated PhaaS Operation
Reported to ec3@europol.europa.eu. This is not an isolated phishing page — it is a coordinated multi-brand PhaaS platform potentially serving multiple criminal actors. The Russian-speaking targeting (TBank, Telegram-RU) and Gulf targeting (Amazon AE) suggest cross-border organized crime. EC3 scope: criminal infrastructure serving multiple fraud operations simultaneously.
Phase 1 — Initial recon: Passive HTTP HEAD request revealed Python/aiohttp/uvicorn/Caddy stack. WHOIS on prov.cx: CentralNic, 40-day-old domain. IP WHOIS on 79.124.58.150: Tamatiya EOOD, Bulgaria.
Phase 2 — Page source analysis: Full HTML + inline JS extracted. Identified 2-step AiTM flow: /api/init_login → /api/submit_otp. Country dropdown revealed Gulf/India targeting. Post-OTP redirect to https://www.amazon.ae confirms victim is silently compromised.
Phase 3 — IP pivoting: Reverse IP lookup on 79.124.58.150 returned 256 prov.cx subdomains. Grepped for brand names — Amazon (4), Instagram (4), TBank (7), Telegram (4), Tether (2), Uniswap (6), Microsoft (1), TrustWallet (3). All confirmed via HTTP HEAD requests.
Phase 4 — Platform analysis: Root domain, admin, and backoffice subdomains all return 404. No legitimate use found across 256 entries. prov.cx domain age (40 days) and naming convention (p-[brand]-[action]-[hex]) confirm automated deployment system, not a legitimate PaaS being abused.
Headless browser screenshot of amazon-ae-relay.apps.prov.cx captured during investigation. Amazon UAE sign-in clone with UAE +971 country code pre-selected. Logo CDN blocked by headless mode — the live page loads it correctly from media-amazon.com, reinforcing the impersonation.
Evidence captured passively via headless browser. Do not visit this URL — it is an active credential harvesting page.