support-postal.com · La Banque Postale PhaaS Kit
Operator Puppet Control · 86-Domain Farm · SLAYER-AS
A 2-day-old domain on SLAYER GROUP LIMITED's bulletproof ASN (AS213441) serves a pixel-perfect clone of La Banque Postale's login portal. The kit harvests a 10-digit account ID and 6-digit PIN via a cloned randomized virtual keypad, then collects the victim's phone number in a second step for OTP interception. An operator puppet-control mechanism polls the server every second to allow real-time Telegram-driven navigation through each harvest stage. The host IP serves 86 phishing domains targeting French health insurance (AMELI), La Poste, Crédit Mutuel, MyHermes, Netflix, and Belgian logistics operators.
The domain support-postal.com was registered on 2026-08-15T11:23:04Z — 2 days before this investigation — through Hosting Concepts B.V. d/b/a Registrar.eu (IANA #1647). Nameservers are all within the Openprovider ecosystem across three European TLDs (.nl, .be, .eu). The domain resolves to 102.135.105.235, an IP within AS213441 SLAYER-AS, a bulletproof hosting ASN operated by SLAYER GROUP LIMITED, registered at 14b Turner Street, Manchester UK on 2025-01-27.
The server banner reveals PleskLin + PHP/8.2.33 — a shared Plesk hosting environment, consistent with bulk-deployed phishing kits. No SPF or MX records exist for the domain, confirming outbound email is not the delivery vector. The missing MX is typical of kits delivered via SMS smishing or Telegram victim-targeting.
The root page at support-postal.com/ serves an iframe wrapper that loads index.php — a PhaaS technique that keeps the outer URL clean while the inner application handles victim routing. The index.php immediately issues a PHP session cookie and redirects to a unique operator path (DUVzTTavlOw/?redirection=login).
The login page carries the title "Connexion à mon espace client - La Banque Postale" and renders a pixel-perfect clone of the real La Banque Postale authentication portal. The form captures a 10-digit account identifier via a masked text field and a 6-digit PIN via a clickable virtual keypad with randomized digit layout — an exact reproduction of La Banque Postale's own security keypad. A hidden steeep field (step tracker) carries the value "login" on the first POST.
On successful credential submission the server returns the string "success" and the JS redirects to ?redirection=phone — Step 2 of the harvest chain, which collects the victim's phone number under the pretext of "Informations de contact" (contact details update). Phone number harvest enables the operator to intercept SMS OTP codes issued by the real bank during SCA-protected wire transfers.
The iframe wrapper page embeds a hex-obfuscated JavaScript beacon that provides the operator with a real-time victim presence dashboard. The root page script uses navigator.sendBeacon() to ping the server via /?ping&s=1/0&r2=NONCE — s=1 on page load and every 60 seconds while the victim remains, s=0 on tab close or navigation away. The operator's panel shows live active victims per token path.
More critically, the js.js file — loaded on every phishing step page — implements a puppet control loop: it sends GET /?waiting=1 every 1 second, and when the server returns a non-empty string, redirects the victim's browser to that URL. This means the operator — watching victims arrive via their Telegram bot — manually triggers each stage transition in real time. The victim sits on a loading screen while the operator decides the next move.
A companion function sendAjaxRequestEveryFourSeconds() continuously re-POSTs the victim's form data to index.php every 4 seconds during the waiting phase, ensuring the server retains the credential set across the full session.
Reverse-IP lookup of 102.135.105.235 via HackerTarget reveals 86 phishing domains co-hosted on the same IP. The portfolio spans multiple European countries and brands, confirming this is a multi-client PhaaS operation — not a single-campaign deployment. Target categories include French health insurance (AMELI), French postal services (La Poste/Colissimo), French online banking (La Banque Postale, Crédit Mutuel), German parcel delivery (MyHermes), streaming services (Netflix in Spain), and Belgian logistics operators.
Critically, when a domain is not actively phishing — either between campaigns or while rotating targets — it issues an HTTP 302 redirect to the legitimate brand site it impersonates: ameli-activation.com redirects to www.ameli.fr; dedouanement-laposte.com redirects to www.laposte.fr. This means automated abuse scanners checking the domain at the wrong time see only a legitimate redirect — not phishing content — and suppress takedown actions.
ameli.fr, they either skip filing a report or mark the domain safe. The operator activates the phishing page manually for campaign runs, then reverts to the legitimate redirect — giving the domain a "clean" reputation window to survive automated checks.This operation maps to a well-established threat actor profile: a managed PhaaS platform operator providing turn-key banking credential harvesting to downstream fraudsters. The operator handles infrastructure, kit maintenance, and live victim session management; downstream clients deliver phishing links to victims via SMS, WhatsApp, or Telegram and receive harvested credentials via Telegram bot.
Screenshot 1 shows the full decoded phishing page structure: WHOIS registration timeline, decoded beacon JS, complete form field analysis, POST routing, and the puppet control mechanism from js.js. Screenshot 2 shows the complete reverse-IP result for 102.135.105.235 with domain categorisation by brand and the confirmed anti-detection redirect behaviour.
abuse@registrar.eu (Hosting Concepts B.V. / Registrar.eu) — domain registrar for support-postal.com. Domain suspension removes the primary phishing endpoint immediately.
abuse@slayergroup.ltd (SLAYER GROUP LIMITED / AS213441) — ASN abuse contact. Network-level takedown removes all 86 phishing domains simultaneously.
abuse@ripe.net (RIPE NCC) — AS213441 shows consistent abuse pattern. RIPE policy review of SLAYER GROUP LIMITED warranted.
cert@certa.ssi.gouv.fr / signalement@cybermalveillance.gouv.fr (ANSSI / cybermalveillance.gouv.fr) — French national CERT. La Banque Postale is critical French financial infrastructure.
suspicious@safeonweb.be (CCB Belgium) — Belgian logistics phishing domains (mr-relay-belgium.com, logistique-be.com) target Belgian users.
ec3@europol.europa.eu (Europol EC3) — multi-country, multi-brand banking fraud operation spanning France, Germany, Belgium, Spain, Finland, and Poland.
La Banque Postale security team — brand abuse, user alert capability, and direct reporting to French financial regulators (ACPR, AMF).
Phase 1 — Target discovery: PhishTank public CSV feed queried for French banking targets (2026-08-17). support-postal.com identified as verified active, targeting La Banque Postale, submitted same day.
Phase 2 — Infrastructure: DNS A record resolved to 102.135.105.235. WHOIS confirmed 2-day-old domain via Registrar.eu. HTTP HEAD confirmed live PHP server. ASN lookup to RIPE REST API attributed 102.135.105.235 to AS213441 SLAYER-AS / SLAYER GROUP LIMITED, Manchester UK. RIPE org record ACRO59091-RIPE extracted abuse email.
Phase 3 — Reverse IP pivot: HackerTarget reverse-IP API returned 86 co-hosted domains. All categorised by brand and target country. Live HTTP probes confirmed redirect evasion on inactive domains.
Phase 4 — Page analysis: Full HTML source retrieved for root page, login page, and Step 2 phone page. Hex-obfuscated beacon JS decoded manually. Form fields, hidden inputs, step tracker, and POST routing extracted. js.js fetched and puppet control mechanism documented.
Phase 5 — Kill chain reconstruction: Multi-step harvest documented: credentials → phone → OTP interception → SCA bypass → wire transfer. MITRE ATT&CK techniques mapped. All findings are passive OSINT — no active exploitation, no login submitted, no data sent beyond browser-equivalent HTTP GET requests.