Klarna Refund Phishing — klarna-helpsupport.shop — 4-Domain Redirect Chain Targeting Belgian School Staff

The phishing email contains a link to 504c64b6.harvest-university.com. This subdomain matches the fake "Order # 504c64b6" shown in the email body. The domain uses Cloudflare DNS with wildcard resolution: any subdomain resolves to the same Cloudflare edge IPs (104.21.94.219, 172.67.140.137). This confirms the operator generates unique per-victim subdomains matching fake order numbers.

The Cloudflare worker returns a 301 redirect to the actual phishing page: ww2-account.klarna-helpsupport.shop/?Email=leklarna@klarnat.com. The Email parameter is the operator's notification address, leaked in every redirect. The domain klarnat.com is registered via Cronon GmbH (Germany), has no MX or TXT records, and was created 2024-12-10: a purpose-built burner domain for phishing operations.

Browser-based investigation reveals a 4-step phishing flow designed to progressively lower victim resistance:

Step 1 (Email): Dutch-language refund notification claiming "Je geld wordt terugbetaald" (Your money will be refunded). Sent from "KlarnaSupport" with a forged display name. The email requests the victim "Voeg nu gegevens toe" (Add your details now) to complete a refund that supposedly failed due to incomplete account data. BCC mass-distribution confirmed: the visible "To:" header shows a Belgian school director (heilighartschooltereken.be), but the same email was also received at an unrelated Belgian logistics company (tctech.be) via BCC. This means the operator is blasting a scraped list of Belgian workplace emails, not targeting individual victims.

Step 2 (Security Page): Pink Klarna-branded page with shield icon stating "De veiligheidscontrole is geactiveerd" (Security check activated). Claims "ongebruikelijke aanmeldactiviteit gedetecteerd" (unusual login activity detected). Classic fear-based social engineering to justify the credential request.

Step 3 (Welcome Page): Clean "Welkom bij Klarna" page with single "Inloggen" (Login) button. Mimics the real Klarna app login flow. Chrome's language detection identifies the page as German, suggesting the kit template was adapted from a German original.

Step 4 (Credential Form): Login form requesting "Telefoonnummer of e-Junl" with a "Doorgaan" (Continue) button. The "e-Junl" typo (should be "e-mail") is a kit quality indicator: sloppy localization from a non-Dutch-speaking operator. Links to fake "Gebruiksvoorwaarden" and "Privacybeleid" add false legitimacy.

Both harvest-university.com and klarna-helpsupport.shop use wildcard DNS. Any subdomain resolves:

harvest-university.com: Registered 2020-01-26 via Mesh Digital Limited. Currently on Cloudflare (buck/meg.ns.cloudflare.com). No MX records. Updated 2026-08-17: the operator reconfigured it one day before this investigation. All subdomains resolve to Cloudflare edge IPs, enabling unlimited per-victim tracking subdomains.

klarna-helpsupport.shop: Nameservers at OpenProvider (openprovider.nl/be/eu). All subdomains (www, account, login, app, api, admin, panel, ww2-account, ww1-account, account-verify, secure, my-account, billing, payment, refund, support, help, and any random string) resolve to 192.241.165.34. The Plesk server handles all of them.

The phishing email was sent from be@groupescolairetemry.com. The domain name translates to "Temry School Group", suggesting either a hijacked legitimate French educational domain or a purpose-built decoy. Key findings:

Registration: eNom LLC, created 2025-01-22. Hosted at 209.16.158.126 (PlanetHoster France, Groupe Barizco Inc., Laval, QC). Uses N0C nameservers (nsa/nsb/nsc.n0c.com). SOA serial 2026072208 indicates last zone update was July 22, 2026.

SPF record: v=spf1 a mx ip4:209.16.158.126 ~all. The softfail (~all) policy allows spoofed mail to pass with a warning. A legitimate domain would use -all (hardfail).

Suspension: PlanetHoster has already suspended the account. Visiting the domain redirects to /ph-sys/suspended/ showing the N0C "SORRY" suspension page. The hosting provider acted before this investigation.

Co-hosting: Reverse IP lookup on 209.16.158.126 returns 500+ domains on the same PlanetHoster shared server. This is a shared hosting environment, not a dedicated phishing server. The operator likely compromised a single cPanel account or created a throwaway account for email sending.

Below the Klarna phishing content, the email body contains a complete copy of a DPG Media (Brabants Dagblad / AD) newsletter. This is a known spam filter evasion technique: padding a malicious email with legitimate news content increases the text-to-link ratio, dilutes suspicious keyword density, and borrows the sender reputation of a real publisher.

The newsletter portion includes real Dutch news headlines ("Politie ontruimt tentfeest in Almkerk", "Brand in België op 30 kilometer van Nederlandse grens"), weather forecasts, sports news, video links, and a footer showing it was originally sent to koco@home.nl (a real Dutch @home.nl email address). This means the operator either has access to a real DPG Media newsletter subscription or scraped the content from a forwarded copy.

The newsletter footer contains valid "Afmelden" (unsubscribe) links, DPG Media B.V. copyright notice, and privacy policy links: all of which add false legitimacy signals that help the email pass content-based spam filters.

The phishing kit runs on 192.241.165.34 (DigitalOcean, LLC, Broomfield CO, AS14061). The server runs Plesk (PleskLin) with nginx and PHP 8.4.24. No reverse DNS domains were found on this IP via HackerTarget, suggesting a dedicated droplet used exclusively for this campaign.

The domain klarna-helpsupport.shop uses OpenProvider nameservers (openprovider.nl/be/eu). No MX records, no TXT/SPF records: the domain exists solely for web-based credential harvesting. The wildcard DNS combined with Plesk's wildcard TLS handling means the operator can serve any subdomain with a valid certificate, enabling unlimited campaign variations (ww2-account, secure, my-account, etc.).

The PHPSESSID cookie is set without Secure or HttpOnly flags, a common indicator of a quickly-deployed phishing kit without security hardening. The PHP session architecture confirms the kit tracks victim state across the multi-step flow.

Phase 1: Email Header Analysis — Identified sender domain mismatch (groupescolairetemry.com vs Klarna), extracted phishing URL from email body, identified DPG Media newsletter padding technique.

Phase 2: DNS & WHOIS Reconnaissance — Full DNS enumeration of all 4 domains (harvest-university.com, klarna-helpsupport.shop, groupescolairetemry.com, klarnat.com). WHOIS registration timeline, registrar identification, nameserver analysis.

Phase 3: HTTP Passive Probing — HEAD requests to phishing infrastructure. Captured full redirect chain (301 from Cloudflare to DigitalOcean). Identified server stack via response headers (PleskLin, PHP 8.4.24, nginx). Session cookie analysis.

Phase 4: Wildcard DNS Validation — Confirmed wildcard DNS on both redirect and phishing domains by resolving random non-existent subdomains. Enumerated 11+ active subdomains on klarna-helpsupport.shop.

Phase 5: Infrastructure Attribution — Reverse IP lookup on sender domain host (500+ co-hosted domains on PlanetHoster shared server). ASN attribution for phishing host (DigitalOcean AS14061). Identified sender domain suspension by PlanetHoster.

Phase 6: Browser-Based Kit Analysis — Visited phishing URL from Belgian residential IP. Captured full 4-step flow: security scare page, welcome gate, credential harvest form. Documented "e-Junl" typo as operator origin indicator. TotalAV confirmation of phishing classification.