SMS phishers harvested phone numbers, shipment data from UPS tracking tool
I was sent one of these SMS today. I usually ignore but today I was in weird mood and started pulling apart the site. Stuff I found:<p>Google is the domain registrar. (reported)<p>Hotlinked to ups.com images, logos and css... Opportunity for some fun here UPS! (reported)<p>Uses hCaptcha on the landing page. (reported)<p>Nginx server with Plesk, and a plesk login page, no obvious stuff like ssh exposed, all latest versions, I'm not much of sec hacker so I didn't get very far. Started sending malformed and large requests to the credit card processing endpoint to see if I could break it, slowed it down a little, but then the captcha got blocked.<p>Of all of those hCaptcha was the first to respond and act, they've already banned the site's account within 5mins of my email... and this renders the site useless, so here's for hCaptcha! fighting fraud while the behemoths are slow and complicit... I know it's whackamole but it was a little bit of fun.