They Left Their IP in the Phishing Log
First published on Medium, April 23, 2025, as "I Didn't Just Block a Phishing Link. I Took Down the Whole Operation." This is now its home.
It started with a guitar listing
I was trying to sell a guitar on Facebook Marketplace when I got a message.
Followed by a suspicious-looking link. The URL was long, weirdly specific, and included words from my actual listing. That was the first red flag. This wasn't a random mass phishing attempt. It was targeted.
I clicked it.
A clone of the Facebook login page. The domain was total nonsense, hosted on a free subdomain under atwebpages.com. Looked real enough to fool someone who wasn't paying attention.
Most people stop here. Report the link, maybe block the sender, move on.
I don't work that way.
The timeline
7:28 PM — Phishing link received. Clicked. Suspected Facebook credential harvester.
7:49 PM — Mirrored the site locally with wget. Confirmed fake login form with POST to do.php.
8:15 PM — Ran a passive directory enumeration. Discovered acc.txt, counter.php, iso.txt.
8:35 PM — Pulled acc.txt and that's when it hit me.
This thing was live.
Real people. Real victims. Credentials from mobile devices: names, passwords, IP addresses. Someone had visited this fake login page minutes ago and typed in their real Facebook details. I could see it in the timestamp.
================================
Email : [redacted]@yahoo.ca
password: [redacted]
IP : [redacted]
USER AGENT : Mozilla/5.0 (Linux; Android 14; SM-A156W Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/134.0.6998.135 Mobile Safari/537.36 [FB_IAB/FB4A;FBAV/501.0.0.61.108;]
================================
Email : [redacted]@hotmail.com
password: [redacted]
IP : [redacted]
USER AGENT : Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/22D82 [FBAN/FBIOS;FBAV/503.0.0.56.104;FBBV/704769221;FBDV/iPhone14,5;FBMD/iPhone;FBSN/iOS;FBSV/18.3.2;FBSS/3;FBID/phone;FBLC/en_US;FBOP/5;FBRV/708854960;IABMV/1]
================================
Email :
password:
IP : [redacted]
USER AGENT : Fuzz Faster U Fool v2.1.0-dev
================================Line by line, the trap was working. (Don't ask me about that last one 🫢)
Then I hit the very first entry:
=============================
Email : test
password: 123
IP : [redacted]
USER AGENT : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
================================Not a victim. A test submission. Somebody was checking the form worked before sending it into the wild. That IP address might be the attacker.
Whois lookup:
NetRange: 97.66.208.0 - 97.66.215.255
CIDR: 97.66.208.0/21
NetName: 97-66-208-0
NetHandle: NET-97-66-208-0-1
Parent: NETBLCK-ITCD-7 (NET-97-66-0-0-1)
###
OrgName: GoNetSpeed
OrgId: OTELC
Address: 505 Third Avenue East
City: Oneonta
StateProv: AL
PostalCode: 35121
Country: USGoNetSpeed. Residential ISP. Alabama.
No VPN. Their IP just sitting there in the log like a signature on the crime scene.
Why I didn't just blow it up
I could have. The form handler was wide open. No auth, no rate-limiting, zero input sanitization. Classic soft target.
But this wasn't a lab. Real shared hosting, real bystanders, real legal exposure.
Submitting fake credentials? Passive. Non-destructive.
Enumerating public files? Recon. Still legal.
Exploiting the form handler to wipe their credential log? That's modification of a computer system. I was sitting in PEI, so Canada's Criminal Code (unauthorized use of a computer, mischief to data) applies to me wherever the server lives. And the test entry came from a US home connection, so the CFAA wants in too: it covers pretty much any computer on the internet. Neither one cares that it was a phishing site.
Intent matters in court. So does impact. I've read just enough case law to know that "but they were criminals" is not the defense people think it is.
So instead I flooded their form with garbage data. Not a denial of service, just enough volume to bury the real credentials in noise. Fake entries that mirrored the victim format with scrambled passwords. Every real password became a needle in a growing haystack.
Then I sent the attacker their own IP address.
Within minutes, they swapped the credential log out and started serving scam gift card redirect links instead.
The phishing operation was dead. They burned it themselves.
9:00 PM — [snack time]
9:06 PM — 403 Forbidden. Blocked.
9:22 PM — Compiled the casefile, encrypted the archive, sent it to relevant law enforcement contacts. Wiped the Kali VM, which took care of any lingering PII in the process.
No loose ends.
Why I do this
When I wrote the first version of this section, mikesploit was going to be a community. A place for people who wanted to learn this stuff from scratch, the way I did. Casefiles, playbooks, recon workflows. I was going to teach it.
That's not what it became.
The reporting approach I built before this, REACT404, automated phishing reports to hosts and registrars. Packaged evidence, sent notices, did everything right. Most registrars ignored it. Some blocked my email address.
Politely asking the infrastructure to take itself down doesn't scale. It never did.
So mikesploit became something else. We built a semantic threat intelligence toolkit that's constantly running. Searching for malicious infrastructure. Correlating signals. Flagging campaigns. When something surfaces, we investigate it. When we have enough to act on, we act. When we have enough to publish, we publish.
The mission is still the same: find the people using the internet as a weapon against the people least equipped to defend themselves, and make their operations as expensive and short-lived as possible. The methods just got sharper.
— mikesploit
(Update 2026-11-10: Trust Report Canada wrote up what to look for when a "buyer" sends you a link to your own listing, and re-checked the hosting behind this one. Their write-up.)