The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains
To stay ahead of evolving threats, LevelBlue utilizes a machine-learning-based URL scanner that constantly evaluates the digital landscape. We closely monitor VirusTotal for instances where LevelBlue acts as the sole detection layer — a crucial tactic for spotting new phishing campaigns early. In this blog, we will unpack several notable phishing campaigns discovered through this method.
Recently, these unique detections highlighted campaigns that abuse newly registered domains and trusted cloud infrastructure. The primary delivery methods rely on convincing brand impersonation and widely used “secure document” templates to deceive end users. These campaigns typically involve multiple layers of URL redirection.
HTML Redirection Smuggling: Dynamic Multi-Stage Phishing Delivery
We identified a new phishing campaign involving “Framer,” a cloud-based, no-code web development platform. Attackers abuse this service to host deceptive landing pages, often using harmless-looking titles such as “Secure Document” or “Shared Proposal.”
In this example, the initial phishing URL ‘hxxps://logangrowthadvisors-rfp-centre[.]framer[.]website/’, displays a generic page posing as a proposal document and the date on which you accessed the URL to make it more convincing.
Figure 1. Phishing URL abusing ‘framer[.]website’ and uses a proposal document as lure.
The page source includes a redirection link triggered by the button click that routes victims to the phishing content via a Cloudflare Workers domain (workers.dev).
Figure 2. Screenshot of the source code of the initial phishing URL.
Following redirection, the phishing site ‘hxxps://stored-plans-hlei[.]w-y9a826[.]workers[.]dev/’ presents a custom CAPTCHA challenge intended to filter automated traffic.
Figure 3. Phishing URL redirection with customized CAPTCHA.
Further analysis of the source code revealed anti-debugging logic that uses conditional checks to block common keyboard shortcuts, including shortcuts for opening Developer Tools. It also defines a JavaScript function that decrypts an encrypted string via the Web Crypto API (crypto.subtle.decrypt).
Figure 4. Screenshot of the source code of the phishing URL using Web Crypto API.
Finally, the source code includes JavaScript that implements HTML redirection smuggling via the HTML5 Blob API. In the _dF function, the script takes the decrypted raw data and stores it locally in browser memory. The script can also alter its behavior conditionally, depending on the server’s response.
Figure 5. Screenshot of the source code of the phishing URL using Blob API.
The final landing page impersonates a Google Account sign-in page.
Figure 6. Phishing URL mimicking the Google Account Sign-In page.
At the time of analysis, a VirusTotal scan showed that both the initial URL and the redirected phishing URL were flagged as “Phishing” solely by LevelBlue.
Figure 7. Screenshot of a VirusTotal scan result for the initial phishing URL.
Figure 8. Screenshot of a VirusTotal scan result for the phishing URL redirection.
Device Code Phishing: Multi-Stage Redirection of Newly Registered Domains (NRDs)
While device code phishing remains highly prevalent — leveraging diverse hosting platforms to evade detection — recent telemetry indicates a tactical shift. Threat actors are increasingly integrating multi-stage redirection chains that route victims from the initial touchpoint to the final landing page. These chains heavily utilize newly registered domains (NRDs), and some are randomized, alphanumeric domain strings.
In this example, the initial phishing URL “hxxp://2934523t5234535323973294afhdsfga[.]com,” displays “Preparing Your Documents” and requires clicking the “Continue” button to be able to proceed to the next page.
Figure 9. Stage 1 of the phishing URL using a generic “Preparing Your Documents” text as lure.
Analysis of the source code shows that it includes a redirect to another phishing page.
Figure 10. Screenshot of the source code of the phishing URL containing another URL redirection.
The phishing URL:
“hxxps://bl[.]dase7[.]shop/7tr22673862r7436r20348r6243078r627784608263652874635743209043652603485264350263478023352026/3933453326jkjdsbvfvvkzfadfxv.html.html”
leads to a generic “Secure Document Portal” page that contains fake document information.
Figure 11. Stage 2 of the phishing URL redirection using a generic “Secure Document Portal” text as lure.
Clicking the “View Document” button triggers another redirect; based on the source code, this leads to a further URL redirection.
Figure 12. Screenshot of the source code of the second URL redirection containing the final URL redirection.
The final phishing landing page,
“hxxps://alasilla[.]com/frontdeskformationdocusignpaywet/zTlHo9aEUKYakbJYawRlffu6C2imV2To1eOp,”
leads to device code phishing impersonating OneDrive.
Figure 13. Stage 3 and final phishing URL leading to device code phishing.
Review of the source code revealed anti-debugging measures, including blocking keyboard shortcuts, interfering with network monitoring, and disabling text selection. These techniques are commonly observed in device code phishing pages to evade immediate detection.
Figure 14. Screenshot of the source code of the final URL redirection with anti-debugging techniques.
All URLs used in this device code phishing chain are newly registered domains with less than one year domain age.
Figure 15. Screenshot of the domain registrations of the newborn domains.
During our analysis, the VirusTotal scan indicated that only LevelBlue classified both the initial and redirected phishing URLs as “Phishing.”
Figure 16. Screenshot of a VirusTotal scan result for the initial phishing URL.
Figure 17. Screenshot of VirusTotal scan result for the final phishing URL.
Detecting these sophisticated campaigns remains highly challenging due to their reliance on a hybrid mix of trusted cloud ecosystems and newly registered domains. Relying solely on static domain blocklists is insufficient. Taking advantage of machine learning in a URL scanner and implementing heuristic rules that inspect inline content and page behaviors assists us in being significantly more effective in classifying these campaigns as malicious. Proactive monitoring and continuous adaptation are vital to helping neutralize these evolving infrastructure-bouncing techniques.
IOCs:
hxxps://logangrowthadvisors-rfp-centre[.]framer[.]website/
hxxps://stored-plans-hlei[.]w-y9a826[.]workers[.]dev/
hxxp://2934523t5234535323973294afhdsfga[.]com
hxxps://bl[.]dase7[.]shop/7tr22673862r7436r20348r6243078r627784608263652874635743209043652603485264350263478023352026/3933453326jkjdsbvfvvkzfadfxv.html.html
hxxps://alasilla[.]com/frontdeskformationdocusignpaywet/zTlHo9aEUKYakbJYawRlffu6C2imV2To1eOp