{"id":3044,"date":"2026-05-13T07:04:02","date_gmt":"2026-05-13T07:04:02","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/"},"modified":"2026-05-13T07:04:02","modified_gmt":"2026-05-13T07:04:02","slug":"guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/","title":{"rendered":"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th)"},"content":{"rendered":"<div>\n<h2>[This is a Guest Diary by Joshua Nikolson, an ISC Intern and part of the SANS.edu Bachelor&#8217;s degree in Applied Cybersecurity (BACS) program.]<\/h2>\n<h2>\u00a0<\/h2>\n<h2>Introduction<\/h2>\n<p>One day at work, a friend messaged me, \u201cHow do you check a website to see if it\u2019s legit?\u201d This friend recently received a phishing text message from a \u201cbank\u201d, and I figured he wanted to be careful and double-check. I told him to put the URL into VirusTotal but said that just because it may say it\u2019s clean, that doesn\u2019t mean it\u2019s not malicious.<\/p>\n<p>He sent me a screenshot of the VirusTotal page for the URL, with no detections and everything showing green. I took a moment to look at it a little more closely. The domain name was unusual, and right off the bat I could see it had been created in the last few months. As of now, it has one detection from a vendor. All domains mentioned in this blogpost will be listed in the Indicators of Compromise section at the end.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png\" style=\"width: 624px; height: 172px;\"><\/p>\n<p>Going to the site, I could immediately tell that something was off about it. It was a secondhand marketplace that seemed to sell just about everything under the sun, with tons of listings in each category and items priced too good to be true. While the site had that \u201cAI vibecoded feeling\u201d, I wanted to give my friend something more concrete other than \u201cdon\u2019t trust this site\u201d.<\/p>\n<p>I decided to reverse image search one of the product images, a Lenovo ThinkPad battery replacement, and after some digging, I found an eBay listing with all the same product images and item descriptions. I did this for a few more of the site\u2019s listings and came to the same result. I let my friend know, and he said, \u201cYeah, it looked too good to be true\u201d.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/2-realbatterylisting.png\" style=\"width: 624px; height: 311px;\"><\/p>\n<h2>Finding a Marketplace<\/h2>\n<p>I found this interesting and wanted to see if I could find something similar again. Today, it is trivial to use AI to mass-deploy these scams, and I wanted to see what would happen if I tried to buy something.<\/p>\n<p>Let\u2019s look up what my friend was originally looking for: a Texas Instruments TI-nSpire CAS calculator. Simply searching on Google and going to the second page, something pops out to me. Why is a driving school selling a calculator?<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/3-ticalcsearch.png\" style=\"width: 624px; height: 176px;\"><\/p>\n<p>The search result link, hxxps:\/\/desidrivingschool[.]com\/listing\/164903741\/ redirects to a marketplace where it is for sale:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/4-calconsite.png\" style=\"width: 624px; height: 580px;\"><\/p>\n<p>This domain looks suspicious on its own, and to add insult to injury, it was registered ~12 days ago on April 3rd, 2026:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/5-domaininfo.png\" style=\"width: 985px; height: 320px;\"><\/p>\n<h2>What&#8217;s happening here?<\/h2>\n<p>You may be asking why this Desi Driving School is showing up in the search results for this calculator? Good question. If you append \u201c\/sitemap.xml\u201d to the URL, you can see tons of these listings that are meant to infiltrate the search results. This is a prime example of SEO poisoning, in which potential victims are lured through their shopping searches to these fake marketplaces.<\/p>\n<p>Threat actors have previously used compromised WordPress sites as command-and-control infrastructure or to stage payloads, but this is being used as a distinct attack vector. Unfortunately, this website was likely compromised, whether through something like a malicious WordPress plugin or stolen credentials, and is now being used to drive traffic to this malicious marketplace:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/6-sitemapxml.png\" style=\"width: 624px; height: 666px;\"><\/p>\n<p>You can see the range of products that this site offers. They must have a good distribution network.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/7-marketplacehome.png\" style=\"width: 624px; height: 633px;\"><\/p>\n<p>While reverse-image searching for images of the calculator, I found another similar posting on a different fake marketplace. Same images, same description and title, same exact setup with a redirect\u2026<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/8-searchresults.png\" style=\"width: 624px; height: 762px;\"><\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/9-calcondifferentsite.png\" style=\"width: 624px; height: 575px;\"><\/p>\n<p>And another\u2026 with what looks like loads of other compromised sites being used.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/10-anothersearchresult.png\" style=\"width: 305px; height: 430px;\"><\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/11-anothermarketplace.png\" style=\"width: 624px; height: 578px;\"><\/p>\n<p>You can endlessly find these sites by searching any description of a product listed with quotes in Google to find the real item that is being sold and copied from, such as this blazer:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/12-blazer.png\" style=\"width: 1428px; height: 738px;\"><\/p>\n<p>If the price was higher than the actual listing, you might think the scheme is just scraping listings, posting them at a higher price, then purchasing the cheaper item and shipping it. However, I do not think that is the case. Let\u2019s try to buy this Eddie Bauer blazer with a fake identity and a fake debit card from Privacy.com and see what happens.<\/p>\n<p>Right away, I can tell this checkout page is a replica of the Shopify checkout page and looks almost identical.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/13-firstcheckout.png\" style=\"width: 624px; height: 651px;\"><\/p>\n<p>Choosing Mastercard, we\u2019ll check out and pay now. Let\u2019s prepare my fake card. Creating a temporary debit card with a $5 spending limit is extremely easy with Privacy.com, and I have my Mastercard ready.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/14-privacycard.png\" style=\"width: 433px; height: 864px;\"><\/p>\n<p>First, I am instructed to enter my card here:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/15-payment1.png\" style=\"width: 624px; height: 171px;\"><\/p>\n<p>Then I get redirected to this page and must enter my information again:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/16-payment2.png\" style=\"width: 624px; height: 572px;\"><\/p>\n<p>After hitting pay now, a loading screen with a different URL is shown that reminds me of the PayPal loading screen:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/17-payment3.png\" style=\"width: 624px; height: 391px;\"><\/p>\n<p>And then I am redirected to a thank-you page for my order, despite the card being declined, which they know because it shows failure_code=failed in the URL.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/18-ordersubmit.png\" style=\"width: 624px; height: 603px;\"><\/p>\n<p>Only one declined charge was seen on my card. However, in other testing instances, I have seen an additional charge at a different price than the \u201cadvertised product\u201d.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/19-cardcharges1.png\" style=\"width: 624px; height: 178px;\"><\/p>\n<p>The above screenshot is from the order we just made, and this next screenshot is from a different test where two charges were attempted right away on order:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/20-cardcharges2.png\" style=\"width: 624px; height: 338px;\"><\/p>\n<p>It seems that shirleymcgrady is another similar site, but probably used as the main checkout for the other smaller sites.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/21-shirleysite.png\" style=\"width: 1428px; height: 1192px;\"><\/p>\n<p>The loading page domain from the payment was also created recently, 1 month ago, with one detection on VirusTotal.<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/22-loadingpageVT.png\" style=\"width: 624px; height: 209px;\"><\/p>\n<h2>Aftermath<\/h2>\n<p>A few days after I tried to check out, multiple other charges were attempted on the card:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/23-additionalcharges.jpg\" style=\"width: 438px; height: 864px;\"><\/p>\n<p>The clear objective of the scam here is to have the victim make a payment for an item that will never be shipped, resulting in their personal and payment information being stolen. I can only imagine how many people were duped by these marketplaces, considering their popularity, and it must be paying off for the attackers.<\/p>\n<p>With the evolving expertise of AI tools and technology in general, attackers can create these campaigns in a matter of seconds. This takes advantage of the average person\u2019s trust by having a high-ranking site in the search results, images that look real (because they are real, and stolen), and a site that seems trustworthy enough for someone to enter their card details.<\/p>\n<p>I would love to take this a step further and use a card with more funds to purchase a lower-cost item to see how different, if at all, the result would be. It is also fun to hunt down these different marketplaces and see how many you can find. Annoyingly, some of them use registrars that make it harder, not easier, to report abuse, but if anyone reading this would like to investigate this further, I would love to offer my help and see what we can do about it.<\/p>\n<h2>Indicators of Compromise<\/h2>\n<p>Marketplace Domains:<br \/>\nsydney.nbcsi[.]com<br \/>\ndryoff.onetoll[.]shop<br \/>\npopeye.fivedemo[.]shop<br \/>\noffup.japanhold[.]shop<\/p>\n<p>Redirector Domains:<br \/>\ndesidrivingschool[.]com<br \/>\ncurencares[.]in<br \/>\nabralipedema.com[.]br<\/p>\n<p>Payment Page Domains:<br \/>\nshirleymcgrady[.]com<br \/>\nyzoqrbiuar[.]asia<\/p>\n<p> (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>[This is a Guest Diary by Joshua Nikolson, an ISC Intern and part of the SANS.edu Bachelor&#8217;s degree in Applied Cybersecurity (BACS) program.] \u00a0 Introduction One day at work, a friend messaged me, \u201cHow do you check a website to see if it\u2019s legit?\u201d This friend recently received a phishing text message from a \u201cbank\u201d, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[90],"tags":[91],"class_list":["post-3044","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","tag-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th) - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th) - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"[This is a Guest Diary by Joshua Nikolson, an ISC Intern and part of the SANS.edu Bachelor&#8217;s degree in Applied Cybersecurity (BACS) program.] \u00a0 Introduction One day at work, a friend messaged me, \u201cHow do you check a website to see if it\u2019s legit?\u201d This friend recently received a phishing text message from a \u201cbank\u201d, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-13T07:04:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th)\",\"datePublished\":\"2026-05-13T07:04:02+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/\"},\"wordCount\":1229,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/\",\"name\":\"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th) - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png\",\"datePublished\":\"2026-05-13T07:04:02+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#primaryimage\",\"url\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png\",\"contentUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th) - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/","og_locale":"en_US","og_type":"article","og_title":"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th) - Imperative Business Ventures Limited","og_description":"[This is a Guest Diary by Joshua Nikolson, an ISC Intern and part of the SANS.edu Bachelor&#8217;s degree in Applied Cybersecurity (BACS) program.] \u00a0 Introduction One day at work, a friend messaged me, \u201cHow do you check a website to see if it\u2019s legit?\u201d This friend recently received a phishing text message from a \u201cbank\u201d, [&hellip;]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-05-13T07:04:02+00:00","og_image":[{"url":"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th)","datePublished":"2026-05-13T07:04:02+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/"},"wordCount":1229,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png","keywords":["Cybersecurity"],"articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/","name":"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th) - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png","datePublished":"2026-05-13T07:04:02+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#primaryimage","url":"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png","contentUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/1-VTresults.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/05\/13\/guest-diary-tearing-apart-website-fraud-to-see-how-it-works-wed-may-13th\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"[GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th)"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=3044"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3044\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=3044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=3044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=3044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}