This really made us speculate what we found. We were having a hard time thinking of a legitimate use for such a collection. The only other reason we could think of is phishing, especially since there are not strings for successful login.

About the site

When we look at the malicious url we see that it takes two parameters:
https://xx.xx.237.228:12000/services_group_list?server=cashpro1ssl&group=12

The parameter group seems to control which banking URL is the target. The alert that originated in the Australian bank’s logs has the url with group set to 11, and the url with group set to 12 triggered alerts based on the logs of the bank in New Zealand. The other parameter required some Googling. However when we discovered that cashpro appears to be the name of the online banking software used by Bank of America, it is very likely that this parameter drives the ‘skin’ that is applied to the fake login page. ‘cashpro1ssl’ might means as much as Cashpro skin version 1 over SSL.

We believe that the alerts we received were triggered by a coder/administrator testing an early version of a ‘Phishing as a Service’ platform. Intended to provide those that are willing to pay an easy way of mimicking the login page one or more banks of your liking. Since this discovery we worked with the Dutch National Cyber Security Center as well as the Dutch Police and one of our clients to see what else we could learn about this site. Unfortunately given the complexities involved with an international investigations and the legal limits we are bound too we have not been able to get the source code of the site. When we ran out of options to get more information a Notice and Takedown (NTD) process was started and the site was taken offline on the 1st of November

What does this mean?

To us it looks like the phishing industry is coming of age. Like many other things on the internet, Phishing is moving from something you have to do yourself to something you can consume as a service. While to site we found is still of low quality (e.g. some Dutch strings seem to be bad machine translations of English sentences) it is only a matter of time until this service becomes good enough to lead to an increased flood of phishing emails. Many banks do not make their own software, but rely on commercially made banking software, which more or less looks alike. While we have seen cases before where phishing sites contained fake login screens for multiple banks, seeing a site that seems to target approximately 1200 urls is new to us.

What is next?

We have published an advisory here. We are working with the NCSC to get it to all Dutch banks and are still investigating how to get this to the other banks implied by the URL list. Hence the public release of this advisory. The site is offline as of the evening of the 1st of November.

FAQ

Why was it decided not to initiate a Notice and Takedown procedure immediately?
After discussions with NCSC, the Police and our customer we decided that there was no immediate threat from this phishing site and that it was more important to learn as much as possible from it.

Why did you call this one Phish Bait?
We deem it highly likely that this is a Phishing as a Service (Phishing aaS) platform. ‘Aas’ is the Dutch word for bait.

Why did you mask the ip address of the malicious site?
The provider hosting this page is likely not to blame, since the notice and takedown process is in progress the actual address is not relevant.

Were you able to hack into the phishing site?
For legal reasons and in order not to raise suspicion with the owner of the site the analysis was limited to the main page and OSINT intelligence collected without direct access to the platform.

Can I get the full URL list?
It is in the advisory.