When Script Kiddies Send You "APT" Phishing: A Red Team Post-Mortem

Author: KL3FT3Z

Date: July 31, 2026

Tags: phishing, redteam, cybersecurity, email-security, osint

🇬🇧 English Version

TL;DR: Someone sent me a cPanel verification phishing email from a China Telecom residential IP, using a compromised WordPress site with a URL path that looks like a cat walked across the keyboard. Spam score: 8.3/10. This is not an APT. This is not even a PT. This is a cry for help.

The Delivery

Last Friday, my inbox received a love letter. The subject line screamed urgency: "Verify your [email protected] Email Address". The sender? [email protected] — a classic envelope-from/header-from mismatch with a display name of [email protected].

Nothing says "I am a legitimate system administrator" like sending yourself an email from yourself to verify yourself.

Header Forensics: A Disaster in Slow Motion

Let's pop the hood and look at what the mail server actually saw:

Return-Path: <[email protected]>
Received: from 059188005118.ctinets.com ([59.188.5.118])
    by mx1.example.com with esmtp (Exim 4.95)
From: "[email protected]" <[email protected]>
X-Spam-Score: 8.3 (++++++++++)
X-Spam-Report:
    VIOLATED_DIRECT_SPF(3.50)
    RBL_SPAMHAUS_CSS(2.00)
    BAYES_SPAM(1.69)
    SUBJECT_ENDS_SPACES(0.50)
    MIME_HTML_ONLY(0.20)
    ONCE_RECEIVED(0.20)
    RCVD_NO_TLS_LAST(0.10)
    DMARC_POLICY_SOFTFAIL(0.10)

Translation for non-mail-nerds: This email failed virtually every authentication mechanism known to mankind. SPF softfail, DMARC softfail, no DKIM, no TLS on the final hop, and a single Received header that traces back to 59.188.5.118 — a China Telecom Hong Kong residential/broadband IP with a reverse DNS that looks like a barcode.

If you're going to spoof a domain, at least try to pass SPF. This is like showing up to a bank robbery wearing a name tag with your real name and forgetting to wear pants.

The Infrastructure: rapidcollections.com

The payload lives here:

https://rapidcollections.com/wp-includes/wewewewewewjhdghjkklaslkjhd/b%20b%20d/webmail-cpanel/#[email protected]

Let's dissect this masterpiece:

This is a textbook compromised WordPress site. The attacker gained access (likely via vulnerable plugin, weak admin password, or nulled theme) and dropped a phishing kit into wp-includes — a directory that should never serve HTML to users. WordPress compromises for phishing hosting are so common that Rapid7, Sucuri, and Patchstack publish monthly reports about them.

The phishing kit itself is a lazy cPanel clone with inline styles from 2005, quoted-printable encoding artifacts, and an urgent orange CTA button that screams "CLICK ME BEFORE YOUR BRAIN TURNS ON."

Red Team Scorecard

Total: 14/60 — F

This wouldn't pass a first-year red team exercise. I've seen better phishing in my spam folder from "Nigerian princes" who at least proofread their emails.

What a Real Attack Would Look Like

Since we're doing this as a teaching moment, here's how an actual red teamer (or, heaven forbid, a real APT) would execute this:

1. Domain: Register a cousin domain like hackteann.red or hackteam-red.com with proper SPF/DKIM/DMARC records. Age it for 30 days. Warm it up with legitimate-looking traffic.
2. Infrastructure: Send via a compromised Microsoft 365 tenant or a reputable ESP with a warmed-up IP. Use Cloudflare or Azure Front Door for the landing page. No residential IPs in headers.
3. URL: https://webmail-hackteam-red.com/verify?token=<random> — clean path, HTTPS, valid certificate, no spaces, no keyboard-mashing.
4. Pretext: Adapt to the target. If the victim has GitHub activity, send a fake "Suspicious sign-in attempt" from GitHub. If they use AWS, send a fake billing alert. Context is king.
5. Content: Use the actual brand's CSS. Mirror the real login page pixel-for-pixel. Add a legitimate-looking footer with real addresses. Include a plaintext version to avoid MIME_HTML_ONLY flags.
6. OpSec: Use multiple hops. Strip identifying headers. Use bulletproof hosting or compromised legitimate infrastructure. Rotate domains every 48 hours.

IOCs (Indicators of Compromise)

If you're a defender and see this in your environment, block these:

• IP: 59.188.5.118 (China Telecom HK — residential/broadband pool)
• Domain: rapidcollections.com (compromised WordPress — monitor for /wp-includes/ anomalies)
• URL Pattern: */wp-includes/*/webmail-cpanel/*
• Sender Pattern: noreply@<target-domain> with display name support_admin@<target-domain>
• SpamAssassin Rules Triggered: VIOLATED_DIRECT_SPF, RBL_SPAMHAUS_CSS, BAYES_SPAM, MANY_INVISIBLE_PARTS

Conclusion

This email is not a targeted attack. It's not APT. It's not a true hacktivism crew. It's a commodity phishing kit deployed by someone with access to a cheap botnet and a compromised WordPress site. The only "advanced" part is the attacker's ability to copy-paste an email address into a URL parameter.

To the operator behind this campaign: I appreciate the effort, I really do. But next time, maybe run your phishing kit through a spell checker, a URL beautifier, and a basic SPF validator. Also, wewewewewewjhdghjkklaslkjhd is not a directory name. It's what happens when you fall asleep on your keyboard.

Stay safe. Verify your SPF records. And please, for the love of all that is holy, patch your WordPress plugins.

KL3FT3Z is a certified penetration tester and red team operator. When not breaking things professionally, he writes about people who break things unprofessionally.