One Logo, Three Kits, Three Telegram Bots

Key findings

• A fake "Fines, Fees and Expenses Collection Center" page on gov.il look-alike domains collects Israeli ID numbers, driver license or case numbers, names, email, phone, payment card number, expiry and CVV, and then shows a one-time-code (OTP) screen. [Observation]
• One logo, three scans. The SHA-256 a5f1fbd6...acae8 of the gov.il logo used by the first kit appears in exactly 3 public urlscan.io scans: setp0il.online (23 Aug 2026), bsg.highnefix.com (13 Oct) and govsercis.ing (20 Oct). Two of them also share five byte-identical stylesheets, and their HTML differs only in an analytics tag injected by Cloudflare. [Observation]
• Four code lineages, one target. Besides that kit (A, with a variant A′ on highnefix.com), we describe Kit B (a Vite-style single-page build on mytemp.website) and Kit C (govsercis.net, an anti-bot hardened page). They share a target and a Telegram-based collection model. Evidence that one operator runs all of them is partial and stated per link below. [Observation] [Inference]
• Three client-side Telegram bots (IDs 8762837261, 8668135633, 8915157729) are embedded in kit JavaScript. The operator rotated the bot and the destination chat between two Kit B deployments seven weeks apart. We did not use any token. [Observation]
• Distribution runs through link shorteners and Blogger. Scans show short.gy and switchy.io redirecting into Kit B, and 56 scans of govil43.blogspot.* country-domain variants redirecting to a further mytemp.website page on 21 Oct. [Observation]
• Cheap to rebuild, expensive to track. Kit B carries Lovable (AI app builder) metadata, and every redeploy changed the Telegram identity. File hashes remain useful, but they decay with each rebuild. [Observation] [Hypothesis]
• Two more hosts and a retooling pattern, from public records only. A lead outside the public record led us to temp-host42.com (registered 10 Oct 2026, Ultahost). Public data as of 22 October 2026 showed it resolving to the same Frankfurt IP as clalitilcom.com, a domain registered on 17 Sep and placed on registry hold on 21 Sep. A third host family, an InMotion temporary.link address, got its certificate on 16 Aug. The operator, or operators, appear to move between GoDaddy temporary domains, InMotion temporary URLs, Ultahost domains and Cloudflare. Whether the new hosts run Kit B is a hypothesis; no public scan shows kit content on them. [Observation] [Hypothesis]
• Part II adds the operators’ side. Redacted screenshots of the bot notification chat match the public Kit B code alert for alert and show a new burst on 21 Oct 2026. A secondhand summary of the operators’ own chat suggests live, manual handling and a dependence on SMS one-time codes. One personal assessment of the operators’ background is recorded there with its limits. It is not a finding. [Observation] [Secondary source]
• The kit does not need stolen victim data. Kit B’s first page asks the visitor to type an ID and a case number. The ID is checked for a valid check digit in the browser; the case number is only checked for length. Nothing is looked up. The ID and case then travel in the next page’s URL, because the kit puts them there. We looked for evidence that victims were chosen from a leaked list beforehand and found none in the code. The idea stays open, and we say what would settle it. [Observation] [Hypothesis]

1. Where this started

The thread began with a single public scan: https://govsercis.ing/0ilgovi/, scanned on urlscan.io on 20 October 2026 at 13:49 UTC. It scored 100 on urlscan’s verdict and carried the brand tag for the Israeli government portal. It surfaced while reviewing public scans for infrastructure aimed at Israeli targets. The page title is the same string as the real service it copies, the Fines, Fees and Expenses Collection Center:

‏המרכז לגביית קנסות אגרות והוצאות

Neither the domain nor the URL path tells you much. What does is the set of files the page loads: a logo, five stylesheets, and an image hotlinked from the real government site. Those files can be fingerprinted. That is the technique this whole report rests on.

Ground rules and evidence labels

Sections 1 to 8 and the appendices A and B come from the public urlscan.io record and passive lookups, checked again on 22 October 2026. Part II adds redacted material supplied to me and says so where it is used. We downloaded nothing from the phishing hosts, did not browse to them, did not submit data to them and did not call the Telegram API with any recovered value. Each statement carries a label:

• [Observation] a value we read from a scan or a stored response.
• [Source date] when and where the underlying record was created, always in UTC unless stated.
• [Inference] a conclusion that follows from observations but is not directly shown.
• [Hypothesis] a plausible explanation we could not test.

2. The investigation, station by station

Each station says what we checked, what it is, and why it led to the next one.

Station 1: the page and its fingerprint

What we checked. The 20 October scan of govsercis.ing/0ilgovi/. What it is. A four-step payment flow: identification, payment details, payment, confirmation. The first screen asks the visitor to pick an identification type and enter an ID number or a driver license number (Kit B also offers a case number). [Observation] The scan recorded 11 responses: the HTML, five CSS files under /assets/css/, a logo called gov.png, a favicon, Cloudflare analytics traffic and one request to ecom.​gov.​il/​voucherspa/​resources/​images/​loading.​gif. That last file is the loading spinner of the real government payment application, loaded straight from the government’s server. [Observation] Why it mattered. Every response in a urlscan scan is stored with its SHA-256. The logo hash is a5f1fbd6bd899601472130fdb8dd804a9f50867e907903a8ccccc5a78a4acae8. Searching urlscan for that exact hash is a passive way to ask: where else has this file been served?

Station 2: the hash pivot

What we checked. A urlscan search for hash:a5f1fbd6...acae8, re-run on 22 October. What it returned. Exactly three scans, all from this family. [Observation]

Why it mattered. No unrelated site in the public record serves this image. A single shared file is a lead, not proof of a shared operator, since kits get copied and sold. So we looked for more shared material.

Station 3: how identical is "identical"?

What we checked. The other files in the two scans that carry the gov.png logo, setp0il.online and govsercis.ing. What we found. All five stylesheets (app.css, payment.css, responsive.css, header.css, logo.css) have the same SHA-256 on both domains. The HTML differs in only one line: the Cloudflare Web Analytics beacon, which Cloudflare injects per site with its own token. The rendered screenshots are byte-identical. [Observation] Why it mattered. Two domains whose certificates were issued 17 days apart, both behind Cloudflare, hold the same files down to the byte, with the kit’s own code untouched between 23 August and 20 October. [Inference] This is a redeployed copy of one kit, not two similar kits. The unchanged code over two months may mean the operators felt no pressure to rotate it. [Hypothesis]

The app.css hash appears in exactly 2 public scans (setp0il.online and govsercis.ing). [Observation, urlscan search, 22 Oct 2026] The only line that differs between the two stored HTML responses is the Cloudflare Web Analytics tag. Cloudflare adds this tag to each site it proxies, with a site-specific token, so the difference is an artifact of the two domains being on separate Cloudflare zones, not of the kit. [Observation] [Inference]

The kit’s own script carries Arabic comments. One comment says the code prevents navigation when the gov.il logo is clicked, so the victim stays on the page. The same script defines sendToTelegram(), which base64-encodes a message and posts it back to the page’s own URL. The Telegram call itself therefore happens on the server, and the bot token does not appear in the page. [Observation] [Inference]

The same page loads its loading spinner from the real government site, a hotlink that can expose the fake page’s visitors to the real service’s logs through the Referer header (see the detection section).

Station 4: the sibling domain registered nine minutes apart

What we checked. TLS certificate records for govsercis.ing and the similar-looking govsercis.net. What we found. The certificates were issued on 29 August 2026 at 18:35:45 UTC (.ing) and 18:26:13 UTC (.net), about nine and a half minutes apart, both by Google Trust Services’ WE1 intermediate. [Observation] Someone set up both domains in one sitting. [Inference] What govsercis.net serves. The scan of https://govsercis.net/g-vie/ on 2 September 2026 (09:30 UTC) is a different code lineage, which we call Kit C. It has its own markup, a hidden honeypot form field (website_url) and a hidden token to catch bots, a "protection overlay" screen, a separate anti-bot/anti-bot.js, page metadata that tells search engines not to index or archive it, and styles that block text selection and copying. The page presents a payment total of 150 NIS and a form for name, email, phone, card number, expiry, ID number and CVV, followed by an OTP screen titled "credit card verification" whose logo is set dynamically. [Observation] The OTP screen is built to look like the card issuer’s own verification step. [Inference]

Kit C is also the most defensive page in the set. It shows a "protection" overlay if DevTools is opened, removes injected script and iframe nodes with a MutationObserver, blocks selection and copying, includes a hidden honeypot field and token for bot detection, and loads an external anti- bot/anti-bot.js. The author spent effort protecting the page from analysts and scanners.

[Observation] The whole page, including the Telegram identifiers, was still captured by a public scanner. [Observation]

Kit C is not the same file set as Kit A. The link between them is infrastructure timing (the nine-and-a-half-minute certificate gap), the shared target and the shared collection model, not shared bytes. [Inference]

Station 5: the same logo on a shared hosting account

What we checked. The third hit of the hash pivot, bsg.highnefix.com/vog1/, scanned on 13 October 2026 (12:30 UTC) after being submitted through http://highnefix.com/vog1. What it is. A third presentation of the same logo, now called logo.png, but with different markup: a single self-contained HTML file with inline styles and a form that includes ID number, driver license number, full name, email, phone, card number, expiry, CVV and a one-time code field with a visible attempts counter. [Observation] It is served by LiteSpeed from 162.213.255.54, a Namecheap shared-hosting address (AS22612). [Observation] Why it matters. When the page loads, its JavaScript posts a short JSON message to send.php on the same host. The function is called sendDataToTelegram and the message text says, in Hebrew, "A new user opened the payment page now". The server replied {"status":"success"}. [Observation] This is a beacon: the operator learns about a visitor before the visitor types anything. That send.php relays to Telegram is inferred from the function name and the message format; the relay itself is server-side and not visible to us. [Inference]

The same page contains a second, quieter detail. After the victim submits card data, a triggerLoading function shows a spinner for a random 7 to 10 seconds before moving to the next step, and its comments are in Arabic. [Observation] A fake delay makes a form feel like it is contacting a bank, and buys the operator time to react in Telegram before the OTP step. [Inference]

Ownership versus compromise. We could not establish whether highnefix.com is attacker- registered or a legitimate site whose hosting account was abused. Certificate transparency data seen on 20 October shows certificates for highnefix.com from January 2026, which is earlier than anything else in this report, and a scan on 21 October shows another subdomain, lome.highnefix.com, on the same IP serving an open directory listing ("Index of /"). Both facts fit either explanation. [Observation] We do not claim either. [Hypothesis] Subdomains per campaign on one hosting account would fit. One further point on Kit A. Its page script sends data by posting a base64-encoded message to its own URL (fetch(window.​location.​href, ...)), so the Telegram token presumably stays on the server. [Inference] That is a different design from Kits B and C, which put the token in client-side code. [Observation]

Station 6: a different build on mytemp.website

What we checked. A second hash family. Scans of 40c.f25.mytemp.website (25 August 2026, 13:27 UTC) and p8s.728.mytemp.website (15 October 2026, 11:57 UTC) share the file govil-logo.png (dde854a8...07cb) and the main JavaScript bundle index-BRl0iJdM.js (f185815c...8750). Each of these hashes appears in exactly two public scans, these two. [Observation] What it is. Kit B is a modern single-page application (a Vite-style build with route chunks for /otp, /payment, /payment-details, /verifying and /success). Its HTML metadata names "Lovable", an AI app-building service, as author. [Observation] That suggests the kit was generated with an AI builder, which would make rebuilds cheap. [Hypothesis] The two scans were reached through link shorteners: http://tgplou.s.gy/jkQ2Zc (short.gy) in August and https://hi.switchy.io/118X9 (switchy.io) in October. [Observation] Both hosts are GoDaddy infrastructure: 107.180.116.166 (US) and 92.205.174.96 (Germany); the pages load GoDaddy’s own signal scripts. The October host received a wildcard certificate the same morning (04:44 UTC) as the scan. [Observation] Features that matter to defenders. The bundle looks up the visitor’s location through ipapi.co/json/, and sends alerts, with Arabic labels, for: a suspicious visit (possible bot), a visit through a VPN or proxy, leaving the page during payment, an attempt to copy from a sensitive field, and a counter of OTP attempts. [Observation] A kit that tells its operator when a victim hesitates is built for live interaction with the victim. [Inference]

Two pieces of Kit B’s code stand out. The HTML head names "Lovable" as author and as twitter:site, and the main bundle calls a function named _​_​lovableReportRuntimeError; both strings are highlighted in the figure. They appear to come from that AI builder’s default template. The main bundle contains an operator-alert system: a visitor profile (IP, country, city, provider, browser, language, screen size and URL, with Arabic field labels), and alerts for bots, VPN or proxy use, leaving the page during payment, copying from sensitive fields, and opening debugging tools. [Observation]

What changed between deployments. Of the bundle’s files, only notify-CoyZhygr.js differs between August and October. That is the file that holds the Telegram destination. Everything else is identical to the byte. [Observation] The operator reused the whole kit and swapped only the place where the stolen data goes.

Station 7: the Telegram bots in the source

The browser-side notifiers in Kits B and C contain their Telegram settings in plain text. The table lists the bot ID (the numeric part before the colon in a bot token) and the destination chat ID. We redact the secret half of each token and we did not use any of them. The IDs identify the bot and the receiving chat, not a person. [Observation]

The images below show the exact lines. Bot token secrets are redacted in the pixels.

Three things stand out. First, the Kit B operator moved from a group chat (negative ID) to what looks like an individual account (positive ID) when they rebuilt in October. That is consistent with a new, smaller operation or a new handler, but we cannot tell which. [Hypothesis] Second, Kit C splits the token across two string literals, which defeats a plain-text search for the token pattern and is a weak, easily bypassed obfuscation. [Observation] Third, every kit uses Hebrew for the victim-facing page and Arabic in code comments and strings. Arabic appears in Kit A’s HTML comments, Kit B’s notification labels, Kit C’s comments and the Highnefix page. [Observation] Language in code comments is weak evidence of who wrote the code. We draw no conclusion about the operators’ identity or origin. [Hypothesis]

Kaspersky’s Securelist describes this exact collection design: phishing pages can post stolen data to a Telegram bot, sometimes with the bot token hard-coded in the page, so that data reaches the operator in real time with an instant notification, using disposable bots that are hard to track and whose operation does not depend on the quality of the phishing page’s hosting (Olga Altukhova, "Where does the data stolen in a phishing attack go?", 12 Dec 2025). What we see here fits that description closely, down to the disposable bots: three bots across three kits.

Station 8: how Kit B handles the ID and case number

The first page of Kit B is a form that imitates the identification step of the real service. The visitor picks "ID and Collection Center case number" or "ID and driver’s license number", types a nine-digit ID and a second number, and presses confirm. We read this from the stored JavaScript of the October scan of p8s.728.mytemp.website (routes-C1-NFZNK.js, scan 01a13f6c-cc80-72ba-9674- 3c3e90f82d01). No page was loaded by us.

• The ID field is checked in the browser with the standard Israeli ID check-digit rule. A number that fails shows an error and the button stays disabled. [Observation]
• The second field is only checked for length (7 to 9 digits for a case number, 7 to 8 for a license) and for digits. The code makes no request to any server to check the case number. [Observation]
• On submit the page first sends an operator notification (with the ID type, the ID and the second field), then navigates to /payment-details with the ID and the case number as URL parameters. The later routes /otp and /verifying accept total, count, phone and id; /success accepts total. [Observation]
• The page copies the identification options of the real gov.il service, including the sentence that the case number appears on the payment demand received by mail or SMS. The real service lists the same options (ID plus case number, ID plus driver’s license number, report number): https://​www.​gov.​il/​he/​service/​debt_​payment_​center_​to_​collect_​fines_​and_​fees_​old [Observation]

notification, then navigation to /payment-details with the typed values in the URL. Source: https://​urlscan.​io/​result/​01a13f6c- cc80-​72ba-​9674-​3c3e90f82d01/

The kit’s operator notifications use the same pattern throughout: a counter limits each alert type to two sends, the visitor profile (IP, country, city, provider, browser, language, screen size, page URL) is added to each alert, and a "page left during payment" alert fires when the tab is hidden on a /payment or /otp path. The alert code is skipped when the host name is localhost, 127.0.0.1, or ends with .lovable.app or .lovable.dev. So a test inside the builder’s own preview would not alert; a test on a real domain would. [Observation]

Station 9: the lure link goes to the first page, with no personal data

Both stored Kit B scans start at a short link, and in both the short link leads to the bare root of the kit. The October link, hi.switchy.io/118X9, serves a small HTML page that sets a Hebrew link preview (title "The Center for Collection of Fines, Fees and Expenses", description "enter identification details", image: the gov.il logo) and then redirects the browser to p8s.728.mytemp.website/ with no parameters. The August link, tgplou.s.gy/jkQ2Zc, ends at 40c.f25.mytemp.website/ the same way; that hop is an HTTP redirect, so the scan stores no preview page for it and the first stored response is the kit root page itself. [Observation]

So for these two links the lure does not carry a name, ID or case number. We cannot say what other short links did. A link can be made per victim, but the two we can see are generic. [Inference]

A related tag appears in the wider record. The parameters utm_​source=​sniply&​amp;utm_​medium=​sniply&​amp;utm_​campaign=​sniply are the defaults that Sniply, a legitimate link tool that puts a call-to-action bar over a page, adds to a link it wraps (https://​support.​snip.​ly/​hc/​en-​us/​articles/​20000965256084-​How-​does-​Sniply-​handle-​UTM-​Tags). A public urlscan search finds 2,631 scans with that tag, nearly all of them repeat scans of one bank look-alike page on web.app, and none on mytemp.website. We list it as a pivot only: it suggests one path through which a victim may reach a page, and it is shared by unrelated sites. [Observation] [Hypothesis]

Station 10: the hosting does not stay put

A lead that did not come from a public source named three more hostnames. We do not reproduce the lead. We checked only public records about them, with no contact.

• An InMotion temporary URL. temporary.link is the service InMotion Hosting uses for the preview address of a cPanel account before a domain points to it (https://​www.​inmotionhosting.​com/​support/​website/​using-​your-​temporary-​url/). The host named in the lead resolves to 23.235.219.250 (AS22611, InMotion, Los Angeles). Certificate transparency shows a Let’s Encrypt wildcard certificate for it issued on 16 Aug 2026 at 09:04 UTC, nine days before the first public scan of Kit B. The parent domain has 1,752 certificates and 250 public scans, nearly all unrelated, so the domain says little (crt.sh and urlscan.io search, 22 Oct 2026). A urlscan search for the exact host returns nothing. [Observation]
• `temp-host42.com`. Registered on 10 Oct 2026 (registrar Ultahost, Inc.), name servers ns1 to ns4.ultahost.com, A record 84.200.33.242 (Frankfurt, AS44066 firstcolo GmbH), mail host mail.temp-host42.com, SPF record pointing to the same IP. No certificate is logged and no public scan exists. Those DNS records are as of 22 October 2026; on 23 October the registry record changed again, the domain moved to Cloudflare name servers and it no longer resolves (rdap.org, checked 24 Oct 2026). [Observation]
• `clalitilcom.com`. Registered on 17 Sep 2026 at the same registrar with the same four name servers. The only public scan, on 20 Sep 2026 at 18:40 UTC, shows https://clalitilcom.com/data/n.php served from 84.200.33.242 by nginx as a page that imitates a Cloudflare "you have been blocked" screen. The registry record was last changed on 21 Sep and shows client hold, and the domain no longer resolves. The name suggests an imitation of Clalit, an Israeli health fund, but no page content that proves this was recorded. [Observation] [Hypothesis] Public urlscan.io searches on 22 Oct 2026 for the three hosting families (the InMotion host, temp- host42.com, clalitilcom.com) returned no scan of a kit page. The only hit is the Cloudflare-style block page on clalitilcom.com described above. [Observation] Two domains that share a registrar, name servers and a server IP, registered three weeks apart, are probably run by the same party. That is an inference from infrastructure only. Ultahost is a normal commercial provider, so the registrar alone proves little; the shared IP and the SPF record that names it are the stronger link. Whether either domain runs Kit B, or any of our kits, is a hypothesis. [Inference] [Hypothesis]

Station 11: were the victims chosen beforehand?

A natural question, once a kit asks for an ID and a case number, is whether the operator already holds those numbers, for example from a leaked database, and sends each victim a personal link. We tested this against the code and the public record.

What would support the idea. Evidence that a visit begins on /payment-details with an ID and a case already in the URL and with no first-page notification before it, which would mean the link carried them; SMS text that quotes a name or ID; case numbers that turn out to be real when the issuing agency checks them. What would weaken it. Every /payment-details visit preceded by a first-page notification from the same browser, which is the path the code produces; the same message text going to many people with no personal detail; the form accepting invalid or made-up case numbers. The agency that holds the case numbers can settle this, and we cannot. For now: not supported by the code, not ruled out. [Hypothesis]

The wider family: same target, link not proven

The title string of the page is also the title of the real service, so any copy shares it. A urlscan search for that title on pages outside gov.il, on 22 October 2026, returned 111 scans across 10 domains since 24 July 2026, including compromised WordPress sites (for example agrisoft.it under /wp- content/plugins/, koding.nl under /wp-includes/, feroviarul.ro), two "watch" domains (govair.watch, gov-air.watch) and a third mytemp.website host (44g.0a9.mytemp.website/t/) that was reached on 21 October through 56 scanner visits to govil43.blogspot.* country-code domains, which redirect to it. [Observation] We did not find shared file hashes between these and the kits above, so we do not link them to the same operator. They show the target is being attacked by many parallel kits. The shared platform mytemp.website itself appears in over 10,000 public scans of unrelated pages, so the domain by itself is not an indicator of this operator. [Observation]

3. How the pieces connect

Retooling timeline, public records only

The chart below uses only public records: urlscan.io scan times, registry (RDAP) dates and certificate transparency. It does not use any notification content or victim data. It shows scans of the first kits in August to October, a hosting temporary URL and two Ultahost domains appearing in between and after, and the first of those domains going on registry hold three days after its only scan. [Observation]

Reading: each new deployment comes with a new host or a new bot, and the hosting changes family at least three times in ten weeks. The pattern fits an operator who treats hosts as disposable. It does not show that one operator ran all of it. [Inference]

4. The problem: what the attacker gets, and why it is worth the effort

A visitor who completes the flow hands over a complete payment identity: Israeli ID number, name, email, phone, card number, expiry and CVV, and then the one-time code the bank sends to authorize the charge. The pages are built to collect that last item. Kit B counts OTP attempts and tells the operator when the victim leaves. Kit C presents a card-verification screen with a dynamic issuer logo and appears to allow a single attempt. The OTP screen exists because the operator wants to use the card now, not sell it later. [Inference] A one-time code has a short life, so the operator needs to know the moment it arrives. That is what the Telegram bot is for. Securelist has documented OTP bots built to intercept such codes in real time ("How scammers bypass 2FA", 10 Jun 2024). The bot turns a web form into a live chat with the victim’s bank account. In other words, the click is the product, and the Telegram message is the delivery mechanism. The lure also fits the target. A fine or fee from a government collection center creates urgency, an official look and a small, believable amount (150 NIS on the Kit C page). The page hotlinks the real government spinner, copies the real header and search bar and uses the real page title. Everything a victim would check at a glance is correct. The only thing wrong is the domain name.

Public context: personalized smishing and fines lures in Israel

These public reports set the frame. None names this kit.

• The National Cyber Directorate warned on 23 Apr 2026 of SMS impersonating National Insurance that quote the recipient’s full name and ID number, probably from previously leaked data, and noted that government login systems have extra authentication layers: https://​www.​ynet.​co.​il/​news/​article/​skzngiv611e [Source date]
• Ynet reported on 7 Oct 2026 that a database combining the Agron (2006) and Elector (2020) leaks, with IDs, addresses, phones, vehicles and relatives of nearly every Israeli, is available for a few dollars: https://​www.​ynetnews.​com/​tech-​and-​digital/​article/​h1kjuamjfg [Source date]
• Israel Police warned on 20 May 2026 of SMS posing as the "Fines Collection Center" and the "National Drivers Inquiries Center", with a payment link: https://​www.​i24news.​tv/​he/​news/​news/​criminal/​artc-​029e418a . It warned again on 29 Jul 2026 (https://​www.​ynetnews.​com/​article/​aaxgrn7k8) and on 9 Sep 2026 (https://​news.​walla.​co.​il/​item/​3866790). These describe generic messages. [Source date]
• JDN, 3 Aug 2026, reporting an analysis by Cyvore: a fake gov.il traffic-fine page reached by SMS that streams typed fields to the attackers while the victim types and lets them push OTP or bank- app screens, technically identical to an Israel Post scam: https://​www.​jdn.​co.​il/​news/​2703827/ [Source date]
• PC.co.il, 19 Oct 2026, on a smishing network found by Reisen Labs that impersonates Israeli traffic police and other agencies: https://​www.​pc.​co.​il/​featured/​459937/ [Source date] The reports show that personalized lures with ID numbers exist in Israel and that live-panel kits for fines are common. They do not show that this kit uses personal data. [Inference]

5. Detection

For SOC and threat intelligence teams

• Hash hunting. Search your proxy, EDR and web-gateway telemetry, and urlscan or similar services, for the SHA-256 values in Appendix A. Start with the Kit A logo and app.css, and the Kit B logo and index-BRl0iJdM.js. A hit means the same file was served, regardless of the domain.
• Egress to Telegram from a web page. Browser-side calls to api.telegram.org/bot... from pages on non-Telegram origins are rare in legitimate traffic. A secure web gateway that inspects URLs can flag POST requests to the Bot API with a sendMessage path.
• Certificate monitoring. Watch certificate transparency for new names containing gov plus a near-miss word (govsercis, gov-air, govil plus digits), and for wildcard certificates on mytemp.website. Note that mytemp.website hosts a great deal of unrelated content, so score it as a weak signal.
• Page-level patterns. The Hebrew title "Fines, Fees and Expenses Collection Center" on any host that is not gov.il, and a gov.png or govil-logo.png image on a non-government origin.
• Shortener and Blogger chains. Treat redirects from short.gy, switchy.io and *.blogspot.* pages whose final destination is a payment-themed page on an unrelated domain as high risk.
• Hosting churn indicators. Alert on new domains registered at Ultahost with a mail host and SPF record on the same IP and a first request to /data/n.php; on certificates for *.temporary.link hosts that serve gov.il look-alike titles; and on short links ( s.gy, switchy.io)

whose preview page names the Fines Center and uses a government logo. Treat the shared- service domains (temporary.link, mytemp.website) as context, not as block lists. [Inference]

• First-page form behavior. A page that checks an Israeli ID check digit in the browser, makes no server request, and then writes the ID into the next URL is a kit pattern worth a content rule. [Inference]

For the organizations being impersonated

• Referrer monitoring on shared assets. Both Kit A scans contacted ecom.​gov.​il/​voucherspa/​resources/​images/​loading.​gif from a page on a foreign domain. Any request for a government asset whose Referer header is a non-gov.il host is a free, near-real- time phishing sensor. Teams that run the real application can alert on it.
• Takedown routes. Abuse reports with the scan IDs in Appendix B to Cloudflare (setp0il.online, govsercis.ing and govsercis.net sit behind it), Namecheap (162.213.255.54), GoDaddy and Host Europe (Kit B IPs), short.gy, switchy.io and Blogger. Report the bot IDs from Station 7 to Telegram so the bots can be banned.

6. Mitigation and what to do

Citizens

• A government fine is paid on a gov.il address. Do not enter a card on any page reached from a text message, a short link or a search result for a "fines center" on another domain.
• If you entered card details: call the issuer immediately and block the card. If you entered an OTP, treat the card as compromised. Do not wait for a charge to appear.
• Report the page to the Israel National Cyber Directorate’s 119 line (https://​www.​gov.​il/​he/​pages/​1192407) and keep the link.

Organizations and security teams

• Block the domains, IPs and short links in Appendix A at DNS and web gateway. Use the hashes for retro-hunts.
• Warn staff that a work phone or laptop can also be a payment-fraud target. Employees who pay a personal fine from a corporate device create an incident for you too.
• Banks and card issuers: put the merchant and amount in every OTP message, and flag OTP requests that follow a card first seen in the last minutes on an unusual device. These kits ask for the OTP seconds after the card number.
• Share indicators with your sector CERT and the national directorate. Public scans suggest these kits stay live for weeks: the earliest Kit A scan we found is 23 August, and its verdict reached 100 only on 20 October.

A management view: three questions for a CISO or a risk owner

7. What we cannot say

• Attribution. We do not name an operator, group or country. Shared Arabic in code comments is not evidence of origin. Part II records one personal assessment of the operators from a secondhand chat summary, with its limits. It is not a finding of this report.
• Scale. We have no count of victims, no count of stolen cards and no loss figure. A scan records a page, not a person.
• Compromise versus ownership. Whether highnefix.com and the WordPress sites in the wider family are attacker-owned or compromised is not established.
• Completeness. Our correlations hold for the public urlscan.io record. Private scans, unscanned deployments and other kit versions can exist. The "exactly three" and "exactly two" counts are counts of public scans on 22 October 2026, not of deployments.
• Behind the form. We did not submit data, so the later steps of Kit A and the server-side behavior of send.php are inferred from client-side code and screenshots only.
• Who the new hosts belong to. We did not establish who controls temp-host42.com, clalitilcom.com or the InMotion host, whether they run Kit B, or whether the two Ultahost domains are linked to our kits at all. The link between them is infrastructure overlap only. The lead that first named them is not a public source and is not reproduced here.
• Whether victims were pre-selected. The code does not need pre-acquired data and the two stored lure links carry none. That is not proof that no list was used for sending. Only SMS samples and the agency’s case records can settle it.

8. What this tells us about the next year

• AI builders lower the cost of a new kit. Kit B shows builder metadata and a clean route-per- step structure. Expect more variants with cleaner code and faster redeploys, so detection should rely on behavior (Telegram egress, shared-asset hotlinks, certificate patterns) as much as on file hashes.
• The Telegram identity is the weakest part and the most useful for defenders. Each rebuild leaks a new bot ID. Tracking bot IDs across scans, and reporting them to Telegram, imposes real cost on operators.
• Real-time OTP relay will stay the goal. As long as one-time codes authorize card payments, kits will keep a live channel from the victim to the operator.
• Public government assets are a free fingerprint. Anyone who runs a heavily copied service can learn which fakes are live by watching who loads its images.

Part II. The notification feed and the operators

Sections 1 to 8 rest on public records only. This part adds material supplied to me from the Telegram notification chat that one Kit B deployment writes to, and a third-party summary of a conversation between two people who appear to watch it. Every screenshot is redacted in the pixels: victim IP addresses (IPv4 and IPv6), identification and case numbers, the second form field, victim-specific URL parameters and the victim’s city are blacked out, and I checked each image after rendering. What stays visible are the alert types, the kit host names, the provider and country, the dates and the browser data that make the alerts match the public code. I did not use any token and I did not contact anyone. Chat-derived items are tagged, and the summary of the operators’ chat is tagged [Secondary source] because I did not see the original.

The alerts match the public code, line by line

The bot sends a Telegram message for each step of a visit. The labels are in Arabic. The alert types seen in the screenshots map one to one to the stored Kit B code (scan 01a13f6c).

Timeline from the feed

I read the feed as main activity from 17 to 27 Aug 2026, sparse until 14 Sep, and a new burst on 21 Oct on a new host (temp-host42.com), which would fit retooling or a new wave. The dated alerts I could read fall on 24 and 25 Aug, 10 and 14 Sep and 21 Oct. These are the only dates I could read, and they are not a count of victims. [Observation]

Who visited, and where

• On 10 and 14 Sep the alerts show Samsung phones set to Hebrew, on Israeli mobile-carrier ranges, visiting a payment page on an InMotion temporary.link host. This is a second hosting family beside mytemp.website. [Observation] An alert shows a visit, not a loss, and I make no claim about what happened to those visitors.
• On 21 Oct an alert came from the new host temp-host42.com in a browser set to Arabic (Egypt), with a UK-geolocated address on a fixed-line ISP. The code produces this alert type, so that host runs this alert code or a copy of it. One alert cannot tell a victim from a tester or an operator. [Observation] [Hypothesis]
• Two first-page alerts (24 and 25 Aug) carry the same value in the second field for two different IDs. The form does not prefill it. If both visitors typed it, it came from something both received, for example a shared number in the lure message. That would point to a generic message, but two cases are too few to conclude. [Observation] [Hypothesis]

The operators’ own chat, as summarized by a third party

Everything here comes from a summary of the chat, not from the chat. I have not seen the original, the writer is unknown and the summary may be machine-made. Each point is a claim to verify. [Secondary source]

• Two handles. "NightShadow" gives instructions and "Sup" runs the interface and reports live. Two handles in one chat do not prove that only two people are involved. [Secondary source]
• Manual, real-time handling. They watch the feed as a victim moves from step to step, nudge each other when a victim stalls, and react to wrong codes and to people who leave. [Secondary source]
• Friction at the bank step. They complain about "app protection" and about a victim who would not type a code into the page and confirmed only by call or in the bank app. The summary reads this as: confirmation by app or phone blocks them and an SMS code exposes the victim. That fits a kit built to relay the one-time code. [Secondary source] [Inference]
• A cash-out claim. The summary says the operators convert charges (250 or 400 NIS are mentioned) into "Dream" credit, and that one message complains that "Dream will not pay out for me". This is the summary’s reading of a few messages and it is unverified. [Secondary source] [Hypothesis]
• Tests. The operators seem to tell test records from real visitors and to track whether someone came back. That is consistent with the 25 Aug dev-tools alert coming from the operator side, or from an outside analyst. The alerts alone do not decide. [Secondary source] [Hypothesis]
• A mention of Jerusalem could be a victim’s location or an operator’s. The summary says so itself. [Secondary source]

My assessment of who they are, and its limits

This is my assessment, not a finding. From the language in the summary I think the operators are probably a Palestinian group. I state it as a personal reading of weak, secondhand evidence. It is not established, it is not a conclusion of this report, and it must not be used to identify, accuse or report any person or community. The limits below apply to every word of it.

The basis I am relying on. The summary describes the chat as colloquial, non-standard Arabic and names these markers: "⁧هيو⁩" (here he is), "⁧يا زلمه⁩" (man), "⁧شو هاض⁩" (what is this), "⁧حضر حالك⁩" (get ready), a "⁧ما...ش⁩" style of negation (for example "⁧مدفعش⁩", "⁧مش راضي⁩"), and an English word inside an Arabic sentence. The summary also describes a small manual team, a cash-out through Dream credit and a mention of Jerusalem, and I noted that Hebrew-speaking victims appear in the alerts while the kit’s Arabic labels look Egyptian. [Secondary source]

Limits of the evidence.

• Dialect is not nationality or location. A way of speaking shows a linguistic background at most. Levantine Arabic is spoken by Palestinians, Jordanians, Lebanese, Syrians, Arab citizens of Israel and large diaspora communities, and others learn it. It does not say where a person is or what passport they hold. [Inference]
• The marker list is mixed. The "⁧ما...ش⁩" negation is usually associated with Egyptian Arabic and also occurs in some other varieties. "⁧مش⁩" is common in Egyptian and in most Levantine speech. "⁧شو⁩" and "⁧يا زلمه⁩" point to the Levant. The summary’s own examples therefore do not single out one variety, and I am not a dialectologist. If dialect matters, a qualified expert should read the original messages. [Inference]
• The summary is secondary and unverified. The writer is unknown, the text may be machine-made, and its strong words ("unambiguous", "clearly") go beyond what a few quoted phrases can carry. I cannot check its translations. [Secondary source]
• Speech can be chosen. A dialect can be picked for convenience, for the team, or to look like someone else. A false flag is possible and cheap. [Hypothesis]
• Kit authors, kit users and chat participants are different questions. Kit B carries AI-builder strings, and kits are copied, sold and redeployed. The Arabic in code comments says little about who sits in the chat. [Observation] [Inference]
• Geopolitical reasoning is not evidence. That the target is Israeli does not say who attacks. Financially motivated crews copy government payment services in every country, and this kit copies a payment page to collect money, not to send a message. [Inference]
• The Dream cash-out is unverified. "Dream Card" is a mainstream Israeli shopping-credit product with its own public site (https://​www.​dreamcard.​co.​il/, found by search on 22 Oct 2026). Whether ""دريم in the chat means that product is not established. The summary’s claim that it is typical of one community has no source that I could find. [Observation] [Hypothesis]
• Two handles are not two operators in total. A chat shows who writes in it, not who built, funded or profits from the operation. [Inference] What would be needed to attribute. Several independent sources: infrastructure and cash-out traces, records held by law enforcement, the original messages read by a qualified expert in Arabic dialects, and independent confirmation. None of these is in this report. Until then the finding is that the operators are unknown, which is also what sections 1 to 8 say.

Hypotheses about tradecraft, not about identity

• The operators depend on a live victim and on SMS one-time codes, and they lose the sale when the bank asks for in-app confirmation. [Secondary source] [Inference]
• Hosting churns across GoDaddy temporary hosts, InMotion temporary hosts, Ultahost and Cloudflare, which fits a team that redeploys faster than it is taken down. [Observation] [Hypothesis]
• The identical second field in two first-page alerts weakly suggests a generic lure with a shared number, not a list of pre-acquired personal data. This updates Station 11 and is still unproven. [Observation] [Hypothesis]

Recommendations that follow from the feed

• Banks and card issuers: confirm card payments in the issuer’s app instead of by SMS code, with the merchant name and amount shown in the approval. In this chat the app step is the one the operators complain about. [Inference]
• Citizens: never type a one-time code into a page you reached from a message. If a bank app asks you to approve a payment you did not start, decline it and call the bank.
• Infrastructure reports: report the hosting and the bot IDs through the proper channels, using only public-record facts (domains, IP 84.200.33.242, the InMotion temporary.link host, bot IDs, scan IDs, dates).

Added limits for this part

• The screenshots and the operators’ chat reach me as redacted images and a secondhand summary. I cannot verify that the alerts are all from one deployment, and I make no claim about victim numbers or losses.
• Nothing here identifies a person, a group or a country, and I did not test any claim by contacting anyone.

Appendix A. Indicators of compromise

Values were re-checked against urlscan data on 22 October 2026. Domains and URLs are shown defanged; plain copies follow in the same appendix for tooling. Telegram token secrets are intentionally omitted.

Post-cutoff note (added 25 October 2026): A urlscan capture dated 24 October 2026 recorded an additional phishing page at seivosio.co.uk/I0/0ilgovi/. The page served app.css and gov.png assets byte-identical to those documented for Kit A and was classified by urlscan as Israeli-government phishing (score 100). These static-asset matches do not establish that the full kit code or operator is the same. This update records a single observation, not continuous activity. Source: https://​urlscan.​io/​result/​01a16f7a-​9ff6-​71b8-​a7d7-​6247542f0a6b/

A1. SHA-256 file hashes

Not useful as indicators: the 50-byte placeholder chunks of Kit B, and the response of send.php ({"status":"success"}, SHA-256 starting 912d0c07), which matches more than 10,000 unrelated scans.

A2. Domains (defanged)

• setp0il.online
• govsercis.ing
• govsercis.net
• seivosio.co.uk
• bsg.highnefix.com
• highnefix.com
• lome.highnefix.com (directory listing, no kit seen)
• 40c.f25.mytemp.website
• p8s.728.mytemp.website
• tgplou.s.gy (short.gy link host)
• hi.switchy.io (switchy.io link host)
• temp-host42.com (registered 2026-10-10, Ultahost; kit link is a hypothesis)
• clalitilcom.com (registered 2026-09-17, Ultahost; on registry hold since 2026-09-21)
• 1786862921bfd55fc1bab1bf07.temporary.link (InMotion temporary URL, cert 2026-08-16; kit link is a hypothesis)
• mail.temp-host42.com (MX of temp-host42.com)
• temporary.link (shared InMotion service; do not block the domain)

A3. IP addresses (defanged)

• 172.67.197.23 (setp0il.online, Cloudflare)
• 188.114.96.3, 188.114.97.3 (govsercis.ing, Cloudflare)
• 172.67.222.18 (govsercis.net, Cloudflare)
• 162.213.255.54 (highnefix.com, Namecheap)
• 107.180.116.166 (40c.f25.mytemp.website, GoDaddy US)
• 92.205.174.96 (p8s.728.mytemp.website, Host Europe DE)
• 84.200.33.242 (temp-host42.com and clalitilcom.com, firstcolo, Frankfurt)
• 23.235.219.250 (InMotion temporary.link host, Los Angeles)

A4. URLs (defanged)

• https://setp0il.online/gigi/
• https://govsercis.ing/0ilgovi/
• https://seivosio.co.uk/I0/0ilgovi/
• https://govsercis.net/g-vie/
• http://highnefix.com/vog1 > https://bsg.highnefix.com/vog1/
• https://bsg.highnefix.com/vog1/send.php (POST beacon)
• http://tgplou.s.gy/jkQ2Zc > http://40c.f25.mytemp.website/
• https://hi.switchy.io/118X9 > https://p8s.728.mytemp.website/
• https://clalitilcom.com/data/n.php (imitation block page, scan 2026-09-20)
• https://temp-host42.com/ (path seen in a lead, not in a public scan)

A5. Telegram identifiers (token secrets omitted)

A6. Related by target only, not linked by evidence

govair.watch, gov-air.watch, 44g.0a9.mytemp.website/t/ (via govil43.blogspot[.]*), agrisoft.it, koding.nl, feroviarul.ro, ethical-shields.com, admintegral.com.ar, gov4m.blogspot.com, goviwt.blogspot.com. These carry the same page title or were seen in related chains. Some may be compromised legitimate sites; do not block them on this report alone.

A7. Plain-text lists for tooling

SHA-256 hashes

a5f1fbd6bd899601472130fdb8dd804a9f50867e907903a8ccccc5a78a4acae8
6f7e42c06bb38393cb3d83bd2feea264a998422e298c95d052d7ad370883bd89
7d74a38e8d5c0c4d78c3606e75d3c21d292e52ed4a4d3b09a19b3f4ec0b2b69b
ac8678f66e4504f1a67bd6127d1f6cfc78836445b30b3eac566a1aaa9c26b7c2
b2dfd7f9d2c055eda71aac81f4f6f22caa24a694ac94ecec149200540711ec4d
1aa1ce29d9486eeb931578ef07bcb33dae601b4fe62eb2d216685ba8a8f4e211
74617a028905ce0008270d50b14ef5e8ef8b1cb146497cb2d981515380991aa0
e073aac9f75e057b9a61efed0c160c4d45dda865dfb54c18b9379ec1d99f9c76
dde854a8914e1019a3f21016b43e16058bbe2974767bf0b12c0d1dc4aefd07cb
f185815c4b91a028fe6bf228071ee89f6cc653aac9681fa63a784856f8628750
220f0191cd5ac2d9c352c9ae2ae6365515aeec0e25be27b2bd7d9b6a13cac579
e1e9931cc2ff81cb4cc7db8305b0a0330c6abe081d5f34db3365c49bbe2bc48f
84bb9c0f67f56a5a6a68fdc8e8cdc4512c95cfc098ce3f27812959ff15e30ba5
1949f98ec92df3dcde3d84f19b61f71eaadbef9ce6a43029adb13a14bbc4bfbc
fe5e36bbd58cf0df9c0bb35122ddad59512c39a3ecceeef583ceea09866fbfb6

Domains

setp0il.online
govsercis.ing
govsercis.net
seivosio.co.uk
bsg.highnefix.com
highnefix.com
lome.highnefix.com
40c.f25.mytemp.website
p8s.728.mytemp.website
tgplou.s.gy
hi.switchy.io
temp-host42.com
clalitilcom.com
1786862921bfd55fc1bab1bf07.temporary.link

IP addresses

172.67.197.23
188.114.96.3
188.114.97.3
172.67.222.18
162.213.255.54
107.180.116.166
92.205.174.96
84.200.33.242
23.235.219.250

URLs

https://setp0il.online/gigi/https://govsercis.ing/0ilgovi/https://seivosio.co.uk/I0/0ilgovi/https://govsercis.net/g-vie/http://highnefix.com/vog1https://bsg.highnefix.com/vog1/https://bsg.highnefix.com/vog1/send.phphttp://tgplou.s.gy/jkQ2Zchttps://hi.switchy.io/118X9https://clalitilcom.com/data/n.php

Appendix B. Evidence register

Public urlscan.io result pages. Times are scan times in UTC.

References

• Olga Altukhova, "Where does the data stolen in a phishing attack go?", Securelist, 12 Dec 2025. https://​securelist.​com/​what-​happens-​to-​stolen-​data-​after-​phishing-​attacks/​118180/
• "How scammers bypass 2FA", Securelist, 10 Jun 2024. https://​securelist.​com/​2fa-​phishing/​112805/
• Israel National Cyber Directorate, 119 operational center. https://​www.​gov.​il/​he/​pages/​1192407
• Registry (RDAP) records via rdap.org for temp-host42.com, clalitilcom.com and temporary.link; certificate transparency via crt.sh; ipinfo.io and bgp.he.net for IP and AS data, queried 22 Oct 2026.
• Israel National Cyber Directorate warning on National Insurance SMS, ynet, 23 Apr 2026: https://​www.​ynet.​co.​il/​news/​article/​skzngiv611e
• Ynet, "Personal data of nearly every Israeli available online for just a few dollars", 7 Oct 2026: https://​www.​ynetnews.​com/​tech-​and-​digital/​article/​h1kjuamjfg
• JDN, smart phishing attack impersonating gov.il, 3 Aug 2026: https://​www.​jdn.​co.​il/​news/​2703827/
• PC.co.il, global smishing campaign impersonating authorities reaches Israel, 19 Oct 2026: https://​www.​pc.​co.​il/​featured/​459937/
• Israel Police warnings on fake fines messages: https://​www.​i24news.​tv/​he/​news/​news/​criminal/​artc-​029e418a , https://​www.​ynetnews.​com/​article/​aaxgrn7k8 , https://​news.​walla.​co.​il/​item/​3866790
• Sniply, how Sniply handles UTM tags: https://​support.​snip.​ly/​hc/​en-​us/​articles/​20000965256084-​How-​does-​Sniply-​handle-​UTM-​Tags
• InMotion Hosting, temporary URL: https://​www.​inmotionhosting.​com/​support/​website/​using-​your-​temporary-​url/
• urlscan.io public scan record and search API, queried 22 Oct 2026 (hash and title searches as described in the text).