Here’s the Exact Attack That Did It (And What to Do)

A real incident, fully documented — including the phishing email, the attack chain, and every step I took to report it.

Last month, a friend of mine received a professional-looking email. It appeared to come from someone in her industry — a real person she knew. The subject was an Invitation to Bid for a large commercial construction project. The body was polished, detailed, and entirely plausible. There was a link to a PDF of the project documents.

She clicked it.

Thirteen days later, at exactly 9:00 AM, her Gmail account sent that same email to every single person in her contacts.

This is the story of how that attack worked, what I did about it, and — most importantly — what you should do if it happens to you or someone you know.

What the Email Looked Like

The email that arrived in my inbox (sent from her account, to her entire contact list, at 9AM on June 1st) looked like this:

It read exactly like a real construction industry ITB. It had a plausible company name, a realistic project scope, a future construction date, a bid deadline. If you work anywhere adjacent to real estate, construction, architecture, or development, you would have no immediate reason to be suspicious.

Note: Gmail flagged this as spam — but only because of pattern-matching against previously seen campaigns. For recipients encountering this style of email fresh, most would open it without hesitation.
phishing email example impersonating construction bid invitation to steal Gmail credentials

The Attack Chain: How It Actually Works

This is what security researchers call a multi-stage credential-phishing operation, and it’s more sophisticated than the scams most people picture when they think of phishing.

Stage 1 — The Lure (a compromised real account)

The email didn’t come from a fake address. It came from a real person’s genuine Gmail account who had already been compromised. Attackers specifically target real accounts because they bypass spam filters, carry the trust of an existing relationship, and are far more convincing than spoofed addresses.

Stage 2 — The Lure URL (a purpose-built website)

The “PDF link” didn’t go to a PDF. It went to a website registered literally the day before the emails started going out. The landing page presented a professional-looking project documents portal and asked for an email address to “log in and access the files.” This is the hook: it feels like a legitimate document-sharing platform.

Stage 3 — The Harvester (a fake Google sign-in page)

After entering an email address, the victim was redirected to a page that looked exactly like Google’s sign-in screen — but the URL was a long, complex domain deliberately designed to look like a technical Google subdomain at a casual glance. The victim entered their Google password. The attacker captured it in real time.

Stage 4 — Account Takeover and Waiting

This is where the attack gets patient. Credentials were taken on May 19th. The attacker waited 13 days — then at exactly 9:00 AM on June 1st, used the account to blast the same lure email to every contact. The delay and automation are deliberate: they maximise spread while minimising the window for intervention.

The Timeline

May 18

Credential harvester domain registered (one day before the attack).

May 19

Friend clicks lure link, enters email address, is redirected to fake Google login, enters password. Credentials captured.

May 31

Lure domain registered (one day before the mass send).

June 1, 9:00 AM

Automated campaign fires. Phishing email sent to entire contact list from my friend’s compromised Gmail account.

What the Infrastructure Tells Us

When I looked up both phishing domains using WHOIS and RDAP tools — without ever visiting them — a clear picture emerged. Both domains were registered within days of being used. Both registrations were privacy-protected. The harvester domain used Cloudflare’s nameservers to obscure the real server. The lure domain was hosted by Namecheap and registered through IONOS.

This is the economics of phishing at scale: domains cost a few dollars, the tooling is automated, and even a 1% success rate across thousands of contacts yields a significant harvest of compromised accounts — which are then used to send the next wave.

What I Did About It

After documenting everything and making sure never to visit the phishing URLs directly, I submitted both URLs to the following services:

Google Safe Browsing — This feeds the database that triggers the red “Dangerous site” warning in Chrome, Firefox, and Safari. Both submissions confirmed successful.

Netcraft — One of the most effective phishing takedown services globally. Netcraft often contacts hosting providers directly to initiate suspension. Both submissions acknowledged.

I then sent manual abuse reports to: the registrar for each domain, the relevant TLD registry, the hosting provider for each IP address, and Cloudflare for its DNS role in the attack chain. Each email included the full URL, IP address, domain registration date, and a description of the attack chain.

The full step-by-step process — including exactly where to submit, what to look up, and the email template I used — is in the SOP section below.

What the Victim Needed to Do

Time matters here. The steps below need to happen in this specific order:

  • Change the password — on a clean device, not the one used to click the link.
  • Sign out of all sessions — at myaccount.google.com/security → “Your devices.” Changing your password does not automatically close open sessions.
  • Revoke third-party app permissions — at myaccount.google.com/permissions. This is the most-skipped and most critical step. Attackers frequently authorise an OAuth app during their brief access window. That app can continue reading and sending email even after the password is changed.
  • Check Gmail settings — look for unexpected forwarding rules, filters that silently delete incoming emails (which can hide security alerts), and any “Send mail as” aliases the attacker may have added.
  • Enable two-factor authentication — using an authenticator app, not SMS where possible.
  • Warn your contact list — by phone or from the now-secured account, let people know not to click the link if they received it.

Red Flags to Recognise Next Time

Looking back at the email, the warning signs were there — they just required a different kind of reading than most of us apply to professional correspondence.

  • The BCC structure. The “to” field showed the email was sent to the sender themselves, with all recipients BCCed. Legitimate business ITB emails don’t usually BCC everyone.
  • The link text said “.pdf” — but it wasn’t. Links in email can display any text regardless of their actual destination. Always hover over a link to see the real URL before clicking.
  • You were asked to log in to access a PDF. That’s not how PDFs work. If a link leads to an unexpected login screen — especially one that looks like Google or Microsoft — stop and check the URL bar.
  • The domain didn’t match Google. The real Google sign-in lives at accounts.google.com. Any other domain, no matter how long or technical-looking, is not Google.
  • The project details were specific but generic. Real enough to feel credible; vague enough to apply anywhere. A hallmark of well-researched phishing templates.

The Bigger Picture

The thing that makes this attack effective isn’t the technology — it’s the social layer. It came from a real person. It used a real industry format. It asked for something plausible. The fake Google login page looked identical to the real one because the attackers simply copied the design.

The most reliable defences are: pause before entering credentials anywhere unexpected, always check the actual URL in the address bar before typing a password, use a password manager (which won’t autofill on a fake domain because it checks the URL), and enable two-factor authentication so that a stolen password alone isn’t enough.

If this happens to you or someone you know, the reporting SOP below gives you the full process. It won’t undo the compromise — but it can get the phishing domains taken down faster, protecting everyone in the next wave of contacts.

Check out my free resource: Peace of Mind in 15: Secure Your Google Account – this is a step-by-step how-to-secure your Google Account(s) workshop.

SOP: How to Report Phishing Domains Step by Step

This is the exact process I followed. Work through all five phases in order — the automated submissions are fast, the manual abuse emails take the most time but are the most likely to result in actual takedowns.

Key rule before you start: Never navigate to a suspicious URL directly in your browser. Only ever paste phishing URLs into report forms and lookup tools — never visit them.

Phase 1 — Triage (Do This Within the First Hour)

  1. Identify and record every URL in the attack chain. A typical operation has at least two: a lure URL (what the victim clicks from email) and a harvester URL (the fake login page). Note all of them.
  2. Screenshot the phishing email before anything is deleted. Note the From address, display name, Reply-To if visible, timestamp, and subject line. Save everything to a dated folder.
  3. Assess account compromise. If the email came from a real person’s account, contact them by phone — not email — immediately. A compromised account sending to a full contact list is an active, ongoing harm.
  4. Extract the bare domain names from each URL. From a long URL like https://c31eb0.somethinglong.org/v3/signin/... you just need somethinglong.org. Write down every distinct domain.

Phase 2 — WHOIS and Infrastructure Lookup

For each domain, look it up at who.is or use these RDAP endpoints directly (faster and more reliable):

  • .org domains: https://rdap.publicinterestregistry.org/rdap/domain/[DOMAIN]
  • .com domains: https://rdap.verisign.com/com/v1/domain/[DOMAIN]
  • IP / hosting lookup: https://rdap.arin.net/registry/ip/[IP_ADDRESS]

For each domain, record: registrar name and abuse email, registry abuse email (see table below), domain creation date — flag anything registered within days or weeks as highly suspicious — nameservers, IP address, and hosting company with its abuse email.

Phase 3 — Submit to Blocklist Authorities

These submissions feed the databases that protect users in Chrome, Firefox, Safari, and most security products. Do them for every URL in the chain.

  1. Google Safe Browsing — safebrowsing.google.com/safebrowsing/report_phish/
    Set: Report Type → This page is not safe / Threat Type → Social Engineering / Threat Category → Email Provider Phishing. Paste the full URL, add a description, submit. Wait for the green “Submission was successful” confirmation. Repeat for every URL.
  2. Netcraft — report.netcraft.com/report
    Toggle off “With Email” (submissions still go through without it). Toggle on “Add further details” and paste your description. Submit each URL separately.
  3. Microsoft SmartScreen (optional, protects Edge and Outlook users) — microsoft.com/en-us/wdsi/support/report-unsafe-site
  4. PhishTank (optional, free account required) — phishtank.org/add_web_phish.php

Phase 4 — Send Manual Abuse Emails

Blocklist submissions don’t result in domain suspension. That requires contacting the humans who control the infrastructure. For each domain, email all of the following:

  • The registrar abuse contact (found in WHOIS/RDAP)
  • The registry for the TLD (see reference table below)
  • The hosting company abuse contact (found in IP RDAP lookup)
  • [email protected] if Cloudflare nameservers are in use

Abuse email template:

Subject: Phishing Domain Takedown Request — [DOMAIN NAME]

To Whom It May Concern,

I am writing to report an active credential-phishing operation using
a domain under your management.

Domain: [DOMAIN]
Full phishing URL: [FULL URL]
IP address: [IP]
Date first observed: [DATE]
Domain registration date: [DATE — flag if very recent]

This domain is being used to impersonate [Google / other] account
sign-in pages to steal user credentials. It is part of an attack
chain that also includes [OTHER URLS].

A real person’s email account was compromised through this attack
on [DATE]. The attacker subsequently used that account to send
phishing emails to the victim’s entire contact list.

I have already reported this domain to Google Safe Browsing and
Netcraft. I am requesting immediate suspension of this domain /
termination of hosting / removal of DNS service.

Please confirm receipt of this report.

[Your name or handle — anonymous reports are accepted]

Phase 5 — Secure the Compromised Account

These steps must be done in this exact order. Do not skip step 3.

  1. Change the password on a clean device — not the one used to click the link.
  2. Sign out of all sessions at myaccount.google.com/security → “Your devices.” Changing a password does not close open sessions.
  3. Revoke all third-party app permissions at myaccount.google.com/permissions. This is the most-skipped and most dangerous step to skip. Attackers routinely authorise an OAuth app during the brief window they have access — that app can continue to read and send email even after the password is changed. Revoke anything unrecognised.
  4. Audit Gmail settings: check Forwarding (Settings → Forwarding and POP/IMAP), Filters (Settings → Filters and Blocked Addresses), and “Send mail as” for anything the attacker may have added.
  5. Enable two-factor authentication using an authenticator app. SMS-based 2FA is better than nothing but weaker than an app.
  6. Warn your contact list by phone or from the now-secured account. Anyone who received the phishing email should be told not to click the link and to delete it.

Quick Reference: Abuse Contacts by Role

Who Role Abuse Contact
NameSilo Registrar (.org) [email protected]
Public Interest Registry (PIR) Registry (.org TLD) [email protected]
Verisign Registry (.com TLD) [email protected]
IONOS SE Registrar (.com) [email protected]
servinga GmbH Hosting (harvester domain) [email protected]
Eonix Corporation Upstream network (servinga) [email protected]
Namecheap Hosting (lure domain) [email protected]
Cloudflare DNS / CDN [email protected]

Quick Reference Checklist

  • Screenshot and document all phishing URLs — do not click them
  • Identify lure domain and harvester domain separately
  • Run WHOIS on both domains — record registrar, host, IP, creation date
  • Submit both URLs to Google Safe Browsing — confirm success message
  • Submit both URLs to Netcraft
  • Email registrar abuse for each domain
  • Email registry abuse for each TLD
  • Email hosting abuse for each IP
  • Email [email protected] if Cloudflare DNS is involved
  • Victim: change password → sign out all sessions → revoke OAuth apps → audit Gmail settings → enable 2FA
  • Victim: warn contact list by phone or secured account

The specific domains and URLs referenced in this post have been reported to Google Safe Browsing, Netcraft, all relevant registrars, hosting providers, and the .org registry. No links to the phishing sites appear anywhere in this post. The victim’s name has been changed.

 

No one should suffer the loss of their Google Account data! Check out my free resource: Peace of Mind in 15: Secure Your Google Account – this is a step-by-step how-to-secure your Google Account(s) workshop.