Threat ResearchApril 9, 20267 min read

Anatomy of a $1.19 Phishing Campaign: How Attackers Impersonated Dubai Customs in Under 4 Hours

Our threat research team dissected a live phishing campaign targeting UAE residents. The attackers registered a domain, deployed a multi-stage credential harvesting kit, and started sending messages — all in less than 4 hours. Here's what we found.

Key Findings

  • 1. Attackers spent $1.19 on a domain, used free infrastructure (Cloudflare DNS, Let's Encrypt SSL), and launched a complete phishing operation in under 4 hours.
  • 2. The phishing kit collected full names, emails, phone numbers, physical addresses, and credit card details across a 3-page flow impersonating Dubai Customs.
  • 3. Zero out of 94 VirusTotal vendors detected the domain as malicious. The campaign was born and died within 24 hours — faster than any blocklist could respond.
  • 4. Cyntelligence's phishing detection engine identified the campaign within hours of domain registration, before the first victim clicked.

The Attack: A Customs Clearance That Never Existed

On April 8, 2026, multiple UAE residents received iMessages from disposable Hotmail accounts. The messages were bilingual (English and Arabic), claimed a customs shipment was on hold, and urged recipients to “review the information by 8 April” via a link to what appeared to be a Dubai Customs portal.

The link led to a convincing 3-page phishing operation:

1

Fake Customs Tracking Portal

A fabricated shipment timeline showing “Package Collected,” “Departure Scan,” and “Arrived at Hub” with realistic dates. The final status showed “Customs Clearance On Hold” with an error badge, citing “regional instability and updated security protocols” as the reason. Complete with the real Dubai Customs logo and references to the legitimate Al Munasiq app.

2

Personal Information Harvesting

A “Delivery Address” form collecting full name, email, phone number, and complete physical address. The form included UAE-specific fields — Emirate dropdown, Area/District, Building/Villa number — showing the attackers understood their target audience.

3

Credit Card Theft

A “Quick Payment” page requesting a “Clearance Activation Fee of AED 20.00” — small enough to seem legitimate. Card number, expiry, CVC, and cardholder name. Seven payment brand logos (Visa, Mastercard, Amex, JCB, Discover) for credibility. A “Secure Payment” badge at the bottom.

The Infrastructure: Built for Speed and Disposability

What makes this campaign notable isn't its sophistication — it's the economics. The entire infrastructure cost was under $2 and was designed to be abandoned within hours.

Campaign Economics

Domain
.top TLD — $1.19/year from a bulk registrar
DNS
Free tier CDN provider
SSL Certificate
Free, auto-issued
Privacy
Free WHOIS privacy service (bundled with registrar)
Total Cost
~$1.19
Time to Launch
Domain registered to first SMS: < 4 hours
Active Lifespan
< 24 hours (abandoned before blocklists update)
Detection Rate
0 out of 94 security vendors (VirusTotal)

The URL structure was designed to deceive at a glance: dubai.<random>.top/ae — mimicking the look of dubai.customs.gov.ae when viewed quickly in a text message.

Why Traditional Defenses Miss These Campaigns

This campaign exploited a fundamental gap in traditional security:

What the Infrastructure Reveals About the Attacker

By analyzing the domain registration patterns, we identified several fingerprints that connect this campaign to a broader operation:

How Cyntelligence Detected This Campaign

Our phishing detection engine identified both domains within hours of registration — before the first phishing message was sent to victims.

The detection relied on monitoring the public infrastructure that all phishing campaigns must use: domain registration records and SSL certificate issuance. When a new domain is registered containing brand keywords that matter to your organization, our engine flags it automatically, enriches it with infrastructure intelligence, and assesses the risk.

For these domains, the combination of signals was unambiguous: brand-new registration, high-risk TLD, privacy protection, and — once the pages went live — credential harvesting forms with UAE-specific fields. Our AI investigation agent produced a full analysis report including the campaign fingerprint, impersonated brand, data at risk, and recommended blocking actions.

The identified infrastructure fingerprint was then converted into a detection rule. Any future domain from this actor — using the same registrar, privacy service, and URL patterns — will be caught automatically at the moment of registration.

What Your Organization Should Watch For

  • New domains containing your brand name on cheap TLDs (.top, .xyz, .click, .info, .online)
  • Domains using your brand as a subdomain (e.g., yourbrand.random.top)
  • SMS/iMessage campaigns referencing customs, deliveries, or account verifications
  • Payment requests for small amounts (“fees” under AED 50) designed to seem legitimate
  • Bilingual content targeting specific regional audiences

Indicators of Compromise

The following IOCs were extracted from this campaign and are available in the Cyntelligence threat intelligence database:

Published IOCs

Domains
custbms[.]top, dubai[.]custbms[.]top, aeirxt[.]top, dubai[.]aeirxt[.]top
URLs
hxxps://dubai[.]custbms[.]top/ae, hxxps://dubai[.]aeirxt[.]top/ae
Campaign
UAE-Customs-Phishing-2026-04

Don't Wait for the Blocklist

Cyntelligence detects brand-impersonating phishing domains within hours of registration — before attackers send the first message. See how proactive phishing detection works for your brand.

Request a Demo

Published by the Cyntelligence Threat Research Team · April 9, 2026