The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs

By Shikhar Dalela and Jeewan Singh Jalal

The operators named the kit themselves.

Buried inside compromised legitimate websites, the hidden staging directory is sometimes literally called “/.bulletproof”, and the PHP session cookie the kit sets on every visitor is named “bp_redir_sess.” The “bp” stands for bulletproof, which is an unusual degree of candor from a threat actor whose entire design philosophy is concealment.

This kit defeats URL reputation checks that secure email gateways (SEG) perform on the email’s Call-to-Action links. But getting past SEGs is a secondary benefit. The kit's primary function is protecting the adversary-in-the-middle (AiTM) infrastructure that sits behind it.

By routing delivery exclusively through disposable compromised websites, the operator ensures their AiTM backend (the infrastructure that actually harvests credentials and authenticated sessions) never appears in any phishing email. Our analysis reveals that confirmed downstream platforms include Sneaky2FA and Tycoon 2FA, which are both adversary-in-the-middle kits that intercept authenticated sessions in real time. Email-based threat intelligence can identify and block the compromised hosts (Bulletproof redirectors) freely; the actual phishing backends remain untouched. The redirectors are designed to be burned.

Read on for our analysis of a large set of confirmed inbox delivery events from this kit.

Key Findings from the “Bulletproof” Blind Redirector Kit Infrastructure Analysis

• Thousands of emails reached end-user inboxes across dozens of compromised legitimate websites between April 29 and July 14, 2026. Traditional SEGs missed them all.
• The kit hides the phishing destination behind an opaque server-side campaign token (go.php?c=<token>). The URL in the email resolves to a legitimate site, and the phishing page is only revealed after the click.
• The primary purpose is masking the AiTM approach. The AiTM backends never appear in any email. Operator-registered domains like newerapetrtjroleum[.]vu (registered June 5, 2026; still absent from all email-based threat intel at time of analysis) are fully shielded behind the redirector layer.
• Confirmed downstream platforms include Sneaky2FA and Tycoon 2FA, adversary-in-the-middle kits that bypass MFA by intercepting the authenticated session in real time.
• QuickBooks and DocuSign sender infrastructure account for 34% of delivery. These are high-trust transactional brands that users are most likely to fall for.
• The kit is still active as of July 14, 2026. New compromised hosts and path variants continue to appear.

How Does The Bulletproof Blind Redirector Kit Work?

The kit stages a hidden directory on a compromised website. Emails contain a link to go.php on that site, with a short ?c= campaign token as the only parameter:

https://dreamhouse-bd[.]com/.bulletproof/go.php?c=68e5c18a734137e5
https://totalsaseguros[.]com[.]br/.9s/go.php?c=securedoc1
https://celeritech[.]biz/.s99/go.php?c=EF76qr

When a victim clicks the link, the PHP script running on the compromised server receives the request, looks up the ?c= token server-side, and creates an HTML page containing a single hardcoded destination URL and a JavaScript timer. The victim's browser renders a fake "OneDrive — Shared Document" loading screen: a spinning progress indicator, "Preparing your file...", "Please wait...", and after 3.3 seconds, navigates to the AiTM backend:

<script>
var dest="https:\/\/<AiTM website>";
setTimeout(function(){window.location.replace(dest);},3300);
</script>

The method window.location.replace() is used instead of a standard navigation so the redirector URL is removed from browser history. Even if the victim hits the “Back” button on their browser, they will not see the redirector they passed through.

The destination is resolved entirely server-side before the page is sent. By the time the HTML reaches the browser, the AiTM URL is already baked in. There are no client-side API calls, no token decoding in JavaScript and no further server communication. The PHP script does the sensitive work invisibly and outputs a throwaway lure page.

This design defeats several common defenses:

• Static URL reputation checks cannot evaluate the link because the destination is resolved server-side and never appears in the email.
• The redirector host is a legitimate website with established reputation: a home decor shop, a villa rental, an engineering firm, not a freshly registered throwaway domain.
• Scanners that follow HTTP redirects but do not execute JavaScript see only the fake OneDrive loading screen; the destination URL is inside a <script> block that requires a real browser to run.

Beyond SEG bypass, the design provides a harder benefit: the operator's AiTM infrastructure stays entirely out of email. The backend domains, which are purpose-built, freshly registered, and carry no prior reputation, are never exposed.

How Does the Bulletproof Kit Filter Out Automated Scanners?

On first contact with go.php from the original hidden directory, the kit sets a PHP session cookie before serving the lure page:

Set-Cookie: bp_redir_sess=9bf0dd2f3880ffe4333e6f1441abf23d; path=/; HttpOnly; secure

The bp_redir_sess name (bp = bulletproof) is a PHP session opened under a custom session name, identifiable by the no-cache headers PHP emits automatically on session_start(). The kit uses this session to run a visitor fingerprint check: the visitor's IP address and user-agent are hashed together with a shared secret into a signed JWT (JSON Web Token) with an expiry timestamp. Automated scanners that do not present a convincing browser fingerprint are either served a challenge page or receive a response that does not forward. The destination URL is only disclosed to visitors who pass.

Phishing kits detecting bots are dangerous because hiding from security scanners elongates their lifespan, allowing them to stay online longer and steal more credentials from victims.

Kill Chain

How Has the Volume of Bulletproof Blind Redirector Kit Attacks Changed?

The sharp decline in the week starting June 8 is consistent with the operators rotating the hosts used rather than organic slowdown. Several high-volume hosts went silent within a tight window, with their final activity recorded on or before June 8. By the time those hosts were scanned, the majority returned 404 responses indicating kit directories had been removed; two earlier hosts that fell silent in May returned 400 errors, suggesting a harder remediation by site owners.

The operator did not go quiet. From June 10 onward a fresh cohort of compromised hosts appeared in delivery, with new compromises standing up in parallel with the old hosts going dark. Whether the June 8 drop reflects site owner remediation, a voluntary rotation or external intervention cannot be determined from delivery data alone: the operator treats compromised hosts as disposable infrastructure, replaced rather than repaired.

The sustained lower volumes from June 15 onward, despite continued active infrastructure, are consistent with SEGs progressively improving detection of this kit's delivery patterns: sender reputation signals, URL structure or token format heuristics accumulating over the campaign's lifespan. The operator continues deploying, yet fewer emails are reaching inboxes.

What Makes Up the Bulletproof Blind Redirector Kit Infrastructure?

Compromised Hosts

Dozens of legitimate websites were identified serving kit redirectors. They span diverse geographies and industries. We noted no pattern to site selection beyond opportunistic compromise.

Here are the top hosts by delivery volume:

Kit Directory Naming

The hidden staging directories follow a consistent naming convention that reveals the kit's identity:

The /. prefix hides these directories from casual web browsing. The /.99 family likely represents version or release identifiers. The fact that /.bulets and /.bulletproof co-exist on the same host is the clearest available confirmation that all path variants belong to the same kit.

Multi-Path Hosts

Several hosts serve more than one kit path, indicating either upgrades on the same compromised server or deliberate multi-path staging:

Analyzing the Bulletproof Blind Redirector Kit Campaign Tokens

The ?c= token is the kit's campaign identifier. Three distinct formats were observed:

Notable token observations:

Named tokens suggest the kit supports operator-defined labels alongside randomly generated defaults. Examples include securedoc1, Webmail_support and Document, which plainly describe the phishing scenario being run. The naming pattern persists across infrastructure rotations: secudoc1 (June 25), securedoc1 (June 26), and docsecure1 (July 8) all appear on different hosts across consecutive days, consistent with an operator running a live campaign while rotating between compromised servers.

Two tokens contained what appear to be real personal names broken up with hyphens, for example [Name]-[Surname]-[obfuscated-identifier], possibly victim or target identifiers encoded for per-recipient tracking.

What Are the Common Delivery Methods for the Bulletproof Blind Redirector Kit?

Sending Infrastructure

QuickBooks (notification[.]intuit[.]com) and DocuSign (docusign[.]net) together account for 34% of delivery. Both are high-trust transactional notification brands; SEGs treat them as inherently low-risk, which is precisely why they are targeted.

QR Code Delivery

One instance was identified where the kit URL was embedded inside a QR code rather than as a plain hyperlink:

https://api[.]qrserver[.]com/v1/create-qr-code/
  ?data=https://dreamhouse-bd[.]com/.bulets/go.php?c=[token]
  &size=150x150

The email contained an inline QR image generated dynamically from the kit URL. This bypasses email security tools that scan hyperlinks but do not decode QR images. These tools miss this link because the kit URL is never present as a clickable link in the email body.

What Phishing Lure Themes Are Common in Bulletproof Blind Redirector Kit Attacks?

Lures are exclusively BEC-style, impersonating financial and business document workflows. Real company names appear throughout, likely scraped from victim networks or prior compromise.

Recurring themes:

• ACH/EFT payment notifications and remittance summaries
• DocuSign and QuickBooks document signing requests
• Project-scoped lures referencing named companies such as construction firms, law firms and suppliers
• Credential harvesting under the guise of mailbox maintenance

Representative email subjects:

Remittance Summary, Ref: [reference number]
Payment Batch: ACH[number] From [Company Name]
Office 365 Password Reset Required for Your Email Account
Urgent Request for Representation, [Legal Matter]
[EXTERNAL] Overdue invoice #[number]

How Do Bulletproof Blind Redirector Kit Landing Pages Work?

The kit functions as a delivery layer only; it does not specify a downstream platform. This allows free switching between any AiTM backend. Instances our researchers scanned confirmed the following outcomes:

Per-Recipient Tracking

The AiTM backend, not the redirector, appends these tracking parameters on its own 302 before serving the phishing page:

https://<aitm-backend>/?utm_source=[value]&utm_medium=[value]
  &campaign=[value]&mid=[unix_timestamp]&eid=[encrypted_value] 

Here’s what they mean:

• mid Value: a Unix timestamp consistent with a campaign-start marker, allowing the operator to correlate victim arrivals against a specific run.
• eid Value: an encrypted per-recipient identifier, different for each target even within the same campaign, enabling the operator to attribute a stolen session to a specific individual.

Combined, these give the operator full tracking of which targets converted and when. None of this is visible in the original phishing email.

What This Means for Defenders

This kit is built to fail silently past the controls most organisations rely on. Each layer of the attack is chosen specifically to be invisible to a standard defensive stack.

Your SEG will not catch it. The email arrives from a high-reputation sender: QuickBooks and DocuSign notifications in 34% of cases. The link in the email points to a legitimate website with established history. There is no suspicious URL to flag, no malicious attachment to scan.

URL inspection will not catch it. Even if the link is followed during scanning, go.php serves a JavaScript redirect that requires a real browser to execute; HTTP-only scanners see only a fake OneDrive loading screen. Instances layer a visitor fingerprint check on top, ensuring automated scanners are filtered before the destination URL is ever disclosed.

MFA will not stop the account takeover. The downstream AiTM platforms confirmed in this dataset, Sneaky2FA and Tycoon 2FA, proxy the authentication session in real time. The victim completes their own MFA challenge on the attacker's page, and the resulting authenticated session token is intercepted before it reaches the victim. By the time the victim realizes something is wrong, the attacker already has a valid, MFA-satisfied session.

Here Are the Mitigations We Recommend:

• Deploy phishing-resistant MFA (FIDO2 / hardware security keys). These bind the credential to the legitimate origin. This means a proxy cannot relay them because the authenticator validates the domain.
• Enable Conditional Access policies that check device compliance and flag logins from anomalous locations or ASNs, even for valid sessions.
• Monitor for OAuth session token replay: sign-ins from unfamiliar IP addresses immediately following a successful MFA event can indicate AiTM session theft.
• Train users that a convincing-looking Microsoft login page and a completed MFA prompt are not proof of legitimacy as the attacker's proxy mirrors both faithfully.

Indicators of Compromise

Kit Directory Paths

/.bulletproof/go.php
/.bulets/go.php
/.99/go.php
/.99s/go.php
/.99b/go.php
/.9s/go.php
/.s9/go.php
/.s99/go.php
/.dis/go.php
/.cl/go.php

Confirmed Compromised Redirector Hosts (Top 15 by Volume)

dreamhouse-bd[.]com
megaauctions[.]net
villamellaparos[.]gr
europeanautoglass[.]com
jurnaledu[.]com
awamke[.]org
pilotisestrutural[.]com[.]br
esradiomurcia[.]es
defendbd[.]com
qsmsteel[.]com
unityrepair[.]com[.]my
r-ddos[.]com
hydocs[.]com
retsmd[.]com
bathroomboutique[.]com

Associated Infrastructure

Detection Pattern

Regexp:  /.*\/go\.php\?c=[A-Za-z0-9_-]+$/
Path:  Hidden directory starting with /. or known variant path
Cookie:  “bp_redir_sess=<hex32>; path=/; HttpOnly; secure” : click-verifier session cookie; kit fingerprint independent of domain or path