If you’re a WordPress developer or agency and you’ve received a polished-looking RFP from someone called “Sheryl Howard” at “Tire Faster EST” — delete it. It’s a credential harvesting operation, and it’s well built.
On 9 April 2026, our agency received what looked like a routine enquiry through our website contact form. Two days later, it escalated into a targeted phishing attack designed to steal Google account credentials via a fake WP Engine login page. We identified it before any credentials were compromised, investigated the infrastructure behind it, and reported it to every relevant authority we could find.
This post breaks down exactly how the attack works, the infrastructure behind it, what we found when we dug into it, and what you should watch for if you receive something similar. Every searchable indicator — email addresses, phone numbers, domains, URLs — is included deliberately, so that the next developer who Googles one of them finds this article instead of falling for it.
The Attack Pattern
The campaign follows a multi-stage social engineering sequence designed to build just enough trust before asking for credentials.
Stage 1: Contact form submission. The attacker submits a short, generic enquiry through your website’s public contact form, posing as a potential client. The message is deliberately minimal — just enough to get a response without triggering suspicion. Using the contact form rather than emailing directly is a calculated choice: it bypasses spam filters and ensures delivery. The tone of the message felt slightly off — template-like, impersonal — which in hindsight was likely the first signal that this was automated rather than a genuine human enquiry.
Stage 2: The payload. When you respond, the attacker follows up with a professionally formatted email containing three elements: a link to a legitimate-looking business website (tirefaster.com), an 11-page PDF technical specification for a WordPress performance optimisation project, and a request to “register” for project access via a fake WP Engine admin panel. The spec document is convincingly detailed — technically accurate scope, structured workstreams, realistic budgets. It’s designed to make the project feel real and high-value.
Stage 3: Credential capture. The registration link points to https://wpengine.st1-tirefaster.com/dev-admin/ — a fake WP Engine login page that harvests your Google account credentials via OAuth. The “wpengine” subdomain prefix and “/dev-admin/” path are crafted to look exactly like a WP Engine staging environment URL, which is what a legitimate client might plausibly share.
The Red Flags
Several indicators made this suspicious before the infrastructure investigation confirmed it:
A Hotmail address for a business marketer. The sender used sheryl.tirefaster@hotmail.com rather than a corporate domain. A genuine business representative wouldn’t conduct a five-figure project negotiation from a free email account.
A Pakistani phone number for a US company. The contact number +92 346 950 1177 is a Pakistani mobile. Tire Faster presents as a US company. The location mismatch is a strong indicator of fabricated identity.
A fake WP Engine domain. Legitimate WP Engine staging URLs follow the format [sitename].wpengine.com. The attacker’s domain wpengine.st1-tirefaster.com reverses this structure — WP Engine becomes a subdomain rather than the root domain. It’s designed to look right at a glance, not under scrutiny.
Google OAuth on an attacker-controlled domain. The “read-only access” framing in the email is deliberate misdirection. OAuth authentication on a malicious domain grants the attacker a token regardless of the stated scope. The actual outcome is full credential access to your Google account.
A generic, template-like PDF. The 11-page specification contains no site-specific data, no actual performance measurements, no real client pain points. Budget figures are round numbers in three currencies. The document is a template — parameterised for industry vertical, not prepared for a specific client.
Access requested before any call. The sequence is structured so that credential capture comes before any legitimate interaction. Register for the admin panel, then we’ll schedule a call. This is the tell — a real client would have a call first.
No verifiable identity. “Sheryl Howard” has no LinkedIn profile, no company directory listing, no digital footprint connecting her to Tire Faster or any related entity.
The Infrastructure — Built to Disappear
When we ran WHOIS and DNS lookups on the domains and hosting involved, the picture that emerged was of infrastructure designed from the ground up for anonymity and disposability.
The phishing domain (st1-tirefaster.com) was registered on 9 April 2026 — the same day the initial contact form enquiry was submitted. It was not pre-existing infrastructure repurposed for this attack. It was created specifically for it, almost certainly via a registrar API as part of an automated provisioning process.
The registrar is CNOBIN Information Technology Limited, based in Hong Kong, operating through ordertld.com. Hong Kong-based registrars are a common choice for this type of operation: they’re real, accredited registrars with legitimate abuse contacts, but they’re sufficiently distant from Australian and US law enforcement to slow any response.
DNS is handled by Cloudflare, which proxies the domain’s real hosting IP. This serves two purposes: it anonymises the actual server location, and it adds an apparent layer of legitimacy — Cloudflare is a trusted name that many targets won’t question.
The hosting IP (103.101.85.78) is where things get deliberately opaque. The IP block (103.101.84.0/22) was originally registered with APNIC (Asia-Pacific) and transferred to RIPE (Europe) in October 2025. It now exists as a stub WHOIS record — network name STUB-103-101-84SLASH22, country code ZZ (unknown/unspecified), abuse contact no-email@apnic.net. There is no identifiable operator and no functional abuse contact. This is not an oversight. There is no hosting provider to report to, which is by design.
The front domain (tirefaster.com) — the website used to add legitimacy to the attacker’s identity — is approximately 16 months old, registered via GoDaddy with WHOIS privacy enabled. Its young age and hidden ownership, combined with its role in this campaign, suggest it may be purpose-built scam infrastructure rather than a real business being impersonated.
Cloudflare’s Response
After reporting the phishing page to Cloudflare’s abuse team, we received this response:
“The reported content is no longer being served by Cloudflare. Cloudflare has no control over content that is not on our network.”
A DNS check performed after receiving this response confirmed the domain still resolved to 103.101.85.78 via Cloudflare’s nameservers. No action was taken. The phishing infrastructure remained operational.
This is a known limitation of reporting through Cloudflare’s abuse channel. When a domain uses Cloudflare as a DNS proxy but hosts content elsewhere, Cloudflare takes the position that the content is not “on their network” — even when they are the sole identifiable infrastructure provider capable of disrupting the operation. For campaigns like this one, where the hosting IP has no valid abuse contact, Cloudflare is effectively the only lever available, and that lever doesn’t move.
What the PDF Metadata Revealed
A forensic metadata extraction from Technical_Specifications_FINAL_v18.pdf produced some useful corroboration of the automation hypothesis.
Producer: ReportLab. The PDF was generated by ReportLab, a Python library for programmatic PDF creation. It was not produced in Word, Google Docs, or any document editor a human would typically use. It was output by a script.
Created 15 days before deployment. The PDF creation timestamp is 25 March 2026 — 15 days before it was sent to us. The modification timestamp is identical, meaning the file was generated once and never edited. This confirms it’s a pre-built template deployed from a batch, not a document prepared for this specific engagement.
All author fields explicitly sanitised. The Title and Author fields contain the literal strings (anonymous) and (unspecified) — not blank fields, but values that were deliberately written in by the generation script. This is an operational security measure to prevent attribution.
A4 format. The document is formatted in ISO A4 — the paper standard used across Europe, South Asia, Australia, and most of the world outside North America. A legitimately US-based business producing professional documentation would typically use US Letter. A small detail, but consistent with a script author operating outside North America.
A Likely Automated Pipeline
Taken together, the evidence points toward a highly automated phishing-as-a-service operation rather than a manually orchestrated campaign. The key indicators:
- Same-day domain registration and infrastructure provisioning (consistent with registrar API automation)
- PDF generated by a Python script from a template, 15 days in advance
- Contact form used as the delivery vector (trivially scriptable; bypasses spam filters)
- Generic, template-like initial enquiry designed not to trigger suspicion
- Infrastructure spread across multiple jurisdictions with no valid abuse contacts
The marginal cost of targeting additional agencies is near zero. To pivot to a new target batch, the attackers need only swap the industry variable, register a new front domain and phishing subdomain, regenerate the PDF specification, and submit contact forms to a new list. The same infrastructure pattern would be reused across all targets.
What Was Reported and Where
Reports were filed with:
- Google Safe Browsing — both the phishing URL and the front domain
- Microsoft — Hotmail account abuse, via web form and email to abuse@outlook.com
- Scamwatch (ACCC) — Australian consumer fraud authority
- CNOBIN / ordertld.com — domain registrar, requesting suspension of st1-tirefaster.com
- Cloudflare — DNS/proxy provider (Report ID: 94a68c96faf466b4; response ineffective, as noted above)
- WP Engine — brand impersonation report, suggesting potential UDRP proceedings
Epilogue: The Human Operator
After the initial reports were filed, we continued the correspondence briefly — partly out of curiosity, partly to see whether the campaign was fully automated or had a human in the loop.
The answer, it turns out, is both.
The early stages — the contact form submission, the structured email, the PDF delivery — showed all the hallmarks of scripted automation: consistent formatting, predictable structure, same-day infrastructure provisioning. But as the back-and-forth continued past the point where a scripted flow would have ended, the responses changed character. They got shorter. They actually addressed what we’d said. The formulaic cadence gave way to something that read like a person at a keyboard.
The final message, sent after we reported that the original phishing link wasn’t working, was telling:
“Hi Geoff, I checked the test environment and everything is working now:
https://wpengine.stg2-tirefaster.com/wp-tirefaster/— What error are you seeing? Could you send me a screenshot, and I’ll try to help. Thanks, Sheryl!”
Two things worth noting: first, they’d spun up a second phishing subdomain — wpengine.stg2-tirefaster.com — after the first one was reported. Fresh infrastructure, same pattern. That URL was reported to Google Safe Browsing immediately.
Second: the exclamation mark after “Sheryl!” is a nice touch. Very personable.
At this point, we’d done everything useful. The reports were filed, the infrastructure was documented, the campaign was exposed. There was nothing left to gain from continued engagement — except, perhaps, a parting message before blocking.
We opted for the Morpheus approach.
“What if I told you… I already reported you to 6 different organisations.”
Then we blocked the address.
How to Protect Yourself
Never authenticate via OAuth on a domain you didn’t navigate to yourself. If a client sends you a link to a login page, type the root domain into your browser independently and navigate from there. Never click through.
Treat any unsolicited RFP that requests admin access before a call as hostile. The sequence — build rapport, deliver spec, request credentials — is the attack. Legitimate clients don’t need your Google credentials before a discovery call.
Verify new client identities through independent channels. Check company registrations, call numbers listed on the company website (not the number they give you), verify LinkedIn profiles against company directories.
Be suspicious of free email addresses representing established businesses. sheryl.tirefaster@hotmail.com claiming to be a marketer at an automotive company is an immediate red flag. It’s not conclusive on its own — some small businesses do this — but combined with other signals, it warrants scrutiny.
Run WHOIS on unfamiliar domains. A domain registered within the last 30 days for a supposedly established business is a critical red flag. It takes 10 seconds and can save you from a serious compromise.
Check the paper size of unsolicited PDF specs. It sounds absurd, but if a “US company” sends you a document formatted in A4, that’s a data point worth noting.
Indicators of Compromise (IOCs)
For anyone conducting threat intelligence or checking whether they’ve been targeted by the same campaign.
All URLs listed below are confirmed malicious phishing infrastructure — do not visit them.
| Type | Value |
|---|---|
| ⚠ Phishing URL (original) — MALICIOUS | https://wpengine.st1-tirefaster.com/dev-admin/ |
| ⚠ Phishing URL (second) — MALICIOUS | https://wpengine.stg2-tirefaster.com/wp-tirefaster/ |
| ⚠ Phishing domain (original) — MALICIOUS | st1-tirefaster.com |
| ⚠ Phishing domain (second) — MALICIOUS | stg2-tirefaster.com |
| ⚠ Front domain — MALICIOUS | tirefaster.com |
| Hosting IP | 103.101.85.78 |
| Attacker email | sheryl.tirefaster@hotmail.com |
| Attacker phone | +92 346 950 1177 |
| PDF filename | Technical_Specifications_FINAL_v18.pdf |
| PDF producer | ReportLab PDF Library - (opensource) |
| Domain registrar | CNOBIN Information Technology Limited (Hong Kong) |
| Original domain created | 9 April 2026 |
| Cloudflare nameservers | leanna.ns.cloudflare.com, valentin.ns.cloudflare.com |
If you’ve received similar communications — even with different names, companies, or industries — please report them and consider sharing your experience to help protect others.
Conclusion
Can operations like this be permanently stopped? Probably not — at least not through the channels available to a single reporting entity. The infrastructure is deliberately designed to resist takedown: jurisdictions are fragmented, abuse contacts are either unresponsive or nonexistent, and the marginal cost of spinning up new domains and personas is effectively zero. By the time any one piece of infrastructure is actioned, the campaign has moved on.
But “can’t be stopped permanently” is different from “pointless to fight.” The realistic goal isn’t elimination — it’s cost inflation.
Every report filed makes the campaign incrementally more expensive to run. Google Safe Browsing flagging a phishing URL means browsers warn users before they can interact with it, cutting the conversion rate on every target that URL reaches. A domain suspension forces a new registration. A published exposure article such as this one, with searchable IOCs means future targets find the warning instead of the phishing page. Each friction point is small in isolation, but collectively they raise the cost of running the campaign and lower its yield.
The attackers in this case built a sophisticated, likely automated pipeline — scripted infrastructure provisioning, AI-generated PDF templates, contact form bots operating at scale. That’s a meaningful investment. Anything that forces them to rebuild infrastructure, retool their approach, or abandon a campaign batch before it pays off represents a real cost. They’re not doing this for fun. Make it expensive enough and the economics stop working.
That’s the realistic win condition: not stopping them, but making it harder, slower, and less profitable to keep going. Document everything, report everywhere, publish openly. It doesn’t feel like much — but at scale, across the community, it adds up.
