A few days ago my wife received this text:
La entrega se ha suspendido porque su pedido no tiene numero de casa. Revise y complete los datos de su domicilio lo antes posible. https:..//ln[dot]run/b5PUN
If you’re not fluent in Spanish, don’t worry, it is a text saying that there was an attempt to deliver a package but the address is incomplete and offers a URL to input your information.
That links redirected to: https:…//seurede[dot]help/es
Of course, it looks shady as hell but you have to admit that once you open it it does look genuine (if you ignore the obvious layout issues):

At the start it asks for a phone number, no matter what you enter you have a package on route, very convenient. And after clicking a few buttons they would ask you to pay $0.99 to reprogram your delivery.
From their URL I figured out their hosting, turingidc[dot]com which is also a very shady page. I’ve tried contacting them but the contact form is broken. This is why I tried a different approach.
Honestly, I had been waiting for an opportunity like this one, the whole page felt vibed-coded so I knew that I would be able to send fake info, just for the fun. Inspecting the requests I saw this:

A POST request to an endpoint that includes a token.
The token was regenerated on each visit but it really never expired or made any checks from where the request was coming. There was also a few other POST requests to localhost:{randomPort}, yes, this definitely looked like amateur work.
Since it was a Friday and I was doing nothing I wrote a few lines in Python and decided to feed their database a bit, 10K requests later with random jitter and what I thought was some believable numbers I gave up because even people with nothing to do like me get bored.
The site is still online. Did I make a difference? Probably not. It was still fun.
















