Ten thousand domains carried more than 100,000 pages before June, which averages out to about ten pages per domain [1][6][3]. Apply that density to the 700-plus domains Group-IB counted afterwards and roughly 7,000 pages were back in service inside a month [7][3]. Treat the estimate as soft, because the source is inconsistent about units: the write-up's opening line calls the 700 new phishing pages, its body calls them additional domains [8][7]. Both readings land in the same place. Affiliates were publishing again while the seizure was still weeks old.
Operation Ghost Hook removed the operator's central plumbing, which the FBI described as core admin servers, a Shopify storefront, about $100,000 in payment wallets and thousands of domains registered through US providers [5]. The kit itself remained in place, held by more than 230 buyers on their own infrastructure [11]. Divide the seized wallet balance by that buyer count and you get about $435 a head [4]. Replacement domains cost less than that.
ChenLun then deleted the Telegram channel that had carried more than 5,000 subscribers and served as the affiliate market [11][10]. That reads as a move against researchers rather than a loss of capability. Each buyer already holds a copy of 267 templates spanning financial services, brokerages, telecoms, postal services, government and toll systems [9].
The kit is operator-attended, not a static credential dump. WebSockets carry victim input to an operator panel in real time, including data typed into a form the victim then abandoned [15]. From that panel, operators can serve SMS, email, PIN or app-based multifactor challenges on demand and push victims back to earlier pages to request more payment detail [14]. In the Singapore Land Transport Authority campaign Group-IB examined, the cloned portal took vehicle registration and phone numbers before the fake payment screen, and Group-IB assessed those numbers were collected to intercept SMS authentication codes in a later stage [13]. The lure also told recipients how to switch off their own handset spam filtering [12].
The one artifact that costs an affiliate something to change is the file naming. Pages use a consistent convention with an alphabetical prefix marking the victim's position in the flow, and Group-IB's recommendation is to hunt on those file-name signatures to trigger takedowns [17]. At $435-per-buyer economics, domains are cheap to replace; the template tree is harder to change, since altering it means reworking the panel that reads it.
One caveat on the count. The 700 figure is a one-month snapshot, and publication came on 3 September, about twelve weeks after the 13 June announcement [2][4][5]. The current number is unpublished, and the only ceiling on it is the 10,000 domains the kit ran before the seizure [6].
