The Story of a Never Ending Scam: When Natalie Hamilton Reemerged with Vengeance and a Power Drill

Or Katz, a researcher at Akamai, follows a phishing persona called Natalie Hamilton, who appeared again and again in a fake quiz-and-prize scheme first seen in late 2022. Each version used the same text with new images and offers, including a power drill. The lure promised a valuable prize if the victim paid a small shipping fee, which exposed card details, and the operators leaned on well-known shorteners and cloud hosting so the links looked trustworthy to reputation checks.

The middle of the talk covers the infrastructure. Redirects varied by geography, some regions were blocked outright, and links that relied on browser-only fragments failed when scanned by simple non-browser tools. Landing pages rotated domains and generated random URLs per victim, so taking down one page did not stop the flow. Tracing a routing domain back to a marketing firm's website template led to about 11,000 associated domains, roughly 1,900 active redirectors spread across more than 20 hosting providers, and 25 impersonated brands. Traffic estimates suggested a campaign worth seven figures.

Katz argues that defenders are measured by detections and takedowns, while attackers measure engagement, time to detection and campaign persistence. The practical takeaway is that defenders need to act faster, prioritise high-traffic malicious sites, and deal with the redirect layer rather than only the landing pages. He also notes that hosting providers and law enforcement often require more evidence than defenders can easily gather.