BreakglassIntelligence
Back to reports
highStealer

Smile Admin Panel

InvestigatedApril 3, 2026PublishedApril 3, 2026
Threat Actors:ProfileAssessments may move after exposure)
smilepanelsratlaravelhetznertorshodan

TLP: WHITE Date: 2026-04-03 Analyst: GHOST (Breakglass Intelligence) Classification: Cybercrime -- Cookie Theft & Financial Fraud Platform Status: LIVE INFRASTRUCTURE

Executive Summary

Investigation initiated from a Twitter lead by @salmanvsf referencing "Smile admin panels." Through Shodan fingerprinting on the HTTP title "Smile Admin," we identified a LIVE Laravel/Inertia.js-based fraud administration panel hosted on Hetzner (Finland) at 46.62.192.169. The panel -- branded "Smile Admin" -- manages stolen browser cookies, user wallets, payment processing, and a storefront ("OMG - GameShop") targeting Myanmar users (Burmese language UI). Two domains (crazydazy[.]online and skibidispace[.]xyz) were registered on the same day via Namecheap and point to the same server. Multiple critical OPSEC failures were identified including open registration, a cookie domain leak, placeholder Google OAuth credentials, and an exposed .git repository.

Key Findings

  • LIVE fraud admin panel at smile[.]crazydazy[.]online with open registration
  • Panel manages stolen cookies (cookiesjson CRUD routes), wallets, wallet transactions, and payments
  • Frontend storefront "OMG - GameShop" at app[.]crazydazy[.]online targets Myanmar users (Noto Sans Myanmar font)
  • Cookie domain scoped to .skibidispace[.]xyz -- reveals hidden second domain
  • Both domains registered 2025-10-15 at Namecheap, WHOIS-privacy protected
  • Certificate Transparency reveals a third subdomain: redeem[.]crazydazy[.]online (now offline)
  • Google OAuth configured with placeholder your-client-id.apps.googleusercontent.com
  • .env returns 403 (exists but blocked), .git/HEAD returns 403 (git repo on server)
  • Product routes include updateMmkPrice -- MMK = Myanmar Kyat, confirming Myanmar targeting
  • Built with Laravel 11+, Inertia.js, Livewire, Sanctum API auth, Vite, TanStack Router
  • Server: nginx/1.24.0 on Ubuntu Linux, OpenSSH 9.6p1
  • Zero VirusTotal detections, zero URLScan submissions -- previously undocumented infrastructure

Infrastructure Analysis

Network Infrastructure

IPASNProviderLocationPortsServicesStatus
46[.]62[.]192[.]169AS24940Hetzner Online GmbHVaala, Finland22, 80, 443nginx/1.24.0, OpenSSH 9.6p1LIVE

Domain Infrastructure

DomainRegistrarCreatedNSPurpose
crazydazy[.]onlineNamecheap2025-10-15registrar-servers.comPrimary -- panel + storefront
skibidispace[.]xyzNamecheap2025-10-15registrar-servers.comCookie domain -- session scope

Subdomain Map

SubdomainDomainPurposeStatus
smile[.]crazydazy[.]onlinecrazydazy.onlineAdmin panelLIVE
app[.]crazydazy[.]onlinecrazydazy.online"OMG GameShop" storefrontLIVE
redeem[.]crazydazy[.]onlinecrazydazy.onlineRedemption portalOFFLINE
www[.]crazydazy[.]onlinecrazydazy.onlineRedirects to rootLIVE
smile[.]skibidispace[.]xyzskibidispace.xyzMirror admin panelLIVE
app[.]skibidispace[.]xyzskibidispace.xyzMirror storefrontLIVE
www[.]skibidispace[.]xyzskibidispace.xyzUnknownLIVE

Certificate Timeline

DateCertificateSANs
2025-10-16www.crazydazy.online, www.skibidispace.xyzSingle domain certs (initial setup)
2025-10-18crazydazy.onlineapp, smile, www subdomains
2025-10-21skibidispace.xyzapp, smile subdomains
2025-10-22skibidispace.xyzapp, smile, www subdomains
2025-10-30app.crazydazy.onlineapp, smile subdomains
2025-12-21skibidispace.xyzapp, smile, www (renewal)
2025-12-29app.crazydazy.onlineapp, smile (renewal)
2026-01-15redeem.crazydazy.onlineredeem only (new service)
2026-02-19skibidispace.xyzapp, smile, www (renewal)
2026-02-27app.crazydazy.onlineapp, smile (current, expires 2026-05-28)

Panel Architecture

Technology Stack

  • Backend: Laravel 11+ (PHP), Inertia.js SSR, Livewire, Sanctum API authentication
  • Frontend (Admin): Vue.js/React via Inertia, Vite bundler, Lucide icons, Instrument Sans font
  • Frontend (Store): React, TanStack Router, Noto Sans Myanmar font
  • Server: nginx/1.24.0 on Ubuntu, Let's Encrypt TLS (E7 issuer)
  • Session: Cookie-based (smile_admin_session), scoped to .skibidispace.xyz

Exposed Routes (47 routes discovered)

Authentication: login, register, forgot-password, reset-password, verify-email, confirm-password, logout, auth/google (OAuth) Cookie Management: cookiesjson (CRUD -- index, create, store, show, edit, update, destroy), cookiesjsonupdate Financial: wallets (index, show, update), wallettransaction (full CRUD), payments (full CRUD) Products: product (index), updatehot, updateMmkPrice (Myanmar Kyat!), image upload Users: users (full CRUD) Admin: admin/dashboard, dashboard Settings: profile, password, appearance Infrastructure: pulse (Laravel Pulse -- 403), livewire/update, sanctum/csrf-cookie, storage/{path}

OPSEC Failures

  1. Open Registration: /register returns 200 -- anyone can create an account
  2. Cookie Domain Leak: Session cookies scoped to .skibidispace.xyz while serving from crazydazy.online -- reveals hidden domain
  3. Placeholder OAuth: Google OAuth uses your-client-id.apps.googleusercontent.com -- template never configured
  4. Exposed .env: Returns 403 (exists, blocked by nginx but confirms presence)
  5. Exposed .git: Returns 403 (git repository exists on server, blocked by nginx)
  6. Inertia Version Hash: d1862febc9084f120197a10bcde82b6d exposed in every page response
  7. Full Route Map: All 47 application routes exposed via Ziggy JavaScript in every page load
  8. Storage Path Traversal: storage/{path} route accepts wildcard path parameter

Attack Chain Assessment

Cookie Theft (browser extension/stealer) 
    --> cookiesjson endpoint (stolen cookie ingestion)
    --> "OMG GameShop" (Myanmar gaming platform -- likely a social engineering front)  
    --> wallets (victim account balances)
    --> wallettransaction (drain victim wallets)
    --> payments (cash out)
    --> redeem (redemption of stolen value)

Threat Actor Profile

Attribution Assessment

  • Confidence: LOW-MEDIUM
  • Evidence: Domain registration patterns, technical choices, language targeting
  • Targeting: Myanmar users (Burmese font, MMK currency)
  • Motivation: Financial fraud -- cookie theft enabling account takeover and wallet drainage
  • Sophistication: MEDIUM -- competent Laravel developer, uses modern stack (Inertia.js, TanStack), but multiple OPSEC failures suggest individual or small team
  • Infrastructure Age: ~5.5 months (domain registration Oct 2025)

Indicators of Developer Profile

  • Uses Laravel with latest patterns (Inertia.js, Livewire, Sanctum)
  • Random/meme domain naming ("crazydazy", "skibidispace") suggests younger developer
  • TanStack Router for frontend suggests awareness of modern React ecosystem
  • Placeholder OAuth credentials suggest this may be a development/staging instance
  • redeem subdomain appeared Jan 2026 -- operation expanding

MITRE ATT&CK Mapping

TacticTechniqueIDApplication
Credential AccessSteal Web Session CookieT1539cookiesjson endpoint ingests stolen browser cookies
CollectionData from Information RepositoriesT1213Panel aggregates stolen cookie data
Resource DevelopmentAcquire InfrastructureT1583.001Hetzner VPS, Namecheap domains
Resource DevelopmentEstablish AccountsT1585.002Google OAuth (attempted), panel user accounts
ImpactFinancial TheftT1657Wallet transactions, payment processing

IOC Summary

Network Indicators

  • 46[.]62[.]192[.]169 (Hetzner, Finland)
  • crazydazy[.]online
  • skibidispace[.]xyz
  • smile[.]crazydazy[.]online
  • app[.]crazydazy[.]online
  • redeem[.]crazydazy[.]online
  • smile[.]skibidispace[.]xyz
  • app[.]skibidispace[.]xyz

Behavioral Indicators

  • HTTP title: "Smile Admin"
  • Session cookie name: smile_admin_session
  • Cookie domain: .skibidispace.xyz
  • Inertia version: d1862febc9084f120197a10bcde82b6d
  • Ziggy route signature: 47 routes including cookiesjson, wallettransaction, updateMmkPrice
  • App title: "OMG - GameShop"
  • Google OAuth redirect: smile.skibidispace.xyz/auth/google/callback
  • User-Agent on JS: Instrument Sans font, Noto Sans Myanmar font

TLS Indicators

  • Cert CN: app.crazydazy.online
  • SANs: app.crazydazy.online, smile.crazydazy.online
  • Issuer: Let's Encrypt E7
  • JARM: 27d27d27d29d27d00042d42d00000026a95928fa9b620834c2feff40bccb8f

Immediate (24-48 hours)

  • Block IOC domains and IP at network perimeter
  • Monitor for connections to skibidispace[.]xyz and crazydazy[.]online
  • Check browser extension logs for cookie exfiltration to these domains

Short-term (1-2 weeks)

  • Submit abuse report to Hetzner (abuse@hetzner.com)
  • Submit abuse report to Namecheap (abuse@namecheap.com) for both domains
  • Monitor CT logs for new certificates issued to these domains
  • Check for related infrastructure using the JARM fingerprint

Medium-term (1-3 months)

  • Monitor for domain migration (actors may move after exposure)
  • Track the "updateMmkPrice" pattern for Myanmar-targeted fraud campaigns

References

  • Twitter lead: @salmanvsf -- "More Smile admin panels"
  • Shodan query: http.title:"Smile Admin"
  • crt.sh: Certificate Transparency logs for crazydazy.online and skibidispace.xyz

GHOST -- Breakglass Intelligence "One indicator. Total infrastructure."

Share