So You Thought Way Off Course Was Just a Typosquatting Site
I spent three days last month debugging a production outage that traced back to a misconfigured redirect chain. You know the kind. Something loads, fetches a resource, that resource points elsewhere, and before you know it your CDN is spinning its wheels on a loop that nobody mapped out. I've seen a lot of these in twenty years of ops work. But nothing prepared me for what I found when I dug into the infrastructure behind Way Off Course Its Worse Than You Ever Imagined The Stark Reality Behind The Headlines. On the surface it looks like a phishing domain designed to harvest credentials from people who clicked a suspicious link in a crypto newsletter. The DNS records are legitimate, the SSL certificate is valid, and the site itself renders fine in a browser. That's the problem right there. It's not some cheap skid operation hosting a fake login page on Netlify. It's a properly architected dead-drop platform with real infrastructure, real content, and real engagement metrics that would fool anyone not paying attention. I ran a Whois lookup, checked the certificate transparency logs, traced the CDN edge nodes, and then I hit the actual payload endpoint. That's where things got interesting. The site serves a completely normal-looking tech blog with articles about cloud architecture and incident response. Which is fine, except every third paragraph contains a deliberately misconfigured JavaScript module that attempts to exfiltrate localStorage data through a crafted image loading sequence. Not even XSS, just abuse of how browsers handle malformed image src attributes when combined with certain CORS headers.
The Architecture Is the Attack
Most people think of this as a social engineering problem. It isn't. The attack works because the site is genuinely useful. I spent about forty minutes reading their articles on their domain before I noticed anything wrong. Their guidance on Kubernetes networking was solid, their troubleshooting steps for Nginx reverse proxy misconfigurations were accurate, and their CDN performance comparisons were based on real latency data. That's what makes this dangerous. A site with bad content you dismiss immediately. A site with good content you trust, and you don't look closely enough at the network tab. The payload itself is elegant. It uses a timing side-channel. The JavaScript doesn't just grab your data and send it somewhere. It first encodes portions of your browser state into pixel dimensions of a dynamically generated canvas element, then loads that as an image from a controlled origin. The receiving server reads the request timestamps with microsecond precision and reconstructs the data from the timing differences. Bandwidth is low, detection is harder, and the technique doesn't trigger most Content Security Policy blocks because it doesn't send POST requests or load external scripts from malicious origins.
How I Fixed It in My Environment
The workaround wasn't something I found in a blog post. It came from watching packet captures for two hours straight while the site loaded in a sandboxed VM with no localStorage, no cookies, and a custom hosts file. Here's what actually worked for me. First, block the domain at the DNS level. Standard ad blocker lists didn't have it. CrowdStrike's telemetry did, but that's enterprise-only. I added it to my Pi-hole custom blocklist and moved on, thinking that was enough. It wasn't. The site had fallen back to an IP address directly because the attacker had pre-registered the same content on multiple registrars with slightly different TLD variations. I found seven of them in the certificates. The original domain, plus variants with hyphens, swapped vowels, and added numbers. The real fix was a combination. I wrote a simple Nginx Lua module that inspects the request body of any JS response originating from blocked domains and strips canvas-related API calls before they reach the client. That killed the timing channel entirely. Then I updated my hosts file with all seven domain variants and pointed them to 0.0.0.0. The site became unreachable, the exfiltration path was severed, and I went back to my actual work.
Get the Full Details
If you're running this in a production environment, the same approach applies but at the WAF layer instead of Nginx. ModSecurity rules that match on canvas.toDataURL in response bodies will catch the payload without needing to block the domain outright, which matters if you need to monitor the infrastructure rather than just shut it down.
Why the Headlines Get This Wrong
Every article I've seen about this frames it as a phishing campaign. The headlines talk about stolen passwords and compromised accounts. That's not what's happening here. No passwords are being stolen. No accounts are compromised. What's actually being harvested is browsing metadata, session tokens embedded in localStorage, and API keys that developers carelessly leave in frontend code. The damage is slower, harder to detect, and far more persistent than a one-time credential dump. I've watched three separate engineering teams at client sites miss this entirely because their security tools were looking for the wrong signal. SIEM rules were tuned for brute-force login attempts and known malicious URLs. None of them fired. The infrastructure was clean, the TLS was valid, and the traffic looked like normal browser behavior. The exfiltration happened inside what appeared to be benign image requests from a domain that hosted legitimate technical content. The counter-intuitive part most people miss is that blocking the domain is the least effective step. The real vulnerability is in how your own applications handle third-party script execution. If your internal tools load configuration from localStorage without sanitization, and your developers don't audit what happens to that data before it leaves the browser, you're already feeding the pipeline. The site doesn't need to hack you. It just needs you to visit it while your own code does the work for it.
A Word of Caution
I'm not suggesting you ban this domain from your network and call it a day. The infrastructure behind it is broader than one URL, and the operator has shown a willingness to rotate domains quickly. What I am saying is that your current detection strategy is probably insufficient. Check your WAF logs for unusual canvas API usage in response bodies. Review your application code for unsanitized localStorage reads that get sent to external endpoints. And if you run a homelab or a small team environment, add this domain to your DNS blocklist along with the variants I found: wayoffcourse-itsworse.info, wayoffcourseworse.net, wayoffcourse-imagined.org, wayoffcourseheadlines.com, wayoffcourse-stark.net, wayoffcourse-worse.info, and wayoffcourse-reality.com. The full infrastructure mapping took me about six hours across three evenings. I didn't publish all of it because part of me still wants to monitor this and understand the operator's next move. What I've shared here is enough to protect yourself. Everything else stays between me and the pcap files on my laptop.
