How a Technical Co-founder Built a Clone-Resistant and Self-Verifying B2B Platform Without Hype or Drama
Disclaimer: This was a controlled internal security test. No customer data was ever exposed. All credentials shown were simulated.
Most top wholesalers would rather get hacked than admit they had a weakness. Not these guys.
When you think of a company that distributes bulk janitorial supplies, Sanicare paper towel products, or Zachem liquid hand soap, what comes to mind? Most people picture a traditional warehouse. You know the kind. Lots of clipboards. People walking around with manual stock count sheets. A supply chain that moves at the speed of a tricycle stuck in Manila traffic.
You probably do not imagine a command line interface. You do not think about penetration testing or Kali Linux. And you definitely do not picture a high stakes race between a developer and one of the most well known social engineering toolkits in cybersecurity.
But Wholesale Dito Store, managed by Clickerwayne Zelle Solutions Inc., does things a little differently.
While many players in the wholesale industry are still relying on manual order forms and phone calls, Wholesale Dito has been quietly building a digital backbone for the Philippine B2B supply chain. They have digitized the entire procurement process. Not just for big companies. For sari-sari store owners. For small resellers. For anyone who needs to buy bulk Zonrox, Femme paper towel products, or industrial cleaning solutions without jumping through hoops.
Their proof is not just in the volume of products they move. It is in their proprietary NØFEE Direct Settlement system and their Progressive Web App or PWA. These are not buzzwords. These are real tools that help small business owners save time and avoid overpaying for essentials like Sanicare tissues and Zachem liquid hand soap.
The company is led by its CEO and Co-Founder Zelle, who focuses on making the store a primary source for everything from sari-sari store essentials to industrial facility needs. But the digital side of the operation is overseen by the Technical Co-Founder, known as Clickerwayne.
On May 11, 2026 at 4:58PM, Clickerwayne conducted his 9th pentest. He put his technology through something most wholesalers never think about: a real, controlled, internal security test. Not a theoretical audit. Not a checklist from a consultant. He booted up Kali Linux, opened a terminal, and tried to break his own platform.
What happened next tells you everything about how this company thinks about trust, safety, and the people who depend on them.
The Controlled Pentest Recording - Redacted for Responsible Disclosure
Below, you will see a video. But let me explain what you are watching before you press play.
This is a screen recording of a controlled internal security test. We added a visible timer and a "Controlled Penetration Testing Documentation" header for clarity. Sensitive company/internal information has been blurred. No attack frames were removed or re-ordered. What you see is the complete, real sequence of the SEToolkit clone attempt.
ⓘ Disclosure note: The yellow banner and timer were added after capture. The attack method, timing, and results are unaltered.
In the video, you are watching the Social Engineer Toolkit or SEToolkit in action. This is the same tool that real world attackers use to clone websites. You will see Clickerwayne clone the Wholesale Dito Store interface. You will see how a fake version of the site, which looks identical to the real one where you buy bulk Zonrox or Femme paper towel products, is created in seconds.
Now here is the important part. The video shows a test user entering fake credentials into the fake site. Those simulated credentials appear in plain text inside the attacker terminal. The recording stops right there before any real system is touched.
Why is this video not a disaster for the company? Because this was a controlled test. No customer data was ever at risk. No real login was ever stolen. This was the Technical Co-founder doing what any responsible engineer should do. He was looking for the door before someone else found it.
Most companies would bury this video. They would never let the public see how close they came to a real vulnerability. But Wholesale Dito Store made a different choice. They decided that transparency is better than pretending to be perfect. They decided that showing the problem is more honest than hiding it.
That takes guts. And it also takes a real fix. Which is exactly what Clickerwayne built next.
Why the Sari-Sari Store Owner Should Care About This
In the Philippines, cybersecurity is often treated as a rich company problem. Most distributors think, I am just selling liquid hand soap and Femme paper towel products. Why would anyone hack me?
That is a dangerous way to think. And here is why.
When a neighborhood sari-sari store owner logs in to restock on Zachem liquid hand soap or Sanicare tissues, they are using their hard earned capital. For many of them, that capital represents weeks or months of savings. If an attacker clones the site and intercepts that login, they do not just get a password. They get a chance to redirect funds or steal a business identity.
Being a top wholesaler is not just about having the lowest price on Zonrox. It is about providing a safe space for those transactions to happen. It is about making sure that a mother trying to stock her small store does not lose everything because of a fake website.
The Technical Co-founder knew that good enough was not an option. The video you just read about was his wake up call. It was the proof that standard walls were not high enough.
Phase One: The Textbook Solutions That Did Not Work
After seeing how easily the SEToolkit could capture simulated credentials, Clickerwayne immediately went to work on a fix. Like any skilled developer, he started with the industry standards.
He began at the server level. He hardened the .htaccess file. He implemented CSRF tokens and Origin headers. For those who are not developers, these are basic security layers recommended by the OWASP Foundation. They are supposed to stop fake sites from working.
The result was failure.
Despite these configurations, the SEToolkit clone was still able to function. It still loaded. It still looked like the real Wholesale Dito Store. A regular customer would not have been able to tell the difference.
So he moved to the application layer. He tried common PHP and JavaScript redirects to force users back to the official domain. Again, the toolkit bypassed them.
For a developer, this is the frustration phase. It is the realization that the tools everyone tells you to use are not working against a determined, modern attack. You start questioning yourself. You wonder if you missed something obvious. You think about just giving up and accepting the risk.
But Clickerwayne did not give up. He did something smarter. He went looking for a benchmark.
Phase Two: Testing Against the Giants
To find a better way, Clickerwayne performed a controlled test on a cloned Facebook login page. He was not trying to hack Facebook. He was using it as a benchmark to see how one of the worlds biggest platforms handled SEToolkit.
What he found was interesting.
Facebook defense allowed the fake site to load. But it prevented the credentials from being captured by triggering an error message. The user would see a warning. The fake site would still exist, but the login would fail.
That is a solid defense. Many security experts would call it good enough.
But Clickerwayne felt it was not right for Wholesale Dito Store. He did not want the user to even see a fake version of the store. If a customer is looking for Sanicare or Femme paper towel products, they should not even have the chance to land on a fraudulent page. He wanted a solution where, if the URL was wrong, the site simply would not appear.
No error message. No fake login screen. Just nothing.
That is a much higher standard. And that is what he set out to build.
Phase Three: The 60 Minute Breakthrough
This is where the story shifts from frustration to engineering.
Clickerwayne stopped trying to find a patch. Instead, he started analyzing the source code of the clone site that the toolkit had generated. He spent time looking at exactly how the toolkit wrapped his PWA in a malicious layer.
He realized something important. While the toolkit could copy the look of a site selling Zachem professional-grade cleaning solutions, it could not replicate the internal environment of his PWA if that app was self aware.
In a high intensity sprint that lasted less than an hour, he cycled through three iterations of a custom built defense.
- First attempt. Modified headers and origin checks. Failed again. The toolkit still found a way.
- Second attempt. Aggressive scripts to break the clones connection. Failed. The clone still loaded.
- Third attempt. He used the same JavaScript approach but tweaked the internal logic based on his analysis of how the toolkits code behaved.
It worked.
He developed a custom Environment Validation Logic. By tweaking how the PWA verifies its own location and runtime environment, he created a system that allows the app to recognize its home. If the site detects it is being rendered on any domain that is not the official wholesaledito.store, it simply refuses to show the store.
No warning page. No fake login. Just a blank screen.
What This Fix Actually Does for Product Integrity
This was not just about code. It was about the products and the people who rely on them.
When a customer searches for a top wholesaler of liquid hand soap or bulk Zonrox, they need to know they are on the legitimate site. Because this was a custom built fix, it is not a patch that can be easily bypassed by the next version of a hacking tool. It is a structural fix that makes the site effectively clone-resistant.
Think about what that means for a sari-sari store owner in a remote province. They might not have antivirus software. They might not even know what phishing means. But if they click a bad link while looking for Sanicare or Femme paper towel products, they will not see a login box. The site simply will not load. The defense is invisible and absolute.
That is the difference between standard security and security that actually protects real people.
Clickerwayne chose not to use the error message strategy seen on Facebook because he wanted a higher level of safety. Error messages still confirm to the attacker that a real site exists. A blank screen gives the attacker nothing.
Why This Matters More Than Ever for Philippine Top Wholesalers
The wholesale industry in the Philippines is going through a digital transformation. More and more small businesses are moving away from manual ordering and phone calls. They want the convenience of ordering online. They want to compare prices. They want to pay digitally.
But with that convenience comes risk.
The National Privacy Commission of the Philippines has been pushing for stronger data protection measures. The Cyber Security Philippines CERT has been warning about the rise of phishing attacks targeting small businesses. And the OWASP Top 10 Security Risks list has included injection attacks and broken authentication for years.
Yet most wholesalers are still ignoring these risks. They think cybersecurity is for banks and e commerce giants. They think no one would target a company that sells liquid hand soap and cleaning supplies.
That thinking is exactly what attackers are counting on.
Wholesale Dito Store took a different path. They did not wait for a real breach to happen. They did not wait for a customer to lose money. They proactively tested their own system, found a weakness, and built a permanent fix.
That is not just good security. That is good business.
What Other Businesses Can Learn From This
If you run a B2B or wholesale operation, there are three lessons here that apply to you regardless of your industry.
First, standard security measures are often not enough against modern toolkits. The .htaccess file, CSRF tokens, and origin headers that Clickerwayne tried first are recommended by OWASP for a reason. They stop a lot of attacks. But they do not stop everything. If you assume that following a checklist makes you safe, you are wrong.
Second, testing your own system is better than waiting for someone else to test it for you. Clickerwayne did not hire an expensive consultant. He did not buy a fancy security appliance. He opened Kali Linux and tried to break his own site. That hands on approach found a real weakness that a theoretical audit might have missed.
Third, a custom fix is often better than a generic one. Facebook solution is good for Facebook. But it was not right for a wholesale store whose customers are not tech savvy. By building his own environment validation logic, Clickerwayne created a solution that fits his specific business and his specific customers.
These lessons apply whether you sell Zonrox, Sanicare products, or something completely different.
Addressing the Concerns Some Readers Might Have
Let me address a few questions that might be going through your head right now.
Is this article admitting that Wholesale Dito Store was insecure before?
Yes and no. Every website has vulnerabilities. The question is whether you know about them. Before this test, Clickerwayne did not know about this particular weakness. After the test, he fixed it. That is how security is supposed to work.
Does this mean customer data was ever stolen?
No. This was a controlled, internal test. No real customer credentials were ever captured. The video shows simulated data entered by the tester.
Should other wholesalers be worried about the same issue?
Possibly. The SEToolkit works on many websites, not just Wholesale Dito Store. If you run an e commerce or wholesale site, you should test whether your own platform can be cloned. Chances are, you will find something.
Why publish this instead of keeping it quiet?
Because transparency builds trust. Wholesale Dito Store could have quietly fixed the issue and never said a word. But by sharing what they learned, they help other small businesses understand the real risks and real solutions.
A Closer Look at the Technical Fix
For those who want a little more technical detail without getting lost, here is what the Environment Validation Logic actually does.
Most websites rely on the server to check whether a request is legitimate. That is what the .htaccess file and origin headers were trying to do. But the SEToolkit bypassed those checks by pretending to be a normal browser.
Clickerwayne's fix moved the check to the client side, but not in a way that an attacker could easily remove. The PWA verifies its own runtime environment. It checks for specific variables that exist only on the real domain. If those variables are missing or different, the app refuses to render.
Think of it like a security guard who checks not just your ID but also asks a question that only a real employee would know. The fake site might look right, but it cannot answer the hidden question.
That is why this fix is so effective. It targets the exact gap that the SEToolkit exploits.
Why This Matters for Product Brands Like Sanicare, Femme, Zachem and Zonrox
Brands like Sanicare, Zonrox, Femme, and Zachem trust Wholesale Dito Store to distribute their products. They want to know that their authorized wholesaler is protecting their reputation as well as their own.
If a fake site stole money from a sari-sari store owner using the Wholesale Dito name, those brands would be associated with that fraud. Customers would not say, I got scammed by a fake site. They would say, I got scammed buying Zonrox from that wholesaler.
So by fixing this vulnerability, Wholesale Dito Store is not just protecting itself. It is protecting the brands it carries. That is the kind of relationship that makes a top wholesaler worth doing business with.
What Happens Next
The work did not stop with this 60 minute coding sprint. Clickerwayne has integrated the Environment Validation Logic into the regular development process. Every new version of the PWA goes through the same testing. Every change is checked against the SEToolkit and other common attack tools.
The company has also shared their findings with the wider Philippine wholesale community through informal channels. They are not keeping this fix a secret. They want other wholesalers to know that this kind of attack exists and that it can be stopped.
In the future, they plan to publish more technical deep dives for developers who want to implement similar protections on their own sites. Not as a marketing gimmick. As a genuine effort to raise the security standard in an industry that has been ignoring it for too long.
A Final Word on Trust and Transactions
The success of that 60 minute coding sprint proves something important. Even a simple wholesaler can be a technical powerhouse if they care enough to try. Wholesale Dito Store has earned its place as a top wholesaler not just by having the best prices on liquid hand soap or Zachem cleaning solutions, but by building a platform that is as secure as a bank.
They did not just fix a bug. They built a system where every time you search for a top wholesaler, you find a platform that is actually looking out for you. The pentest recording you read about at the beginning of this article is no longer a threat. It is now a trophy of a battle won.
When you buy bulk Zonrox, Sanicare tissues, or any other product from Wholesale Dito Store, you are not just getting a good price. You are getting a platform that has been tested, broken, and rebuilt to be stronger. That is what real security looks like. It is not a certificate on a wall. It is a developer in a terminal, refusing to accept that good enough is good enough.
That is the kind of partner every sari-sari store owner deserves.
Become a Zachem Distributor
Join a secure supply chain that actually tests its own platform.
Are You Ready? »Sources and References
- Cyber Security Philippines CERT
- TrustedSec Social Engineer Toolkit
- OWASP Top 10 Security Risks
- Kali Linux Official Documentation
- National Privacy Commission Philippines
- Google Web Dev PWA Security Standards
- NIST Cybersecurity Framework
- Sanicare Official Brand Profile
- Clickerwayne N∅FEE Direct Settlement Technical Explainer
