UNC1151 Phishing Campaign: Infrastructure Analysis by Censys

In this campaign, cybercriminals directed victims to compromised websites and then to a fake Google login page. The main technical feature of the attack was the use of the WebSocket protocol to intercept entered data in real-time. This allowed operators to automatically bypass multi-factor authentication (MFA) based on SMS or one-time passwords (OTP). To mask their activities, the group used legitimate content delivery networks, including Bunny CDN and Cloudflare, attempting to hide the true IP addresses of the command servers.

Despite efforts to mask themselves with CDN, the cybercriminals made a critical error at the infrastructure level. Experts from Censys discovered that the digital certificate for the spoofing phishing domain was at one point located on the direct IP address 45.194.44.44. This address is physically located in Poland and belongs to the provider Datagear. This revelation was as if the mask was removed: by identifying the true IP address, researchers were able to find other digital certificates used within this operation. Notably, additional phishing resource certificates were generated on the found node, confirming the systematic nature of the group’s actions.

A detailed investigation of the disclosed IP address revealed open ports 3001 and 3002 with specific settings. An HTTP request to port 3002 returned a 404 error with a unique text message, indicating exclusive functionality for WebSocket. This structural indicator was found to be an extremely rare phenomenon in the global network. Searches in the Censys databases by the hash of this response body revealed three more IP addresses worldwide, all belonging to the same campaign. Each of these servers was used to host digital certificates with similar naming patterns, forming a centralized network for data collection.

The investigation of the revealed infrastructure confirmed the targeted nature of attacks against specific regions. Besides the initial attack on email services, the group massively generated certificates for creating fake copies of popular Ukrainian web portals. On one of the identified servers, analysts recorded digital certificates that mimicked mail services I.UA and bigmir)net. Through targeted queries to the infrastructure, an active phishing page was also identified that mimicked the META.UA portal. The combination of this data indicates that the UNC1151 group serially produces fake tools to compromise legitimate European services.

The analysis of the phishing incident proves that modern cybercriminals use complex architectures to scale their attacks and bypass multi-factor authentication. Transitioning from reactive blocking to proactive intelligence creates conditions for rapidly detecting disguised infrastructure arrays. Company iIT Distribution, as a Value Added Distributor, provides expert support in deploying advanced information security solutions, including threat intelligence tools and attack surface management. The iITD team supports projects at every stage, helping partners protect critical credentials and reduce the risks of intelligent cyberattacks.