Shared SSH Keys Link Phishing Infrastructure Targeting Kuwait and Gulf Businesses
Summary
Hunt.io researchers link more than 230 domains impersonating Gulf-region businesses to shared SSH keys and hosting patterns. The ongoing campaign uses cloned sites, including mobile payment lures targeting Zain customers.
Key points
- The campaign, first observed in early 2025, targets fisheries, telecommunications, and insurance businesses in Kuwait, with some infrastructure impersonating a Bahraini fishery.
- Researchers identified more than 230 domains, many hosted across servers in Aeza International’s network and associated with three main IP addresses.
- Two reused SSH key fingerprints and common ASN usage link servers across the infrastructure cluster.
- Phishing pages imitate business websites and services, including a Zain-branded mobile payment portal requesting phone numbers and discounted payments.
- Researchers did not directly observe credential-harvesting code or malware payloads; the reported sites and campaign patterns indicate phishing staging.
- The article provides SSH-key and ASN-based hunting queries, and recommends monitoring reused keys, hosting patterns, and brand-inspired domain registrations.
Article Details
- Attack Vectors
- Phishing portals impersonated businesses in Kuwait’s fisheries, telecommunications, and insurance sectors to prompt users to provide information or make mobile payments.
- Operators used brand-inspired and transliterated domains, cloned storefronts and payment pages, and multi-domain hosting on shared servers.
- The same infrastructure cluster hosted pages impersonating Zain and soliciting phone numbers and discounted payments; credential harvesting code was not directly observed.
- Defensive Notes
- Monitor for reuse of the two SSH RSA SHA-256 fingerprints listed as IOCs to identify related servers.
- Hunt for brand-themed or transliterated domains hosted on Aeza International Ltd infrastructure, including assets associated with ASN AS210644.
- Monitor new domains and cloned pages imitating regional fisheries, insurance services, and telecommunications payment portals.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | al-watanyea[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | al-watanyia[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | al-watnya[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | almotahida1[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | almotheda[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | alwataniaa8[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | alwatanniya[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | alwatanya2[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | alwatenia4[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | alwatnnia[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | alwattanya[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | alwattnia[.]com | Phishing domain impersonating the National Fishing Company of Kuwait. |
| DOMAIN | alwattny[.]com | Brand-inspired phishing domain example identified in the campaign's detection guidance. |
| DOMAIN | alwattnya[.]com | Phishing domain impersonating the National Fishing Company of Kuwait. |
| DOMAIN | alwtaneya1[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | alwtania2[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | awatanaia[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | dallmonfish[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | dalmon-bh[.]com | Phishing domain spoofing Delmon Fish. |
| DOMAIN | dalmon-fishs[.]com | Phishing domain spoofing Delmon Fish. |
| DOMAIN | dalmonfishs[.]com | Phishing domain identified as an example of the campaign's Delmon Fish impersonation. |
| DOMAIN | dalmonfishy[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | delmona5[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | delmone11[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | delmone9[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | delmoon5[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | delmoon9[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | dl5[.]xvipx[.]top | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | el-watnneya[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | elwataniaa8[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | elwattanuia[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | elwattanya1[.]com | Phishing domain using a brand-inspired name to impersonate the National Fishing Company of Kuwait. |
| DOMAIN | ilwatanea[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | megamail[.]pw | Domain listed in the report's IOC table as part of the campaign infrastructure. |
| DOMAIN | motaheda01[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | motahida2[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | motahidda2[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | mothada[.]pro | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | mothedaa[.]live | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | syarati[.]pro | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | tamcar[.]pro | Phishing domain impersonating Kuwait's automotive insurance sector. |
| DOMAIN | tameeeny[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | tamienz[.]pro | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watania01[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | wataniaa10[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | wataniaa9[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | wataniax[.]pro | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watanuia[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watanuia01[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watanuya1[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watanya2[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watanyaa10[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watanyafish[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watenya[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | watnnia[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | wattanuea[.]com | Phishing domain listed on campaign-linked infrastructure. |
| DOMAIN | wtanaya[.]com | Phishing domain impersonating the National Fishing Company of Kuwait. |
| DOMAIN | zain-kw[.]pro | Phishing domain impersonating Zain and hosting a mobile payment lure. |
| IPV4 | 109[.]120[.]178[.]145 | Campaign-linked server hosting phishing domains listed in the IOC table. |
| IPV4 | 134[.]124[.]92[.]70 | Identified in the report as an IP hosting domains associated with the phishing infrastructure. |
| IPV4 | 138[.]124[.]58[.]18 | Campaign-linked server hosting a phishing domain listed in the IOC table. |
| IPV4 | 138[.]124[.]78[.]35 | IP identified as hosting phishing domains in the campaign. |
| IPV4 | 138[.]124[.]92[.]70 | Phishing infrastructure server linked to domains through shared SSH keys and hosting patterns. |
| IPV4 | 150[.]241[.]93[.]231 | Campaign-linked server hosting phishing domains listed in the IOC table. |
| IPV4 | 46[.]226[.]167[.]145 | Campaign-linked server hosting phishing domains listed in the IOC table. |
| IPV4 | 77[.]221[.]152[.]224 | Campaign-linked server hosting phishing domains listed in the IOC table. |
| IPV4 | 77[.]221[.]152[.]232 | Campaign-linked server hosting the listed phishing domain. |
| IPV4 | 77[.]221[.]153[.]225 | Campaign-linked server hosting phishing domains listed in the IOC table. |
| IPV4 | 78[.]153[.]136[.]29 | Phishing infrastructure IP hosting domains including zain-kw[.]pro. |
| IPV4 | 89[.]208[.]113[.]172 | Listed as a campaign network observable; no domains are specified for this IP. |
| IPV4 | 89[.]208[.]113[.]34 | Campaign-linked server hosting phishing domains listed in the IOC table. |
| IPV4 | 89[.]208[.]97[.]251 | Campaign-linked server hosting domains spoofing Delmon Fish. |
| IPV4 | 91[.]108[.]240[.]137 | Campaign-linked server hosting phishing domains listed in the IOC table. |
| SHA256 | 000e6797a0d6571bf2b4e77f86b1e68c61d23f0369b6a5e96682a9d84b4cbef9 | SSH RSA SHA-256 fingerprint reported as consistently reused across campaign-linked assets. |
| SHA256 | dbe1065a0caaa2d1d89001b505ac1a00c5aee6202225b9897580c3c148ea2537 | SSH RSA SHA-256 fingerprint reported as consistently reused across campaign-linked assets. |
MITRE ATT&CK
Vendors
Tools
Countries
Bahrain89.208.97[.]251 hosted domains spoofing Delmon Fish, a prominent fishery company in Bahrain.KuwaitHunt.io researchers are tracking an active phishing operation targeting Kuwait's fisheries, telecommunications, and insurance sectors. First observed in early 2025, the campaign remains ongoing, leveraging more than 100
Industries
FisheriesHunt.io researchers are tracking an active phishing operation targeting Kuwait's fisheries, telecommunications, and insurance sectors. First observed in early 2025, the campaign remains ongoing, leveraging more than 100Insuranceare tracking an active phishing operation targeting Kuwait's fisheries, telecommunications, and insurance sectors. First observed in early 2025, the campaign remains ongoing, leveraging more than 100 domains toTelecommunicationsHunt.io researchers are tracking an active phishing operation targeting Kuwait's fisheries, telecommunications, and insurance sectors. First observed in early 2025, the campaign remains ongoing, leveraging more than 100