GoPhish Infrastructure Linked to Domains Spoofing Polish Energy and Government Organizations
Summary
Hunt.io identified a GoPhish server linked to domains impersonating Polish energy and government organizations, as well as other brands. No phishing content was active during review, but the infrastructure appeared maintained for possible credential collection.
Key points
- A server at 40.67.208[.]154 exposed a GoPhish administrative panel on port 3333.
- The hostname uregov[.]pl and related domains mimicked Poland’s Energy Regulatory Office and private energy companies.
- Researchers identified 18 additional domains on the same infrastructure, including lookalikes for other organizations and brands.
- Subdomains suggesting authentication portals and Punycode lookalikes could help impersonate legitimate services and evade basic domain matching.
- Short-lived TLS certificates and domain registrations continued into early March 2025, including domains resembling Mercedes-Benz services.
- The associated domains returned default 404 pages during review; researchers found no active phishing content at that time.
- The article recommends monitoring suspicious domain registrations, certificate transparency logs, passive DNS, and threat-intelligence feeds.
Article Details
- Attack Vectors
- Domains resembling Polish energy organizations and other entities were associated with a server running a GoPhish administrative panel, suggesting preparation for credential phishing; no active phishing content was observed during the review.
- Subdomains using labels such as auth, bhp, and microsoft, along with Punycode domain names, were described as attempts to impersonate internal portals and trusted services.
- Defensive Notes
- Monitor suspicious domain registrations resembling internal systems or partner organizations.
- Track certificate transparency logs and passive DNS for infrastructure reuse or rotation.
- Use threat intelligence feeds to monitor newly registered or high-risk domains.
- Tune anti-phishing controls for frequently impersonated sectors, including energy, legal, and enterprise SaaS.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | auth-nomadelectric[.]com[.]pl | Energy-company-themed domain associated with the GoPhish infrastructure. |
| DOMAIN | auth[.]nomadelectri[.]com | Energy-company-themed subdomain associated with the GoPhish infrastructure. |
| DOMAIN | baza[.]mnuiak[.]pl | Subdomain listed among the domains tied to the GoPhish server. |
| DOMAIN | bhp[.]nomadelectri[.]com | Energy-company-themed subdomain associated with the GoPhish infrastructure. |
| DOMAIN | bhp[.]xn-nomadelectri-8qb[.]com | Punycode energy-company-themed subdomain associated with the GoPhish infrastructure. |
| DOMAIN | intelect[.]pl | Domain listed among the spoofed domains tied to the GoPhish server. |
| DOMAIN | kuchniavikingi[.]pl | Domain listed among the spoofed domains tied to the GoPhish server. |
| DOMAIN | mercedes-portal[.]pl | Domain described as intended to spoof Mercedes-Benz and associated with the GoPhish infrastructure. |
| DOMAIN | microsoft-m365[.]mercedes-portal[.]pl | Subdomain described as intended to spoof a service associated with Mercedes-Benz and tied to the GoPhish infrastructure. |
| DOMAIN | microsoft[.]nomadelectri[.]com | Subdomain associated with the GoPhish infrastructure and described as impersonating a trusted third-party service. |
| DOMAIN | mnuiak[.]pl | Domain listed among the spoofed domains tied to the GoPhish server. |
| DOMAIN | munaik[.]pl | Domain listed among the spoofed domains tied to the GoPhish server. |
| DOMAIN | nomad-electric[.]com | Energy-company-themed domain associated with the GoPhish infrastructure. |
| DOMAIN | nomadelectri[.]com | Energy-company lookalike domain associated with the GoPhish infrastructure. |
| DOMAIN | testin[.]rqower[.]solar | TLS certificate common name described as likely intended to impersonate a testing environment linked to R.Power Renewables. |
| DOMAIN | uregov[.]pl | Domain identified as impersonating Poland's Energy Regulatory Office and associated with the GoPhish infrastructure. |
| DOMAIN | xn-nomadelectri-8qb[.]com | Punycode energy-company lookalike domain listed among the domains tied to the GoPhish server. |
| DOMAIN | zdrofit[.]com[.]pl | Domain listed among the spoofed domains tied to the GoPhish server. |
| IPV4 | 185[.]253[.]212[.]22 | Previous IP address to which nomad-electric[.]com pointed before being updated to the GoPhish server. |
| IPV4 | 40[.]67[.]208[.]154 | Server hosting the exposed GoPhish administrative panel and associated spoofed domains. |
Vendors
Tools
Countries
NetherlandsFigure 1: SQL Search results for hostnames containing the word 'gov' linked to malware.At the time the domain was observed, it resolved to a Microsoft IP address in the Netherlands:Polandthis structure-an unlikely format for official infrastructure. The domain appears intended to spoof Poland's Energy Regulatory Office (URE), the agency responsible for overseeing the country's electricity and gas
Industries
AutomotiveCateringBeyond the energy sector, additional domains tied to the server included lookalikes for a fitness gym, a catering service, and an apparent intellectual property law firm. These stand apart from the earlier energy- andEnergyin Hunt.io, we identified infrastructure associated with domains spoofing Polish organizations in the energy sector, including both a national regulator and a private renewable energy firm. While the infrastructureFitnessBeyond the energy sector, additional domains tied to the server included lookalikes for a fitness gym, a catering service, and an apparent intellectual property law firm. These stand apart from the earlier energy- andGovernmenthostnames, including the keyword gov-a common pattern in phishing infrastructure impersonating government services.Legalcluster built around the GoPhish framework and tied to domains impersonating Polish energy entities, legal services, and global brands. While the server was not serving phishing content at the time of review, its