Researchers Detail EvilGophish Phishing Infrastructure, Evasion Tactics, and Detection Clues
Summary
Hunt researchers describe EvilGophish’s phishing infrastructure and evasion tactics, including Turnstile pages and redirect rules, and explain how login-page text and URL patterns can reveal servers and associated domains.
Key points
- EvilGophish combines GoPhish for campaign email distribution with Evilginx3 for phishing pages and campaign statistics.
- Operators use Cloudflare Turnstile and redirect rules to hinder scanners and route some visitors away from phishing pages.
- Hunt identifies servers using distinctive login-page HTML and URL patterns such as `/login?next=`.
- The researchers found domains mimicking Microsoft, chat services, and cryptocurrency platforms, with many observed servers hosted on DigitalOcean.
- A cluster of six `it-avinc.com` subdomains resolved to one DigitalOcean IP; the researchers said some displayed an Apache default page.
- Hunt noted that `validate.it-avinc.com` had previously redirected to AeroVironment’s legitimate site, but that redirect was no longer active.
- The researchers said they would continue monitoring the infrastructure; they did not confirm that the AeroVironment-mimicking domains were malicious.
Article Details
- Attack Vectors
- Phishing campaigns use domains that mimic well-known organizations and phishing landing pages to target victims.
- EvilGophish supports email and SMS distribution and uses Evilginx3 for campaign tracking and phishing pages.
- Some phishing operators use CloudFlare Turnstile verification pages to hinder online scanners and increase the apparent legitimacy of phishing sites.
- Redirect rules send requests that fail allowlist checks or meet specified criteria to legitimate pages instead of phishing sites.
- Defensive Notes
- Identify EvilGophish instances by examining distinctive HTML text on publicly accessible login pages and URL elements such as /login?next=.
- Correlate login-page signatures with associated domains to identify infrastructure and potential targets.
- Monitor suspicious domains and infrastructure over time; the article notes that many domains associated with the observed IP displayed the Apache2 default splash page.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | account[.]it-avinc[.]com | Suspicious domain associated with the observed EvilGophish infrastructure. |
| DOMAIN | adfs[.]anacap[.]co | Domain listed in connection with a likely attempt to mimic a private equity firm. |
| DOMAIN | anacap[.]co | Domain listed in connection with a likely attempt to mimic a private equity firm. |
| DOMAIN | callcabinet[.]net | Domain listed as part of infrastructure spoofing a compliance call-recording company. |
| DOMAIN | chattie[.]app | Domain listed among suspicious infrastructure mimicking a chatbot app. |
| DOMAIN | chattie[.]org | Domain listed among suspicious infrastructure mimicking a chatbot app. |
| DOMAIN | datafund[.]io | Domain listed among suspicious infrastructure associated with the observed phishing infrastructure. |
| DOMAIN | dev-divine[.]magecommerce[.]com[.]br | Domain listed with infrastructure associated with a spoof of a compliance call-recording company. |
| DOMAIN | example[.]it-avinc[.]com | Suspicious domain associated with the observed EvilGophish infrastructure. |
| DOMAIN | fairdrop[.]app | Domain listed among suspicious infrastructure mimicking a blockchain airdrop site. |
| DOMAIN | it-avinc[.]com | Suspicious domain identified in connection with infrastructure mimicking AeroVironment. |
| DOMAIN | login[.]it-avinc[.]com | Suspicious domain associated with the observed EvilGophish infrastructure. |
| DOMAIN | login[.]microsoft-o365-account[.]com | Domain identified as a Microsoft Office 365 login spoof. |
| DOMAIN | login2[.]anacap[.]co | Domain listed in connection with a likely attempt to mimic a private equity firm. |
| DOMAIN | m365installation[.]com | Domain identified as a Microsoft Office 365 spoof. |
| DOMAIN | validate[.]it-avinc[.]com | Suspicious domain associated with the observed EvilGophish infrastructure; it previously redirected to AeroVironment's legitimate website. |
| DOMAIN | www[.]it-avinc[.]com | Suspicious domain associated with the observed EvilGophish infrastructure. |
| DOMAIN | www1[.]anacap[.]co | Domain listed in connection with a likely attempt to mimic a private equity firm. |
| IPV4 | 142[.]93[.]78[.]17 | IP listed with domains associated with a spoof of a compliance call-recording company. |
| IPV4 | 143[.]198[.]224[.]30 | IP associated with six suspicious domains and an EvilGophish instance detected on port 3333. |
| IPV4 | 178[.]128[.]196[.]190 | IP listed with domains associated with a blockchain airdrop spoof and a chatbot app mimic. |
| IPV4 | 209[.]97[.]180[.]233 | IP listed with a domain identified as a Microsoft Office 365 spoof. |
| IPV4 | 4[.]216[.]156[.]191 | IP listed with a domain identified as a Microsoft Office 365 login spoof. |
| IPV4 | 40[.]81[.]128[.]161 | IP listed with domains described as a likely attempt to mimic a private equity firm. |
MITRE ATT&CK
Vendors
Products
Tools
Evilginx3from project README (Source: GitHub)EvilGophish, authored by fin3ss3g0d and written in Go, integrates Evilginx3, a man-in-the-middle attack framework, with GoPhish, an open-source phishing platform. GoPhish handlesevilgophishThis blog post dives into some of EvilGophish's evasion tactics and demonstrates how identifying administrative panels can assist defenders and researchers in preemptively exposing this infrastructure beforeGophishIn late 2023, Hunt Research published a blog post detailing how we uncover emerging and previously unknown Gophish infrastructure.RedGuardFigure 3: Turnstile HTML template (Source: EvilGophish)Like redirector tools RedGuard and RedWarden, EvilGophish enables operators to set up redirect rules that enhance defense evasion.RedWardenFigure 3: Turnstile HTML template (Source: EvilGophish)Like redirector tools RedGuard and RedWarden, EvilGophish enables operators to set up redirect rules that enhance defense evasion.