Vasilis Orlof walked through how he tracked down deployments of Gophish, the open-source phishing framework that serves awareness trainers and actual attackers equally well.
Starting from a single admin login page on the default port 3333, he pivoted on the gophish.css stylesheet in urlscan (911 results) and on the page’s HTML in Censys, which returned close to 1,200 hosts carrying around 3,500 domains.
Shared SSH fingerprints suggested that several servers were provisioned by the same entity, and many of the domains impersonated brands such as Microsoft, PayPal, LinkedIn and Google.
Telling a malicious campaign apart from a training exercise remains hard, which is why he published the method and kept the IoCs to himself.
All of this works because operators expose the admin interface: the Gophish documentation binds it to 127.0.0.1:3333 by default and says exposing it to the Internet “should only be used if needed”.
Apparently, it is needed quite often.
