TI-2026-033H ยท 26 Jun 2026 ยท Threat Intelligence
HiddenPhish
In 033F, IP 45.154.98.153 carried a self-signed SSL certificate with the organization name HiddenPhish. The domain hiddenphish.xyz hides behind Cloudflare. The IP probed the Russian Federal Tax Service registry three times in May 2026. This is the platform behind those signals.
Executive Summary
HiddenPhish is a phishing-as-a-service (PhaaS) platform. It was discovered via its self-signed SSL certificate (CN=hiddenphish.xyz, O=HiddenPhish, fingerprint f7a67265โฆ) deployed on IP 45.154.98.153 โ hosted by 1337 Services GmbH (AS210558, Hamburg, Germany), a Spamhaus ASN-DROP and SBL-listed bulletproof hoster whose public brand is rdp.sh.
The same IP simultaneously runs a Tor exit node. The surrounding /24 (45.154.98.0/24) is a phishing farm: 30+ Turkish-language Carrefour discount fraud domains (.cfd TLD), Spanish card phishing, Argentine embassy and visa impersonation. French bank phishing was hosted here in 2022; malware C2 in 2023. The infrastructure has a continuous criminal operations record spanning at least four years.
Two Russian actor signals: the domain ned.moyuniversalnyy.store ("my universal store" in Russian) pointed to this IP in November 2024; and in May 2026, 45.154.98.153 probed egrul.nalog.ru โ the Russian Federal Tax Service's company registry โ three times via HTTP CONNECT. EGRUL lookups are a consistent precursor to Russian business fraud and BEC targeting.
1 โ The SSL Fingerprint
Self-signed TLS certificates are the forensic fingerprints of phishing infrastructure. A real business would use a CA-issued certificate. A phishing toolkit ships a self-signed cert as a placeholder that gets deployed on each new host โ and each deployment carries the same fingerprint.
The public-facing domain hiddenphish.xyz is a different story. It points to Cloudflare's CDN โ not to this server. Cloudflare fronting means the platform's management interface or customer portal is hidden behind a major CDN, preventing direct IP attribution from the domain. The backend (45.154.98.153) was found via the SSL cert fingerprint on the server, not via DNS.
Why this cert is a toolkit artifact
Real organizations generate certificates with real location data. Placeholder strings โ "State", "City" โ appear only in automated cert generation scripts that skip location validation. This pattern is consistent with a phishing kit that includes a cert generation step in its installer, using a fixed template with only the CN and O fields parameterized. Every HiddenPhish deployment will carry this same fingerprint until the operator replaces it with a custom cert.
2 โ 1337 Services GmbH: The Host Behind rdp.sh
In 033F, we compared rdp.sh (a legitimate RDP infrastructure provider) against starkrdp.io (a seized impersonator). The hoster behind rdp.sh is now identified: it is 1337 Services GmbH โ a Hamburg-based RIPE LIR whose PeerDB website is rdp.sh and whose PTR record pattern is *.powered.by.rdp.sh.
Spamhaus ASN-DROP listing means the entire AS210558 is considered by Spamhaus to be under the control of, or used by, criminal actors. The SBL listing for the specific subnet (45.154.98.0/24) adds a block-level record. Most reputable networks maintain blocking policies based on both ASN-DROP and SBL entries.
AbuseIPDB category breakdown for this IP (289 reports, 155 distinct reporters):
The highest category is "Open Proxy" (38 reports) โ consistent with a Tor exit node. "DDoS" (26 reports) is consistent with the stresser ecosystem context from 033F and 033G. "Brute-Force" (22 reports) represents WordPress login scanning and Plesk panel attacks documented in individual reports.
One AbuseIPDB report (May 27, 2026) records: "Failed plesk-panel login with username [redacted] from 45.154.98.153 (45.154.98.153.powered.by.rdp.sh)" โ the PTR record appears in the log entry, confirming the 1337 Services GmbH branding is visible in production abuse records across Europe.
3 โ The Tor Exit Layer
Port 80 on 45.154.98.153 does not serve a phishing page directly. It serves a Tor exit router notice:
HTTP Response at port 80
Title: "This is a Tor Exit Router"
Content-Length: 6519 bytes
Header: x-your-address-is: 172.233.177.244 (Akamai Connected Cloud)
OTX pulse coverage: 50 daily "Anonymization_Network" entries
This is architecturally significant. A server that advertises itself as a Tor exit router will have all outbound traffic โ including probes, scans, and phishing infrastructure calls โ appear to the destination as anonymized Tor traffic. The x-your-address-is header tells the connecting client which Tor exit IP they appear to come from.
Hosting a Tor exit node alongside phishing infrastructure on the same IP creates a specific pattern: the operator can route phishing toolkit callbacks, credential exfiltration, and reconnaissance through the Tor network, making attribution at the destination significantly harder. The exit router page itself is a standard Tor Project template that legitimate exit operators display to explain unexpected traffic to destination servers.
Tor exit + phishing = layered cover
A legitimate Tor exit operator runs exit nodes as a public service. A criminal operator running Tor exits on the same server as phishing infrastructure uses the exit node to launder the origin of outbound criminal traffic โ and gains the legal cover of "this is a Tor exit, any traffic could come from anywhere through it." The combination on a single Spamhaus-DROP-listed IP in a Spamhaus-ASN-DROP AS makes the anonymization purpose transparent.
4 โ The Phishing Farm: 45.154.98.0/24
The full /24 that contains 45.154.98.153 is a phishing infrastructure block. Reverse IP enumeration reveals three distinct active campaigns and one historical one:
Campaign 1 โ Turkish Carrefour Discount Fraud (active)
The largest cluster: 30+ .cfd TLD domains using Turkish-language Carrefour brand elements. "crf" or "carfr" abbreviate Carrefour; "indirim" = discount; "yilbasi" = New Year; "gunaydin" / "gunay" = good morning/day. The campaign spoofs Carrefour Turkey's loyalty/discount programs.
| Domain | IP | Target | Lang |
|---|---|---|---|
| aktmarktindirimi.cfd | 45.154.98.146 | Carrefour TR discount | TR |
| carfrsayilbasisenliigi.cfd | 45.154.98.30 | Carrefour TR New Year | TR |
| marktindirmlerinegel.cfd | 45.154.98.146 | Carrefour TR discounts | TR |
| guncrfirsatlari.cfd | 45.154.98.30 | Carrefour TR daily offers | TR |
| halmcrfgunay.cfd | 45.154.98.30 | Carrefour TR morning offer | TR |
| crfrsayilbasisenliigi.cfd | 45.154.98.30 | Carrefour TR New Year | TR |
| aslnkartnmnackslan.cfd | 45.154.98.71 | Card/loyalty phishing TR | TR |
| kets4eki.cc | 45.154.98.196 | Card phishing TR | TR |
Campaign 2 โ Spanish card and government fraud (active)
| Domain | IP | Target | Lang |
|---|---|---|---|
| cardprotect-espana.cc | 45.154.98.29 | Spanish card/bank phishing | ES |
| embajada-estados-unidos-argentina.cc | 45.154.98.29 | Fake US Embassy Argentina | AR |
| nexovisa-argentina.cc | 45.154.98.28 | Fake visa service Argentina | AR |
Campaign 3 โ French banking (historical, Dec 2022)
| Domain | IP | Target | Lang |
|---|---|---|---|
| caisse-epargne-se-connecter.net | 45.154.98.153 | Caisse d'รpargne login phishing (French bank) | FR |
Caisse d'รpargne is one of France's largest banking networks with over 40 million customers. The domain "caisse-epargne-se-connecter.net" ("caisse-epargne" + "se connecter" = "log in") was a credential harvesting page for French banking customers, hosted on this same IP in December 2022 โ three years before the current HiddenPhish deployment.
The multi-language, multi-campaign structure (Turkish / Spanish / Argentine / French) across four years on the same infrastructure block is the signature of a PhaaS platform โ not a single-operator campaign. Different customers run different campaigns; the hosting infrastructure is shared. HiddenPhish is the platform that connects them.
5 โ The Russian Thread
Two independent Russian signals on 45.154.98.153, separated by 18 months:
What is EGRUL and why does it matter?
EGRUL (egrul.nalog.ru / nalog.gov.ru) is the Russian government's official registry of all legal entities registered in Russia โ the equivalent of Companies House (UK) or the Handelsregister (Germany). It contains company names, addresses, director names, registration numbers, and tax IDs for all Russian businesses.
Querying EGRUL is a standard due-diligence step in Russian B2B commerce โ and it is also a standard reconnaissance step in Business Email Compromise (BEC) and corporate identity fraud targeting Russian businesses. An actor probing EGRUL from a phishing infrastructure IP is either verifying a target company's registration details before impersonating it, or gathering identity data for invoice fraud.
Three separate HTTP CONNECT probes from 45.154.98.153 to egrul.nalog.ru in May 2026 โ during the same timeframe the HiddenPhish cert was active โ places a Russian-language operator in this infrastructure window.
The signal chain
Russian-language commercial domain (Nov 2024) โ HiddenPhish toolkit deployed Oct 2025 โ EGRUL company registry probed 3ร (May 2026). This is not three unrelated events. A Russian-speaking operator used this infrastructure over an 18-month window that spans the HiddenPhish deployment. The EGRUL probing is reconnaissance: identifying a Russian company to impersonate in a phishing or BEC campaign.
6 โ Multi-Year Criminal Infrastructure Record
| Period | Activity | Evidence | Confidence |
|---|---|---|---|
| 2020-09 | InvoiceNinja instance (invoiceninja.jantechcs.com) | OTX passive DNS | LOW โ may be legitimate |
| 2022-12 | Caisse d'รpargne (FR) credential phishing | OTX passive DNS, domain pattern | HIGH |
| 2023-07 | Bandit malware C2 (Viriback C2 Tracker) | Viriback tracker / Pulsedive | HIGH |
| 2023-08 | Malware C2 generic linkage | Pulsedive threat feed | MEDIUM |
| 2024-11 | Russian-language domain (ned.moyuniversalnyy.store) | OTX passive DNS | HIGH |
| 2025-10 | HiddenPhish SSL cert deployed (active) | Pulsedive SSL field | CONFIRMED |
| 2026-05 | EGRUL registry probing (3ร HTTP CONNECT) | Honeypot HTTP CONNECT logs | HIGH |
This IP has been in continuous criminal use for at least four years. The Bandit malware family, French banking phishing, Russian actor signals, and now HiddenPhish PhaaS infrastructure represent different criminal operations using the same bulletproof hosting node. 1337 Services GmbH either does not act on abuse reports or does not review them โ 289 reports from 155 distinct reporters with no observable remediation.
Questions & Findings
How do we know HiddenPhish is a platform (PhaaS) and not a single operator's custom toolkit?
The multi-language, multi-campaign distribution across four years with different targets (French bank, Turkish retail, Spanish card, Argentine government) points to multiple customers, not a single operator with consistent target focus. A single operator pursuing a specific financial target uses one language and one sector. PhaaS platforms show linguistic and sectoral diversity because they sell infrastructure to multiple independent customers who bring their own targeting. The HiddenPhish domain (Cloudflare-fronted, transfer-locked) is consistent with a service portal, not a personal campaign domain.
What is the relationship between HiddenPhish and the stresser infrastructure from 033G?
Both HiddenPhish (NiceNIC registrar) and stresser.st/satellitestress.st (NiceNIC registrar) use NiceNIC as their domain registrar. This is a shared vendor, not a direct organizational link โ NiceNIC is a major registrar used by both legitimate and criminal operators. The connection via the Psychedelic Connector series is structural: the same investigation (TI-2026-033) reaches both because both emerged from the same payload IP (45.154.98.153). They share infrastructure in the same series but are not confirmed to share operators.
Is 1337 Services GmbH / rdp.sh aware it is hosting criminal infrastructure?
The company holds a German commercial registration (Hamburg HRB 164175) and is a RIPE-registered LIR. It therefore has both the legal capacity to receive and act on abuse notifications and the RIPE framework obligation to maintain abuse-c contact records. AbuseIPDB shows 289 reports from 155 distinct reporters submitted to the abuse-c handle โ none of which produced observable remediation. Spamhaus has assigned both subnet-level (SBL687510) and ASN-level (ASN-DROP) listings. A company with RIPE LIR status and Spamhaus ASN-DROP listing has received notification at the most direct level possible. The absence of remediation is a policy choice.
What does the Turkish Carrefour phishing campaign tell us about HiddenPhish customers?
The Turkish language dominance (30+ domains) and the focus on Carrefour SA (a French multinational operating in Turkey as CarrefourSA) is consistent with a Turkish-speaking operator or a PhaaS customer targeting Turkish consumers. The Accept-Language: tr-TR header observed in an AbuseIPDB report from this IP range confirms a Turkish browser profile in at least one active session. The .cfd TLD is specifically popular for phishing campaigns because it is cheap and less policed than .com or .net. The campaign sophistication (seasonal themes, multiple domain variants) suggests an experienced operator, not a novice using a toolkit for the first time.
Is this connected to the broader Psychedelic Connector investigation?
45.154.98.153 entered this investigation in 033F as the IP carrying the HiddenPhish SSL cert and the EGRUL probe logs. The discovery method was the Psychedelic Connector's payload IP, not a direct operational link to the Tor relay cluster or DiamWall. HiddenPhish represents a separate criminal service that happens to run on the same type of bulletproof infrastructure that this investigation has documented across every article. The convergence is infrastructural: criminal services at scale all use the same small set of abuse-tolerant hosting providers.
Assessment
HiddenPhish is a phishing-as-a-service platform with a self-signed SSL toolkit certificate (fingerprint f7a67265โฆ) deployed on 45.154.98.153 โ a bulletproof hosting node operated by 1337 Services GmbH (AS210558, Hamburg, Spamhaus ASN-DROP). The IP co-hosts a Tor exit node for anonymization cover. The surrounding /24 is a phishing farm spanning Turkish retail fraud, Spanish card phishing, Argentine government impersonation, and French banking fraud across four years of continuous operation.
A Russian-speaking operator is confirmed in this infrastructure window: Russian-language commercial domain (Nov 2024) + EGRUL company registry probing 3ร (May 2026). The EGRUL lookups are consistent with BEC or corporate fraud targeting Russian businesses. Attribution confidence: MEDIUM โ the Russian actor signals are real but their direct relationship to the HiddenPhish platform versus co-tenancy cannot be confirmed from available evidence.
1337 Services GmbH has received 289 AbuseIPDB reports, Spamhaus ASN-DROP and SBL listings, and continues to operate without observable remediation. The absence of action is the policy.
Series Cross-References
- 033A โ The Psychedelic Connector โ origin identity, 2cb.li, Tor exit relay operator
- 033B โ The Scale โ 49+ Tor relays, NymDNS, AS47583 (Hosting Moldova)
- 033C โ The Substrate โ Satanist operator, Mynymbox LLC, Njalla infrastructure
- 033D โ The Saint Kitts Connection โ offshore registration, Caribbean shell structure
- 033E โ The Operators โ em, maxzrbn, secretdrop.to, PGP warrant canary
- 033F โ The Payload โ 45.154.98.153 introduced; HiddenPhish SSL cert first observed; EGRUL probing documented; phishdestroy.io DDoS
- 033G โ The Stresser Layer โ DiamWall stresser empire, Hugo Carvalho, Internet Magnate ZA