urlscan.io Blog

The urlscan Threat Research Team identified a suspicious IP address hosting a cluster of phishing sites predominantly targeting UK banks, including HSBC, Lloyds, Metro Bank, Barclays, and Revolut. Pivoting from this IP address using shared nameserver infrastructure revealed a much broader network, including two distinct administrative panels self-identified as FluxPanel and FastFlux, a historic nameserver pair still carrying the same targeting pattern, and an overlapping second cluster.

Analysis of the panels’ source code, combined with direct interaction with a live deployment, indicated the primary objective of this network is not traditional credential phishing. Instead, the pages appear designed to socially engineer victims, most likely already in a phone call with a threat actor, into downloading and installing remote access software. The administrative panels themselves reveal a centrally managed platform capable of mass updating deployed content, evading Google Safe Browsing flags, and signing malicious binaries, indicating a mature and scalable operation.

This brief documents the pivots used to expand this cluster, from nameserver infrastructure and phishing kit fingerprinting to a decoy landing page technique used to age domains and evade detection, and outlines how these indicators can be combined to track this network going forward.

Pivoting via Nameservers

During routine monitoring of malicious web activity on the urlscan platform, the urlscan Threat Research Team identified a suspicious IP address, 31.7.61.48, hosting a number of banking phishing sites predominantly targeting UK banks. Reviewing the hostnames dataset for this IP address shows a clear targeting pattern across the resolving domains.

Rather than continuing to pivot on the IP address itself, which threat actors can rotate easily, the shared nameservers used by these hostnames provide a more durable pivot. Searching for domains sharing the same nameserver pair as the original cluster, while excluding the known IP address, surfaced a wider set of domains following the same naming and targeting conventions.

One notable hostname within this set is actionfrauduk[.]com, a domain that impersonates Action Fraud, the UK’s national reporting center for fraud and cybercrime. This hostname was first seen in 2022, considerably earlier than the rest of the cluster, but was only observed using this nameserver pair from May 2026 onward. This suggests the domain may have been dormant, or used for an unrelated purpose, before being incorporated into this network. At the time of writing, the domain does not currently resolve. Impersonating a fraud-reporting body is a technique that can be particularly effective against victims who already suspect they have been scammed and are attempting to report it.

FluxPanel and FastFlux Admin Panels

Two websites hosted on the original IP address, admin17272828domainxcun[.]com and panel[.]nsnamedns[.]net https://urlscan.io/result/019e3bf8-d962-716d-97e5-ac43cdf86a1a were found to expose administrative interfaces bearing the names FluxPanel and FastFlux. These names appear directly on the panels themselves.

While the threat actor uses the phrase ‘Flux’ for its administrative tooling, the underlying infrastructure does not reflect a true Fast Flux hosting network in the classic sense. Genuine Fast Flux networks rely on rapidly rotating hundreds of proxy IP addresses with ultra-short Time To Live (TTL) values to conceal origin servers. Here, by contrast, the phishing hostnames remain tightly clustered across only a couple of shared IP addresses and rely on a single, shared nameserver. Source code recovered from both panels, examined in the following sections, does expose a ‘flux node’ concept that administrators can add, toggle, and remove, so the name is not purely a misnomer. However, this manually managed node list is a far cruder mechanism than the automated, low-TTL DNS rotation that defines genuine Fast Flux hosting.

Notably, the FastFlux interface itself is hosted at panel[.]nsnamedns[.]net - the exact same nameserver domain used by the wider set of phishing hostnames identified on the original IP address. This directly links the administrative panel to the centralized hosting infrastructure it manages.

Historic and Overlapping Nameserver Clusters

A historic nameserver pair, ns1[.]dnsupgrade[.]com and ns2[.]dnsupgrade[.]com was also identified. Only a small number of domains currently use this pair; however, they follow the same naming and targeting patterns observed elsewhere in this network, suggesting this pair represents an earlier iteration of the same operator’s infrastructure. This is further corroborated by a hardcoded reference to this exact nameserver pair found directly within the FluxPanel interface’s source code, described above, confirming it as first-party infrastructure rather than a coincidental overlap.

A second cluster, which overlaps with the network described above, was identified using the nameserver pair ns1[.]fastlookup[.]net and ns2[.]fastlookup[.]net.

The FastFlux administration page associated with this second cluster is not currently resolving. However, based on its naming convention, it is highly likely to have been hosted on admin27229rmnpan[.]com, a hostname consistent with the administrative panels identified elsewhere in this network.

FastFlux Panel: Multi-Tenant Infrastructure Management

Although the FastFlux panel was no longer accessible at the time of writing, its purpose could still be analyzed.

The code defines two separate sets of functionality, an admin application programming interface (API) and a tenant API, indicating a multi-tenant, control-panel-style architecture rather than a single-operator tool.

adminApi: {
  login, me, stats, logs, proxyLogs,
  tenants, suspendTenant, unsuspendTenant, deleteTenant,
  domains, suspendDomain, unsuspendDomain, deleteDomain,
  fluxNodes, addFluxNode, toggleFluxNode, deleteFluxNode,
  invites, createInvite, deleteInvite,
  audit, settings, updateSetting
}
tenantApi: {
  signup, login, me,
  listDomains, addDomain, verifyDomain, deleteDomain,
  listRecords, addRecord, updateRecord, deleteRecord,
  listOrigins, addOrigin, updateOrigin, deleteOrigin,
  domainStats, domainDnsLogs, domainProxyLogs, firewallSnippet
}

The admin API exposes global administrative functions, including suspending or deleting tenants and domains, managing so-called “flux nodes,” issuing sign-up invites, and reviewing an audit log. The tenant API allows an individual tenant to sign up using an invite code, then manage their own domains, Domain Name System (DNS) records, and origin servers, and review per-domain statistics and logs.

The presence of an invite-gated tenant sign-up flow suggests this infrastructure may be operated as a service made available to multiple operators, rather than being used exclusively by a single actor. This API structure appears oriented toward provisioning and monitoring hosting infrastructure, rather than directly managing phishing or scam page content, which instead appears to be the responsibility of FluxPanel, described below.

FluxPanel: Site, Binary, and Certificate Management

Where the FastFlux panel appears focused on generic infrastructure management, the FluxPanel interface reveals functionality tied much more directly to the phishing and scam content itself.

All actions on this interface are routed through a single API endpoint, api.php, gated behind a valid session token issued at login. The panel includes a function to re-link a domain to its origin server that explicitly checks whether the domain has been flagged by Google Safe Browsing, and still allows the operator to proceed if they confirm:

async function relinkDomain(id, name, isFlagged) {
  let force = false;
  if (isFlagged) {
    if (!confirm(`${name} is Safe Browsing FLAGGED.\nRe-link anyway? Chrome will show red warning.`)) {
      return;
    }
    force = true;
  } else if (!confirm(`Re-link ${name} to server (Apache + Caddy)?`)) {
    return;
  }
}

The panel also tracks a cloaked status alongside live and active states for each domain, a term that most likely refers to the decoy landing page technique described later in this report.

Most notably, a dedicated “buttons” page manages three per-domain buttons, labeled exe, msi, and livechat, along with a “support code” and references to locally hosted EXE, MSI, and DMG binary files. A helper function maps each button to a display label:

function modeLabel(m) {
  return {
    exe: "EXE — Verify Call",
    msi: "MSI/VBS — Stay Secure",
    livechat: "LiveChat — AnyDesk"
  }[m] || m;
}

This corresponds directly to the “Confirm call,” “Live chat,” and “Report problem” buttons observed on the phishing pages themselves, and explicitly names AnyDesk, a legitimate remote access tool, confirming that these buttons are used to deliver remote access software rather than to harvest credentials. The presence of DMG binaries alongside EXE and MSI files indicates that macOS victims are targeted alongside Windows users.

The interface additionally exposes a binary signing queue, with actions including scan_binary_files, upload_binary, signing_queue, sign_file, and retry_sign. The presence of a dedicated signing workflow suggests the operators may have access to a valid code-signing certificate for their binaries, which would reduce the likelihood of security warnings being shown to victims during installation.

Bulk actions such as buttons_mass_update_url and update_all_download_links confirm that the operator can update button destinations across every managed domain in a single action, indicating centralized control over a large number of live deployments simultaneously.

Finally, the interface contains a hardcoded reference to ns1[.]dnsupgrade[.]com and ns2[.]dnsupgrade[.]com within the empty-state messaging for its domain registration feature:

"...Once registered, NS will auto-route to ns1/ns2.dnsupgrade.com and the domain will be wired to your selected page automatically."

This directly confirms that the historic dnsupgrade[.]com nameserver pair identified later in this report is native, first-party infrastructure belonging to this operator, rather than a coincidental overlap.

Cloaked Landing Pages

Across this network, a default landing page was observed being deployed on newly provisioned hostnames before any phishing content is served. These cloaked pages correspond to the cloaked status tracked internally within the FluxPanel interface, described above, alongside live and active states used once a domain has been fully weaponized.

The same hostname was observed at two different points in time, first serving the cloaked page and then showing the live page once the threat actor updated the page status.

Primary Purpose: Remote Access Software Delivery via Fake Verification Codes

Analysis of the phishing kit’s client-side code indicates that the primary objective of these pages is most likely not to harvest banking credentials directly, but rather to convince victims, who are likely already in contact with a threat actor over the phone, to download and install remote access software.

Each weaponized page presents three buttons: “Confirm call”, “Live chat”, and “Report problem”. Selecting any of these opens a modal that asks the victim to enter a six-digit verification code, described as being provided by “your advisor”.

When a code is submitted, it is sent via a POST request to a verify-download.php endpoint on the same domain, along with a mode parameter identifying which button was used, exe for “Confirm call,” livechat for “Live chat,” or fraudreport for “Report problem”:

{
  "code":"345334",
  "mode":"exe"
}

Should the code validate successfully, the code indicates the endpoint returns a download URL, triggering an automatic download, and in some cases a ZIP archive password displayed directly to the victim, presumably to be relayed verbally by the “advisor” so the victim can open the protected file:

if (d && d.success && d.url) {
  err.textContent = "Download starting…";
  if (d.zip_password) {
    try {
      var pe = document.getElementById("vfE");
      if (pe) {
        pe.textContent = "ZIP password: " + d.zip_password;
        ...
      }
    } catch (e) {}
  }
 ...
} else {
  err.textContent = d && d.message ? d.message : "Invalid code. Please try again.";
}

This behavior confirms server-side validation, indicating a backend control panel or active process where the threat actor generates and verifies these codes—likely in real time during a call with the victim.

Submitting a code confirmed that the client posts it, along with the corresponding mode value, to verify-download.php exactly as inferred from the client-side code.

{
  "success":false,
  "message":"Code is invalid or has expired. Please request a fresh code from the agent."
}

This phishing kit also posts login data to /app/complete.php, a more conventional credential-phishing flow. However, this form immediately redirects the victim to the legitimate impersonated website afterward, without making any attempt to request multi-factor authentication codes or further account details. This behavior would be unusual if the form were the primary objective of the page, and instead suggests the credential form plays a secondary or supporting role, while remote access software delivery, gated behind the phone-verified download flow, is more likely to be the network’s primary objective.

Conclusion

This investigation began with a single suspicious IP address hosting UK banking phishing content and, through nameserver pivoting, expanded into a much broader network. This network is tied together by two self-identified administrative panels, FluxPanel and FastFlux, a historic nameserver pair still carrying the same targeting patterns, and an overlapping second cluster of infrastructure. Source code analysis of both panels points to a centrally managed platform: FastFlux appears to provide multi-tenant hosting and DNS infrastructure management, while FluxPanel directly manages deployed phishing and scam content, including mass content updates, domain re-linking around Safe Browsing flags, and a binary signing workflow that may involve a valid code-signing certificate.

Rather than functioning as a traditional credential phishing operation, the evidence gathered indicates the network’s primary objective is most likely to deliver remote access software to victims already engaged in a phone-based scam, using a phone-verified download flow gated behind a six-digit code. Alongside the infrastructure and behavioral pivots, the phishing kit itself and its associated decoy landing page each provide durable, hosting-agnostic fingerprints for tracking this network as it evolves. The urlscan Threat Research Team will continue to monitor this cluster for further domains, panels, and targeted brands.

More on urlscan Pro

If you want to learn about the urlscan Pro platform and how it might be valuable for your organization feel free to reach out to us! We offer free trials with no strings attached. We would be happy to give you a passionate demo of what our platform can do for you. Reach out to us at sales@urlscan.io.