Bluekit and the AI Impersonators: A Phishing Kit Hunt That Uncovered a Fraud Empire

TL;DR

• 5 Bluekit phishing kit domains RED
• 17+ AI brand impersonation domains (9 screenshot-verified, 8 infrastructure-confirmed) HIGH
• 1 credential harvesting domain (log-in-account.com, phishing since 2021) RED
• 5 generic AI/tool domains on shared infra (NOT impersonations) MEDIUM
• 38+ game domains by the same company AMBER
• 1 mobile app with 1M+ downloads and documented user fraud CONFIRMED
• 1 operator: AppStation Studio PTE. LTD, Singapore

This is not 18 impersonation domains. It is a mixed portfolio: some are clear brand impersonations, some are generic tools, some are game clones, and one is a credential harvesting domain. All drive traffic to mobile apps with documented fraud. This article corrects our earlier over-claims with screenshot evidence and documents the follow-up investigation that expanded the scope from 56 to 69+ domains.

Part 1: Hunting Bluekit

The Target

Varonis Threat Labs published research on Bluekit in April 2026, describing an AI-powered all-in-one phishing kit with 40+ phishing templates (Outlook, Gmail, iCloud, GitHub, Ledger, etc.), browser-in-the-middle (BitM) attack methodology using rrweb, AI Assistant with multiple model options, Telegram exfiltration, automated domain registration, and session hijacking.

The Hunt

We ran the phishing tracker pipeline against the Bluekit source articles, extracting 52 markers and generating 98 search queries. The pipeline returned 263 candidates. Of 263, 252 were false positives. But five domains stood out.

The Infrastructure

All are Cloudflare-fronted. The two-day gap between .cc (March 23) and .su (March 25) is the strongest evidence of a single operator registering domains in quick succession.

What We Did not Find

Despite extensive searching, we found zero victim-side phishing pages. The five domains are the kit's own landing/admin infrastructure.

MITRE ATT&CK Mapping

Part 2: The AI Impersonation Operation

The Accidental Discovery

During candidate triage, deepseek.net and chat-gpt.org surfaced on the same Hetzner IP (65.108.76.151, PTR: mail.chat-gpt.org). IP pivots revealed 9 domains on that IP, 3 on AlexHost MD, and 36+ game domains on a third Hetzner IP. By the end, we had 56 domains across four hosting providers.

A follow-up investigation — pivoting on the old AppStation server (176.123.6.10, host.gptserver.com), the AdSense publisher ID, and the credential harvesting domain log-in-account.com — revealed 13 additional domains, bringing the total to 69+. This approaches the "70+ web apps" claimed on the AppStation Studio website.

Screenshot Evidence

We downloaded 15 URLScan screenshots and analyzed each using a local vision LLM (Qwen3.6-MoE on llama.cpp). Here are the honest results:

Tier 1: Confirmed Brand Impersonations

HIGH screenshot verified

9 confirmed brand impersonations with screenshot evidence. CONFIRMED

Follow-up: 8 Additional AI Impersonation Domains

HIGH same infrastructure — confirmed via IP pivot on old server (176.123.6.10, host.gptserver.com)

Credential Harvesting: log-in-account.com

New AI Tool: gptimage.com

gptimage.com — GPT Image impersonation ("GPT Image - AI Image Generator Online"). Vite/React SPA, Google Analytics ID G-MBCNYWT2MG. Linked from drive.log-in-account.com. Same design language as other AppStation sites.

View screenshots — Tier 1 confirmed impersonations

deepseek.net

deep-seek.com

deep-seek.ai

chatgbt.org

chatgot.org

chat-gpt.org / chatai.org

removebg.net

humanize.org

drive.log-in-account.com

Tier 2: Generic Tools on Shared Infrastructure

MEDIUM NOT impersonations

5 domains that are NOT impersonations but are on shared infrastructure. NOT IMPS

View screenshots — Tier 2 generic tools

upscale.org

spinwheel.org

aigenerator.org

aidetector.ai

Tier 3: Operator Infrastructure

View screenshot — AppStation Studio operator site

appstation.studio

Tier 4: Credential Harvesting Infrastructure

The Game Empire

The third Hetzner IP (65.108.78.181) hosts 38+ game domains. These are NOT impersonations — they are game clones. But they are operated by the same company and drive traffic to the same mobile apps.

wordly.org · globle.org · flagle.org · georiddle.org · geoguesser.io · worldlegame.io · closeword.org · numberle.org · crazygames.org · flappybird.gg · flappybird.run · blockblast.game · watermelongame.com · retrobowl.org · mahjong.gg · image-generator.com · spellbee.org · infinite-craft.com · infinitecraft.net · connect.game · squares.org · combinations.org · phrazle.gg · wordwaffle.org · crosswordle.org · strands.game · dordlewordle.com · quordly.com · octordly.com · sedecordlegame.org · weavergame.org · wordsearch.io · unwordle.org · sudoku-online.com · 2048.gg · solitaire.online · snowrider.com · driftboss.org

38+ game domains linked from wordly.org's own page and discovered via IP pivots.

The Mobile App & Fraud

• App name: "AI Chat: AI Chatbot Assistant"
• Package: com.appstation.chatgpt
• iOS ID: id6468878395
• Downloads: 1,000,000+ · Reviews: 28,900 (4.5-star)
• Developer: APPSTATION STUDIO PTE. LTD, 68 Circular Road #02-01, Singapore 049422

The Fraud

David Orr (March 2023): "I just got scammed by this app! It asked me to enter my credit card number to 'verify' my identity... my bank's fraud division blocked the transaction — which was trying to charge me $39.99." (292 helpful)

Lyn P (February 2024): "My bank account has had successive amounts ($28 each time) deducted on several dates, all charged by ChatGPT. Had to close both my card + bank accounts." (92 helpful)

The Russian Connection

chat-gpt.org loads Yandex Metrica: mc.yandex.ru/watch/108435860

Infrastructure Summary

Historical Infrastructure Migration

The operation migrated from 176.123.6.10 (host.gptserver.com, nginx/1.20.2) to 176.125.242.237 (server.chatgpt.org, nginx/1.22.1) in April 2026. Both on AlexHost (Moldova).

Timeline

Honesty Correction

What We Got Wrong

1. Called all 18 domains "impersonations" — only 9 are confirmed. 5 are generic tools, 3 are operator, 1 is credential harvesting.
2. Claimed 18 domains — actually 69+ across 4 IPs (17 AI + 38 games + 5 operator + 9 adjacent/credential harvesting).
3. No screenshots — now 15 screenshots analyzed via local vision LLM.
4. Over-claimed on generic tools — spinwheel.org, aigenerator.org, aidetector.ai are NOT impersonations.
5. Missed the old server — follow-up investigation discovered the old AlexHost server (176.123.6.10) hosting 8+ additional AI impersonation domains.

What We Got Right

1. Operator identity — AppStation Studio PTE. LTD, Singapore.
2. Infrastructure pattern — 4 hosting providers.
3. Mobile app fraud — documented user reviews.
4. Russian analytics — Yandex Metrica ID 108435860.
5. Cross-linking — wordly.org links to com.appstation.wordly.

IOCs

Bluekit Phishing Kit

AI Impersonation — Confirmed (screenshot-verified)

Follow-up Discoveries (same infrastructure, confirmed via IP pivot)

Generic Tools (NOT impersonations)

Possibly Related

Recommendations

For Defenders

1. Block 17+ AI impersonation domains (including 8 follow-up discoveries) at DNS filter/firewall
2. Block 4 infrastructure IPs at network egress (65.108.76.151, 176.123.6.10, 176.125.242.237, 205.196.81.104)
3. Block Bluekit domains (bluekit.su, .cc, .pk, .ws, .la)
4. Block log-in-account.com and all subdomains — credential harvesting domain
5. Add Yandex Metrica ID 108435860 to proxy block list
6. Add AdSense pub ID ca-pub-1851068468056357 to proxy block list
7. Monitor mobile app (com.appstation.chatgpt) via MDM
8. Educate users about "free AI chat" websites

For Platform Trust Teams

1. Google Play / Apple: App has documented user fraud. Review in-app purchases.
2. Cloudflare: Bluekit domains use your infrastructure.
3. Hetzner: IPs 65.108.76.151 and 65.108.78.181 host 47+ domains.
4. AlexHost: IPs 176.123.6.10 and 176.125.242.237 host ChatGPT impersonation domains.

For Threat Hunters

1. Monitor URLScan for page.title:"bluekit - your phishing kit"
2. Monitor CT for new bluekit.* certs
3. Watch Yandex Metrica ID 108435860
4. Pivot on PTR mail.chat-gpt.org
5. Check passive DNS for pre-Cloudflare Bluekit IPs

Methodology

Tools Used

• Phishing Tracker Pipeline: Source ingestion, marker extraction, queries
• URLScan: Live queries, IP pivots, screenshot retrieval
• Certificate Transparency (crt.sh): TLS certificate history
• WebFetch: Direct page retrieval
• Local Vision LLM: Qwen3.6-MoE on llama.cpp for screenshot analysis
• Tesseract OCR: Cross-validation of screenshot content
• Intel Store: Observable registration, relationship mapping

What Worked

1. URLScan title queries — highest yield
2. IP pivoting — critical for full domain cluster
3. Certificate Transparency — launch timeline
4. Google Play listing — connected 69+ domains to named entity
5. Local vision LLM — screenshot analysis without external API
6. Historical IP pivoting — old server (176.123.6.10) revealed 8+ new domains
7. AdSense publisher ID — linked drive.log-in-account.com to AppStation

What Did not Work

1. kit_wording evidence type — 98% false positives
2. IP pivoting for Bluekit — all Cloudflare anycast
3. No rrweb/WebSocket fingerprints found
4. crt.sh unreliable — 502 errors on multiple domains

Acknowledgements

• Varonis Threat Labs — original Bluekit research
• URLScan.io — scanning infrastructure
• crt.sh — Certificate Transparency data
• Qwen3.6-MoE vision model on local llama.cpp server