Following the refund: how fake South African government sites led to a global phishing kit

Pivot One: The Naming Convention

Let's search our first two leads on VirusTotal:

• justice-gov-za.weebly[.]com
• ncpg-gov-za.weebly[.]com

Both sites point to the same two IP addresses (74.115.51[.]8 and 74.115.51[.]9), which belong to Weebly's shared hosting infrastructure (AS27647). They also sit behind the same wildcard SSL certificate covering *.weebly.com that is shared across every free Weebly site. None of that is pivotable though. Thousands of legitimate Weebly sites share those IPs and that certificate.

The naming convention itself however, turned out to be the one usable fingerprint.

VirusTotal Intelligence: entity:domain and domain:*-gov-za.weebly.com

This pivot added one sibling: 4373-kznhealth-gov-za.weebly[.]com, impersonating KwaZulu-Natal's Department of Health.

As a next step, I dropped .weebly.com from the query entirely to see whether the same naming pattern showed up on other providers. A custom domain would open up new pivoting opportunities that Weebly's shared hosting couldn't offer.

VirusTotal Intelligence: entity:domain and domain:*gov-za*

This returned a much larger and noisier set. I checked each result to see whether the domain served an impersonation page. The Indicators of Compromise table at the bottom lists each domain with the organization it impersonates and the hosting provider. Where the page didn't name the organization it impersonates, the table lists it as unknown.

Pivot Two: Ghosty Networks Hosting

domain:*gov-za* query on URL and website scanner - urlscan.io^[2] returned 1,302 historical scans against this naming pattern. Here’s the Urlscan report for one specific SARS lure.

The SARS Example

Examining this result showed the page is titled "Tax Return Status Dashboard - SARS". The page loads an antibot.js script, then a Cloudflare Turnstile challenge before serving content. This antibot + turnstile gate is standard in commercial kits. It hides the lure from scanners and researchers.

The Dead End: Page Title

Next, I tried the page title itself as a pivot.^[3] Only one domain came back as a result.

Urlscan: page.title:"Tax Return Status Dashboard - SARS"

The Shared IP Address

Coming up empty on the title put me back on the SARS lure's (sars-gov-za.vetactivity[.]ro) own infrastructure. The domain resolves to 46.151.182[.]230 which belongs to Ghosty Networks LLC (AS205759). Intrinsec classifies Ghosty Networks as a bulletproof network, citing its use in March 2026 malspam campaigns and its likely links to Optibounce and AnonRDP.^[4] That's worth pivoting on. So I ran page.ip:46.151.182.230 on Urlscan.^[5] It came back with 372 historical scans.

This query turned up six instances of a Polish tax-authority lure all titled "e-Urząd Skarbowy - Twoje dane podatkowe" and run through the identical captcha.html/antibot flow as the SARS page.

• etax.vetactivity[.]ro
• etaxpanel.vetactivity[.]ro
• etax.clinicaactmedica[.]ro
• etaxpanel.clinicaactmedica[.]ro
• etax.onestaprod[.]ro
• etex-poland.energy-report[.]ro

Note: Because Cloudflare ties each Turnstile sitekey to a single account, the same sitekey showing up across multiple domains is a strong signal they belong to the same operator, even when the sitekey itself can't be used as a search pivot.

To tell which domains the attacker owns outright versus which they've compromised, compare passive DNS history at the apex against the subdomain. A compromised domain shows years of stable apex history that only diverges recently, while the apex keeps resolving elsewhere. An attacker-owned domain has no such split. The Ownership column in the Indicators of Compromise table applies this test to every domain.

Pivoting this IP directly shows dedicated infrastructure that hosted numerous phishing kit deployments. SARS is a South African entry in a cluster that already covers multiple countries' tax authorities, banks and registrars.

What This Means for Defenders

Two Weebly URLs in the UniqueSignal feed turned into a number of government lures. One of those lures led to something bigger. One IP hosting the same kit under multiple countries' brands.

The following detection actions are advised:

• Block 46.151.182[.]230 and watch AS205759 for new hosting of the kit.
• Hunt for the captcha.html path with the antibot.js hash in urlscan and in proxy logs that record file hashes. The SARS and Polish tax lures share this flow.
• Monitor new *-gov-za domains, including *.weebly.com and *.pages.dev subdomains. On shared platforms the name is the only selective fingerprint.

MITRE ATT&CK Mapping

Indicators of Compromise

First seen is the date of the earliest VirusTotal passive DNS record for the domain. It shows when VirusTotal first saw the domain resolve, so the lure may have been live earlier.