Bluekit PhaaS WebRTC STUN fingerprinting before HTTPS connection to suspicious domain

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects a specific behavioral pattern associated with Bluekit Phishing-as-a-Service (PhaaS) involving WebRTC IP address leak fingerprinting. The rule identifies UDP STUN traffic (port 3478) originating from common web browsers followed within 30 seconds by an HTTPS connection to non-reputable domains, indicating a potential client-side phishing reconnaissance or identification attempt.