Bluekit PhaaS WebRTC STUN Bot Detection — Endpoint UDP to Port 3478

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•8

Detects outbound UDP traffic over port 3478 (STUN) initiated by common web browsers. This pattern is commonly used by phishing-as-a-service (PaaS) platforms like Bluekit to perform WebRTC IP leak checks, potentially revealing a victim's real IP address behind a proxy or VPN. The rule excludes common communication platforms like Microsoft Teams, Zoom, and Webex to reduce false positives.