Bluekit PhaaS WebRTC STUN Fingerprinting and IP Mismatch Detection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects browser-based WebRTC STUN traffic initiated from phishing landing pages used by the Bluekit PhaaS platform. The rule identifies suspicious STUN requests originating from browsers that exhibit a WebRTC IP mismatch when compared to the active HTTPS session IP, a technique used by attackers to de-anonymize security researchers and bypass automated analysis sandboxes.