Bluekit PhaaS WebRTC STUN Probe for Researcher IP Mismatch Detection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•2

Detects instances of Bluekit Phishing-as-a-Service (PaaS) where the browser utilizes WebRTC RTCPeerConnection to initiate a UDP STUN request on port 3478 while concurrently accessing a suspicious web page. This behavior is used by attackers to discover the visitor's real IP address, effectively bypassing proxies or VPNs to identify security researchers or analysts.