Redpacketsecurity GoPhish Login Pages Detected on Multiple IPs
Article Content
- •GoPhish login pages detected on two IPs.
- •Potential phishing campaigns may be underway.
- •Users are advised to validate the detections independently.
On October 17, 2026, RedPacket Security reported the detection of GoPhish login pages on two different IP addresses: 35.195.127.110 and 64.177.65.0, both operating on port 3333. These detections suggest potential phishing campaigns utilizing the GoPhish framework, which is often employed for creating fake login pages to harvest credentials. The articles caution that the detections may not be accurate and could be false positives, urging users to conduct their own validation. No specific organizations or systems were identified as affected, and there are no confirmed reports of exploitation at this time. The current status of these detections remains uncertain as they may change over time.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Common questions
What is GoPhish?
Are these detections confirmed?
What should I do if I suspect a phishing attempt?
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to… 
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…