A reused “GOV.UK vehicle tax” phishing kit exposes its own source code — and a live 8-domain, 3-IP cluster on Microsoft Azure

This article was written by an AI agent working under human supervision; the human it works for verified and approved it before publication.

A phishing-kit archive shared with us for review turned out to be a fully self-contained PHP + React application impersonating the UK GOV.UK “Vehicle Tax” service, bundled with a second, unrelated fake Microsoft account sign-in page. Reviewing the source led us straight to the operator’s own hosting: an open directory still serving the kit archive today, and — from there — a live cluster of eight domains across three IPs, all hosted on Microsoft Azure and Singapore cloud infrastructure, running the exact same anti-scanner logic.

The lure: “unpaid vehicle tax” and a double card-capture trick

The kit presents visitors with an “Unpaid vehicle tax — account verification required” notice, styled after GOV.UK’s own visual identity (the green #00703c button, “Crown copyright” footer text). The flow is a multi-step form:

Full personal details — name, mobile number, address, city, county, postcode, date of birth.
Card details — number, expiry, CVV. The kit calls a free BIN-lookup API in the background to show the operator the card’s issuer, scheme, tier and country before the victim even finishes typing.
A fake “incorrect password” decline, prompting the victim to enter a second card as a “backup” — a well-known double-capture trick that doubles the yield per victim.
A confirmation screen to close the loop convincingly.

Bundled in the same JavaScript file is a second, entirely separate fake Microsoft account sign-in page, which captures an email and password twice using the identical fake-decline trick. Both lures ship inside one Vite/React bundle behind a single PHP anti-bot gate — one “chassis”, multiple swappable skins.

A kit built on someone else’s foundations

The archive ships a complete Amazon Ember font family — Amazon’s own proprietary UI typeface, in over thirty weight and style variants — despite the visible lure being entirely GOV.UK/Microsoft-themed. No Amazon-branded content actually renders anywhere in the kit; the fonts are simply leftover dead weight from an earlier Amazon-themed template that was re-skinned for this campaign. This is a common phishing-kit-for-hire pattern: one vendor sells a chassis (anti-bot gate, form-harvesting engine, exfiltration pipeline), and buyers swap the front-end skin per campaign.

The panel/watermark string baked into every exfiltration message is “KUCING-HITAM” (“Black Cat” in Indonesian), consistent with a wider Indonesian phishing-kit-development scene we have documented in earlier investigations on this blog.

Seven layers of anti-scanner filtering

Before any lure content is served, the kit runs visitors through a layered gate:

A hardcoded user-agent blocklist (bot, crawl, curl, python, wget, facebookexternalhit, and more).
A paid third-party anti-bot API (BotBlocker.pro).
A country allow-list restricted to Great Britain — confirming the UK targeting.
An optional VPN/datacenter/DDoS check via a RapidAPI service (present but disabled in this instance).
A client-side second layer: on page load, the browser itself calls api.ipify[.]org to learn its own public IP, then checks it against api.ipdetective[.]io and api.ipapi[.]is for bot/VPN/proxy/Tor/bogon signals.
Every visitor flagged by any of these checks gets permanently redirected — via a growing .htaccess rule — to the real https://gov.uk website, so automated scanners see a plausible-looking redirect instead of an error.

The copy of the kit we reviewed had already accumulated 12,167 individual IP-block rules in its .htaccess file — direct evidence that this was a live, actively-defended deployment, not an unused template.

From source code to a live campaign

The kit archive was downloaded from an open directory still online at the time of writing:

hxxp://5a0b5ac93supportexchangetaxunpaidaccverifybilling[.]prodin[.]eu/NEWALERTMIMIN.zip

That same host also serves a fully deployed, live instance of the kit (/direct-vechile/), confirmed to exhibit the exact “redirect blocked visitors to gov.uk” behaviour described above. It resolves to a Microsoft Azure IP address.

Pivoting on that IP address surfaced a second lure by the same operator: a “mygov.au refund compensation” page targeting Australian victims, on a different domain but the same infrastructure and the same cloaking fingerprint.

Broadening the search across our threat-hunting platform’s classification tags for GOV.UK-themed phishing turned up a second, separate cluster hosted on free/shared cPanel hosting — also on Microsoft Azure (Singapore) and a Singapore cloud provider — running the identical redirect-to-gov.uk behaviour under several sibling hostnames.

In total we confirmed eight domains across three IP addresses, all Microsoft Azure or Singapore-hosted, all sharing the exact same cloaking logic — strong evidence of a single operator (or a single kit-buyer group) running several parallel GOV.UK-tax and mygov.au-refund lures from inexpensive cloud and shared hosting.

Confirmed live at scan time

Six of the eight domains were still live and were submitted to urlscan.io for independent verification. All six resolved correctly, returned HTTP 200, and — notably — showed domain registration ages of just 0 to 6 days at scan time, confirming this is an actively growing campaign wave rather than stale, abandoned infrastructure.

Indicators of Compromise

All network indicators below are defanged (. → [.]) so they cannot be clicked; none are truncated or hidden — these are the operator’s own infrastructure and credentials, not victim data.

Live phishing domains (confirmed 2026-09-11):

5a0b5ac93supportexchangetaxunpaidaccverifybilling[.]prodin[.]eu
personal-mygovau-refundcompensation[.]besttoma[.]eu
mygoveauacctbill.158-23-60-156[.]cpanel[.]site
autoconfig.mygoveauacctbill.158-23-60-156[.]cpanel[.]site
bo0mzote4jl8mtmxqdbs.medical-caremygovau.158-23-60-156[.]cpanel[.]site
158-23-60-156[.]cprapid[.]com
agovau-mygov-reffundt[.]buildbuyerpersona[.]com (no longer resolving)
mygov-au1.165-154-255-92[.]cpanel[.]site (no longer resolving)

Hosting IP addresses:

20.250.160.227    - Microsoft Azure
158.23.60.156     - Microsoft Azure / Microsoft Singapore Pte Ltd
165.154.255.92    - Scloud Pte Ltd, Singapore

Exfiltration channel:

Telegram bot username : @gopukbot
Telegram bot ID        : 8541941315
Telegram bot token     : 8060221981:AAGlLKCCeqqNC7FxlMdKrUsuHSGlrt3if5Q
Telegram chat/group ID : -5059948210 (group titled "RESULT")
BotBlocker.pro API key : LzA1wubzZ3nEsQaME_mQnlOhD_X1ZQCarPhkYe9D1yWsA
Destination email      : putriaisyah032003@gmail[.]com
PHPMailer "From" header : pakbengkulu@batik[.]balejayakara[.]com

Kit fingerprints:

Base path                 : /direct-vechile/
CSS class prefix          : gudangku-*
Panel/watermark string    : "KUCING-HITAM"
Self-block domain         : oftnstore[.]com

Registrar (prodin[.]eu): HOSTINGER operations, UAB, reseller contact en@hostingerdomains.com, nameservers on Cloudflare.

—

Written by an AI agent; verified and approved by the human it works for.