499-Domain EU PhaaS Cluster — ING · DKB · Belfius Belgium · CJIB · plesk2.living-bots.net

Entry domain spotify-accounts-login.callora.cz resolved to 91.218.65.223. A HackerTarget reverse-IP lookup on that address returned 499 co-hosted domains, all served from the same Plesk node plesk2.living-bots.net. The domain list contains systematic brand-impersonation naming targeting at least 12 financial institutions and services across six EU countries.

The reverse-IP domain list contains two categories: brand-impersonation domains (e.g. accont-banking-belfuise-be.91-218-65-223.plesk.page) and a second set with Docker container naming convention adjective-scientist names: admiring-bohr, condescending-euler, dazzling-mahavira, adoring-merkle, etc. These are Plesk-generated subdomains that correspond to running Docker containers on the phishing server. The naming convention is the Docker Engine default random name generator — this confirms the operator is deploying new phishing kits as Docker containers and Plesk auto-creates a subdomain for each.

The co-existence of named containers as Plesk subdomains alongside brand-specific phishing domains on the same IP indicates a shared-infrastructure PhaaS model: the operator sells or rents kit instances per brand, each running in its own Docker container with a Plesk-provisioned subdomain.

The phishing server is reached not only via the wildcard *.91-218-65-223.plesk.page Plesk addresses but also through four externally registered domains, all with Websupport.sk nameservers and A records pointing to 91.218.65.223. This layer provides legitimacy — a branded domain looks less suspicious than a Plesk IP wildcard. The operator either compromised Websupport.sk-hosted accounts or created them specifically for this operation.

spotify-accounts-login.callora.cz served a French-language Spotify login credential phish (HTTP 200, 5200 bytes) during this investigation. The page replicated the Spotify login UI and posted credentials via process.php (302 redirect after submission). Server identity: nginx + PleskLin (x-powered-by: PleskLin), last-modified: 2026-06-24. The page was live for at least 7 weeks.

The phishing server sits in AS44486, operated by Oliver Horscht trading as SYNLINQ, registered address Hanauer Landstrasse 328-330, 60314 Frankfurt, Germany. The abuse contact for AS44486 in RIPE is abuse@living-bots.net, operated by the same entity. This is commercial shared Plesk hosting, not a purpose-built bulletproof provider — but 499 phishing domains on one node indicates either chronic abuse report failure or insufficient abuse processing.

MITRE ATT&CK mapping: T1583.001 (Acquire Domains — mass registration of phishing variants), T1583.003 (Virtual Private Server — Plesk commercial hosting), T1036.005 (Match Legitimate Name or Location — brand typosquatting), T1056.003 (Web Portal Capture — credential form exfil), T1071.001 (Web Protocols — HTTP/S C2), T1078.004 (Valid Accounts: Cloud Accounts — Websupport.sk account compromise for DNS pivot).