Date: 10/16/2026
Severity: High
Summary
Researchers identified and mapped the infrastructure behind a phishing-kit-as-a-service (PhaaS) operation marketed as “Iron Man System.” The kit is sold to cybercriminals as a self-hosted package that creates fake websites impersonating postal services, banks, tax agencies, telecom providers, and other organizations to steal victims’ information. Researchers obtained a license to investigate its backend infrastructure, source-code repository, build pipeline, and operator identities. The HUNTER team also infiltrated communities managed by Chinese threat actors to gather further intelligence on the operators and their associates. The investigation uncovered 2,360 phishing templates impersonating organizations across 130 countries, including banks, retailers, healthcare providers, police departments, and government agencies.
Indicators of Compromise (IOC) List
Domains/URLs | api2.peaceman.cc ipapi2.peaceman.cc bin2.peaceman.cc log2.peaceloving.xyz ossapi.haoeryu.top docker.aidchildren.cc docker.loveboy.xyz install.loveboy.xyz api2.haoyutai.cc |
IP Address | 104.26.8.8 172.67.149.149 194.233.80.219 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "log2.peaceloving.xyz" or url like "log2.peaceloving.xyz" or siteurl like "log2.peaceloving.xyz" or domainname like "install.loveboy.xyz" or url like "install.loveboy.xyz" or siteurl like "install.loveboy.xyz" or domainname like "docker.aidchildren.cc" or url like "docker.aidchildren.cc" or siteurl like "docker.aidchildren.cc" or domainname like "docker.loveboy.xyz" or url like "docker.loveboy.xyz" or siteurl like "docker.loveboy.xyz" or domainname like "ipapi2.peaceman.cc" or url like "ipapi2.peaceman.cc" or siteurl like "ipapi2.peaceman.cc" or domainname like "api2.peaceman.cc" or url like "api2.peaceman.cc" or siteurl like "api2.peaceman.cc" or domainname like "bin2.peaceman.cc" or url like "bin2.peaceman.cc" or siteurl like "bin2.peaceman.cc" or domainname like "ossapi.haoeryu.top" or url like "ossapi.haoeryu.top" or siteurl like "ossapi.haoeryu.top" or domainname like "api2.haoyutai.cc" or url like "api2.haoyutai.cc" or siteurl like "api2.haoyutai.cc" |
Detection Query 2 : | dstipaddress IN ("172.67.149.149","194.233.80.219","104.26.8.8") or srcipaddress IN ("172.67.149.149","194.233.80.219","104.26.8.8") |
Reference:
Iron Man Phishing Network