GoPhish Infrastructure Targets Polish Energy and Government

This report documents the discovery of a GoPhish-based phishing infrastructure (hosted at 40.67.208.154) using domains that spoof Polish energy regulators and a renewable energy firm, plus additional brand lookalikes; investigators observed exposed GoPhish admin interfaces, short-lived Let's Encrypt certificates, and ~19 domains tied to the server, provided IOCs and recommended defensive monitoring for suspicious registrations, certificate transparency, and passive DNS to detect future reuse.