Tracing HuntPanel: a 2023 origin, a rebrand and a tenant fleet

Part one analysed what this kit does to a visitor and how far its tenants spread. This post reconstructs where the kit comes from, who it is sold to, and how long the codebase has been in service.

Part one: inside the kit·16 min readHuntPanel: a rented phishing kit with an operator on the socketTechnical analysis of a live General Motors careers phishing deployment and the kit behind it: cloned brand pages, a collection form, a fake identity provider, and a Socket.IO console that lets an operator steer the victim. 245 captures across 108 registrable domains, with detection opportunities and indicators.

Introduction

The client kit carries no name of its own. The console does. Every tenant reports to a panel whose login page is titled HuntPanel Ver 2.0, and the panel is the half of the operation that changes slowly: the client files are edited per campaign, while the console accumulates version numbers over years.

That asymmetry is what makes an origin trace possible at all. The material in this post comes from the panel’s own build, from the urlscan capture index, and from one public analysis published in September 2023.

Key findings

• The panel ships a help screen written for customers: Telegram tutorials, an nginx deployment guide, an article about buying ad traffic, and advice on tagging a traffic source.
• Its build constant, viteHPVer, runs 1.67.2 in October 2024, 1.68 in November 2024 and 1.82 in July 2026. The login card of the 1.82 build reads Hunting panel 1.82.
• The same architecture, the same configuration variable names and the same panel services appear in a phishing operation Phish Report documented in September 2023 under the codename RedLungfish, then at panel version 1.13.
• urlscan holds that earlier generation: 1,452 captures on 149 hosts and 119 registrable domains between March 2023 and June 2024, aimed at fintech brands.
• The rebrand is visible in the file names. The 2023 kit served /rl-script/ and /rl-style/; from October 2024 the same product serves /hp-scripts/ and /hp-styles/ and titles its console HuntPanel Ver 2.0.
• 42 panel sightings on 23 distinct hostnames, from July 2023 to July 2026, carry tenant-style names.
• Registry records put two panel domains in one Cloudflare account, and one hostname in the fleet now resolves through expired nameservers.

What the panel says about itself

The console is a React single-page application, served with a two-line configuration file that every deployment edits:

1
window.globalConfig = {
2
    REACT_APP_BACKURL: `https://api.hp-live-palladium.live`,
3
    REACT_APP_BACKURL_SOCKET: `https://api.hp-live-palladium.live`,
4
};

Behind the login it carries screens for projects, domains, files, bank-sessions, card-sessions and profile, and it authenticates with a bearer token stored in local storage. Two of the operator’s own routes are worth naming: bank-sessions and card-sessions are where a tenant reads what its campaigns collected.

The marketing is inside the build. The 2024 versions of the bundle contain a help screen addressed to whoever bought the kit:

Some tutorials https://t.me/rl_webdev
It's better to place landing in folders like www.example.com/account/login
How to run your ads companies advice: https://telegra.ph/How-to-run-your-ads-companies-02-09
You can specify source of traffic by adding request param in link (yourdomain.com?source=adscompany1)
   or in config file of landing

That last line explains a field in the client kit. source= is how a buyer tags traffic, and the project value in the client configuration, FacebookGeneralMotors2 or GoogleSpotify, is that tag promoted into a campaign name. The rest of the text is a product manual: a Telegram handle for tutorials, a Russian nginx guide for deployment, and a Telegra.ph article about running ad campaigns. All four lines, the Telegram handle, the nginx guide, the article and the traffic-tag advice, are present in the October and November 2024 builds and absent from the 1.82 build of July 2026.

Version history

The panel reports its own version through a build constant, and the captures show the ladder:

The build grew from 1.30 MB to 1.88 MB between those two generations, and the constant travelled from 1.67.2 to 1.82 across twenty-one months. A tenant cannot change that number, because it is compiled into the bundle.

The earlier generation

Phish Report published their analysis of RedLungfish on September 13th, 2023, describing a group targeting fintech customers: Clover, Wise, Barclaycard, E-Trade and Robinhood. Their description and the kit in part one agree field by field:

• pages cloned from the legitimate login with Save Page WE, which is the savepage-version marker the client pages still carry
• extra forms for a card PIN or an SMS code, shown and hidden by stage, which is the sms-page and wh-page journey
• a configuration file with the variables backUrl, apiKey, apiUrl, project and banLink
• the same api.ipdata.co geolocation call, paid for with the operator’s own key
• a React single-page console with services for auth, news, projects, sessions, socket and users, behind a username and password, at version 1.13
• panel domains hunting-panel.cc and hunting-panel.click, and a detection rule that matches the page title Hunting panel

The codename comes from the file prefix. In 2023 the kit served /rl-script/rl-script.js, /rl-script/config.js and /rl-style/rl-style.css, which is where the analyst’s rl came from. The vendor’s own Telegram handle is rl_webdev, so the codename and the handle share the same two letters, and the product later renamed the prefix to hp while keeping the handle.

Continuity in the capture index

The earlier generation is still searchable, and its numbers bracket the rebrand:

The earlier set is aimed at fintech: Converge 72 captures, Chase 69, Robinhood 9, Fidelity 8. One of the domains Phish Report listed as an indicator, accessmyiq-login.com, appears inside it, which ties the analyst’s sample to the same infrastructure. The last capture of the rl- generation is June 25th, 2024 and the first of the hp- generation is October 2nd, 2024, so the rename happened in that three-month window.

The tenant fleet

The panel’s own favicon is the cleanest way to enumerate its instances, because the operator’s build never changes it while each tenant changes its domain. That hash returns 42 sightings on 23 distinct hostnames:

hunting-panel.cc          hunting-panel-1.online     huntingpanelprod3.online
hptest.online             refcard-hplive.online      refund-hplive.lat
james-hp-live.xyz         achteam-hplive.shop        mike-and-nick-hplive.store
guy-int-mean.baby         huntpanel-gold-vps.store   hp-live-platinum.info
hp-live-gold.live         ironhuntlivepanel.life     platinumhuntingpanel.life
hp-gold-vps.homes         hp-live-ruby.live          hp-live-palladium.live

The names read like instances bought by different people: personal and team names, a test host, a third prod host, a pair of card-themed hosts, and one domain that mixes a metal with a hosting label. Phish Report concluded in 2023 that the sites were probably run by one group, because nothing in their sample separated them. The panel’s own features point the other way now: users with admin and worker roles, projects assigned per user, and a news feed for staff are what a product sold to several operators looks like.

Infrastructure

Registry records add two details that the captures cannot show. The domains are registered across two registrars, and the fleet shares nameservers:

hp-gold-vps.homes and hp-live-silver.live are on the same Cloudflare nameserver pair, so both sit in one account, and the registrations run in a rhythm of a new panel domain every few months. ironhuntlivepanel.life now resolves through expired-ns1.niceisp.com, which is what a burnt panel domain looks like once its registrar stops answering. Certificate transparency adds the shape of each deployment: an api. hostname is always issued next to the apex.

What the evidence establishes

The record supports the product, its vendor’s public contact handle, its version ladder over three years, the tenant-style naming of its panels and a move from fintech phishing in 2023 to recruitment and retail banking in 2025. It does not identify the people behind it, and the codename in use here is the one a third party gave the operation in 2023, not a name the operators use.

Two limits are worth stating. The fleet is 42 sightings rather than a census, because the panel’s domains are only visible when something references them from a scanned page or a researcher submits them. And the capture record is scanner-driven, so the gap between June and October 2024 in the table above is a gap in coverage as much as it is a release schedule.

Detection opportunities

The indicators worth writing down are the ones a tenant cannot change by registering a new domain:

• Requests for /rl-script/config.js, /rl-script/rl-script.js or /rl-style/rl-style.css in the earlier generation, and /hp-scripts/, /hp-script/, /hp-custom-script/ and /hp-styles/ in the current one.
• A console whose page title is HuntPanel Ver 2.0 or Hunting panel, and whose login card names a version such as Hunting panel 1.82.
• A bundle carrying the viteHPVer constant, and a configuration file exposing REACT_APP_BACKURL and REACT_APP_BACKURL_SOCKET.
• A socket connection to a hostname matching hp-live-<metal>, <name>-hplive, huntingpanel* or huntpanel-*, on path /fake.
• The client configuration keys project, projectType and banLink, which appear in the kit’s files under both prefixes.
• Panel favicon sha256 48ac2b78..., which is shared by every tenant panel and by none of the phishing sites.

No domain appears in that list on purpose. This operation registers a new panel domain every few months, retires the old one, and rotates socket backends on the same schedule, so a hostname is a perishable indicator. What survives a redeployment is the code the kit serves, the version string its console prints, and the artwork the operator reuses.