# Formula 1 Phishing Campaign & Kit Analysis: Real-Time BIN-Routed Ticketing Fraud Kit Targets Middle East Banking Customers (SOCRadar STRU)

> SOCRadar's Threat Research Unit exposed a phishing-as-a-service kit that clones a 134-page Formula 1 ticketing site, uses card-BIN routing to serve bank-specific fake OTP/push/balance-check screens for eight Middle East banks, and relays captured data in real time to a live-operator C2 backend across an 11-domain Cloudflare-hosted cluster.

- **Published:** 2026-08-08T00:00:00Z
- **Last reviewed:** 2026-08-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1944
- **ID:** TL-2026-1944
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SOCRadar's Threat Research Unit (STRU) published a technical breakdown of a phishing kit and campaign that exploits fan demand around Formula 1 Grand Prix events to harvest payment-card data, personal information, and one-time authentication codes. Rather than a generic credential-phishing page, the kit is a high-fidelity, 134-page replica of a legitimate F1 ticketing platform (news, event, entertainment, and hospitality sections included), backed by roughly 40 PHP files split between checkout plumbing and a dedicated fraud-verification module.

The checkout flow walks victims through ticket selection, patron-information capture, and card entry, then pivots to a bank-specific authentication-bypass stage. A BIN-routing component reads the first six digits of the captured card number to identify the issuing bank and serves one of eight pre-built, bank-branded verification screens (Emirates NBD, RAKBANK, HSBC, Abu Dhabi Commercial Bank, Dubai Islamic Bank, Emirates Islamic, First Abu Dhabi Bank, Mashreq). These screens rotate through OTP entry, account-balance verification, push-notification approval, and identification-code pretexts — all designed to walk a real-time human operator through defeating the victim's actual bank MFA at the moment of the (attempted) real transaction, rather than merely harvesting a static password.

The backend polls a command-and-control host at 144.31.3[.]209 over plain HTTP (port 80, `/api/record` endpoint), using flow-control query parameters (`?g=`, `?b=`, `?p=`, `?i=`) on a `secure_check/index.php` handler and a per-victim session cookie so an operator can watch incoming submissions and choose the next screen to serve. A Python utility at `booking/main.py`, containing Russian-language code comments, is used to clone and localize the legitimate site's assets; the kit also embeds a call to Yandex Metrika (`mc.yandex.ru/metrika/tag.js`), a Russian web-analytics platform, on its pages. Neither artifact is a confirmed attribution, but together they are suggestive of Russian-speaking kit developers/operators.

Infrastructure consists of a primary lure domain, f1-tickets-sg[.]com (Singapore-dollar-denominated hospitality pricing, suggesting an APAC-facing lure variant), plus an 11-domain cluster of Spain/Madrid-region-themed lookalikes (`f1-ticket-es[.]com`, `f1-ticket-spain[.]com`, `ticket-f1-es[.]com`, `tickets-f1-es[.]com`, `tickets-f1-spain[.]com`, `booking-f1-spain[.]com`, `f1-tickets-spain[.]com`, `f1-tickets-es[.]com`, `f1-booking-spain[.]com`, `f1-booking-es[.]com`, `ticketsf1-madrid[.]com`), all hosted behind Cloudflare (CLOUDFLARENET ASN) with first-seen registration dates spanning May 20 to July 8, 2026 — roughly two and a half months of active infrastructure expansion. SOCRadar assesses the naming convention (`f1-[ticket|booking]-[region|city]`) as a reliable indicator for hunting future expansion of the same cluster.

Victimology centers on prospective buyers of premium F1 hospitality and grandstand packages — a demographic primed to act quickly during high-intensity ticket-release windows and, per the targeted bank list, concentrated among customers of major UAE/Middle East financial institutions. SOCRadar characterizes the operation as phishing-as-a-service with an actively human-operated fraud layer rather than a fully automated kit, and recommends blocking the identified C2 IP and domain cluster, hunting for the naming pattern, and moving financial-institution fraud controls toward behavior-based detection of balance-check/push-approval requests from non-partnered merchant domains rather than static blacklisting alone.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1608.006 SEO Poisoning
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1056.003 Input Capture: Web Portal Capture
- T1621 Multi-Factor Authentication Request Generation
- T1071.001 Application Layer Protocol: Web Protocols
- T1036.005 Match Legitimate Resource Name or Location

## Sources

- [Formula 1 Phishing Campaign & Kit Analysis](https://socradar.io/blog/formula-1-phishing-campaign/)
- [Threat Actors Attacking Fans and Teams of Belgian Grand Prix With Phishing Campaigns](https://cybersecuritynews.com/threat-actors-attacking-fans-of-belgian-grand-prix/)
- [Phishing Attacks Hit Fans and Teams of the Belgian Grand Prix](https://cyberpress.org/phishing-attacks-hit-fans-and-teams/)
- [Fake Streams, Counterfeit Merch & Scams: How Fraudsters Target F1 Fans](https://www.infosecurity-magazine.com/news/how-fraudsters-target-f1-fans/)
- [Formula 1 fans targeted by evolving scams, Bitdefender warns](https://www.scworld.com/brief/formula-1-fans-targeted-by-evolving-scams-bitdefender-warns)
- [Grand Prix website hacked to send out phishing emails to F1 fans](https://www.techradar.com/pro/security/grand-prix-website-hacked-to-send-out-phishing-emails-to-f1-fans)
- [7 Formula 1 Scams That Are Catching Out Fans Right Now](https://f1chronicle.com/7-formula-1-scams-that-are-catching-out-fans-right-now/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1944