Baker Hughes-themed domain cluster observed — sharing IOCs for enrichment / hunting
Observed a coordinated cluster of Baker Hughes / Baker Hughes Energy-themed domains via Cloudflare Brand Protection around 2026-07-01 ~06:5x UTC.
I do not work for, represent, or have any affiliation with Baker Hughes. Sharing for blue-team monitoring, enrichment, and possible phishing/procurement-fraud detection.
Posting here because the cluster may be useful for DNS/mail/proxy monitoring. I’m not claiming confirmed phishing, compromise, or attribution. Looking for corroboration/enrichment from anyone with passive DNS/TLS/mail telemetry.
Signal:
- 43 Cloudflare Brand Protection alerts observed
- Some duplicate alerting/feed normalization observed
- Unique IOCs listed below
- No confirmed phishing content observed yet
- No confirmed attribution
- Some entries may be subdomains under existing parent domains rather than independently registered domains
Brand tokens observed:
- bakerhughes
- baker-hughes
- bakerhughesenergy
- baker-hughes-energy
- bakerhughesenergyservices
- baker-hughes-energy-services
Notable namespace patterns:
- mil[.]ph
- mil[.]tm
- gov[.]mu
- df.gov[.]br
- ngo[.]za
- nom[.]za
- edu[.]ee
- lib[.]ee
- int[.]la
- ws variants
- Cloudflare workers[.]dev infrastructure
Assessment:
Pattern appears consistent with bulk-generated brand impersonation infrastructure. Possible use cases include phishing, vendor/customer targeting, procurement fraud, credential capture, or document-delivery lures.
The gov/mil/edu/ngo-style namespace selection may indicate government, defense, energy, or procurement-themed pretexts. Attribution is not confirmed.
Defensive value:
- domain watchlists
- mail gateway blocks
- web proxy/DNS blocks
- passive DNS/TLS enrichment
- procurement/AP/vendor-fraud awareness
- Baker Hughes-themed lure hunting
Open questions:
- Is anyone else seeing MX, TLS, passive DNS, or hosting activity for this cluster?
- Any observed Baker Hughes-themed emails, fake procurement portals, RFQ lures, document-delivery pages, or credential capture?
- Any overlap with known energy-sector or government/defense procurement campaigns?
IOCs:
bakerhughes.chantysothy[.]kh
bakerhughes.lib[.]ee
bakerhughes.mil[.]ph
baker-hughes.mil[.]tm
baker-hughes.df.gov[.]br
baker-hughes.ngo[.]za
baker-hughes.chantysothy[.]kh
baker-hughes-energy.aquila[.]it
baker-hughes-energy.gov[.]mu
baker-hughes.org[.]ws
baker-hughes.edu[.]ws
baker-hughes.net[.]ws
baker-hughes-energy.ngo[.]za
baker-hughes-energy.edu[.]ee
baker-hughes-energy.net[.]ws
baker-hughes-energy-services.nom[.]za
baker-hughes-energy-services.lib[.]ee
baker-hughes-energy-services.df.gov[.]br
baker-hughes-energy.chantysothy[.]kh
baker-hughes-energy-services.int[.]la
baker-hughes-energy.mil[.]tm
baker-hughes-energy.edu[.]ws
baker-hughes-energy-services.gov[.]mu
baker-hughes-energy.int[.]la
baker-hughes-energy-services.com[.]ws
baker-hughes-energy-services.chantysothy[.]kh
baker-hughes-energy-services.edu[.]ws
bakerhughesenergy.ngo[.]za
baker-hughes-energy.nom[.]za
bakerhughesenergy.chantysothy[.]kh
baker-hughes.nom[.]za
bakerhughesenergyservices.aquila[.]it
bakerhughesenergy.df.gov[.]br
bakerhughesenergyservices.edu[.]ee
bakerhughesenergyservices.df.gov[.]br
bakerhughesenergy.edu[.]ee
bakerhughesenergyservices.net[.]ws
bakerhughesenergy.lib[.]ee
bakerhughesenergyservices.int[.]la
bakerhughesenergyservices.chantysothy[.]kh
bakerhughesenergyservices.gov[.]mu
bakerhughesenergy.org[.]ee
Update:
baker-hughes-energy-services.org[.]ph
baker-hughes-energy[.]ph