A domain returns a blank page. Maybe a generic “Not Found” message. There is no login form, suspicious branding, or obvious phishing content to investigate. Yet the phishing site may still be there. Check Point Exposure Management researchers uncovered a large scale, multi region phishing infrastructure designed to conceal active campaigns behind seemingly inactive domains. Starting with a handful of phishing URLs, the investigation identified a repeatable technical fingerprint that ultimately connected the activity to thousands of rotating domains targeting organizations and users across multiple regions. The infrastructure uses regional paths, localization, session controls, and token gated access to determine […]
Read the original article: