Case Study: Mapping a Phishing Network and Shutting It Down

I’m Joe. Cybercrime investigation is a different discipline from penetration testing: nothing is in scope, nobody signed a contract with you, and the only leverage you have is the quality of the evidence you hand to someone who can act. This is how one forwarded email turned into a mapped criminal cluster and a set of takedowns. Names, brands and identifiers are removed; the tradecraft is not.

1. It Starts With One Forwarded Email

   An employee forwarded a message that did not feel right — a payroll notice with a login link. That is the entire starting position for most of the investigations I run. The email itself is rarely interesting; what matters is everything attached to it. Full headers, the sending infrastructure, the link destination, the TLS certificate on that destination, and the registration record behind the domain. One report is a data point. The job is turning it into a map.

2. Pulling the Thread

   The link resolved to a host serving a near-perfect clone of the customer’s login page. From there the expansion is mechanical: certificate transparency logs give you every other name that host has ever presented, passive DNS gives you what else lived on that address, and the registration metadata — registrar, nameservers, creation timestamps, the exact hour of day domains were registered in batches — gives you the operator’s habits. Attackers automate, and automation leaves a fingerprint whether they intend it or not.

3. Clustering the Infrastructure

   By the end the cluster held 412 lookalike domains: typo variants, homoglyphs, hyphenated brand strings and lookalikes for several other companies the same operator was targeting. They shared one registrar, one hosting ASN, a small pool of nameservers and an identical page template with the same favicon hash. That last detail matters more than it sounds — a favicon hash and a template fingerprint let you find the next batch of domains before they are ever used against anyone.

4. Who Actually Gets the Report

   Different recipients can do different things, so the same evidence pack goes to several places at once. The registrar can suspend the domain. The hosting provider can pull the content. The mail provider can kill the sending accounts and poison reputation for the whole cluster. The national CERT can warn other targets in the same sector. And where there is clear criminal fraud with victims, the case is referred to law enforcement — for US-linked activity, the FBI’s Internet Crime Complaint Center. Blocking the domains in your own perimeter protects your users; reporting them protects everyone else’s.

5. What Actually Caused the Takedowns

   Not outrage, and not volume. What moved abuse desks was a report they could action without doing any research themselves: the exact domain, the exact URL, a timestamped screenshot, the raw headers, the hash of the phishing kit, a one-line statement of which brand is being impersonated and the fact that credentials are being collected. Reports that read like a complaint get queued. Reports that read like a finished case file get actioned, and the cluster started collapsing within days.

6. Building Detection That Survives the Next Campaign

   Takedowns are cleanup, not defence — the same operator registers a new batch the following week. So the deliverable was never the list of dead domains. It was a certificate-transparency watch on the brand strings and their homoglyphs, detection rules keyed to the template and favicon fingerprints, DMARC moved to enforcement so direct spoofing of the domain stops working, and a reporting button in the mail client that routes to a human who reads it. The next campaign was caught during registration, before a single employee saw it.

7. If You Only Do One Thing

   Set up certificate-transparency monitoring for your brand and its obvious misspellings today. It is free, it takes an afternoon, and it tells you that someone has stood up a lookalike site with a valid certificate — usually hours or days before the first email goes out. Every campaign I have investigated was visible in CT logs before it reached a single inbox. Almost nobody was watching.