/
← Voltar ao feed
medium banking financial services government transportation postal services retail

Check Point uncovers multi-region phishing infrastructure hiding live campaigns behind blank 404 pages across thousands of rotating domains

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 10:00 · coletado há 1 dia

Check Point Exposure Management researchers uncovered a large, multi-region phishing infrastructure that conceals active campaigns behind domains that look inactive. Root domains return blank or generic "Not Found" pages, while the phishing content is served only through concealed regional paths (for example /it, /de, /pa) and under specific conditions. One September collection window tied 10,187 domains to the cluster, 90% of them in the highest malicious category. A later snapshot held 5,785 domains, which shows heavy infrastructure churn. Campaigns target banking, government services, transportation, postal services and rewards programs in Southeast Asia, Europe, Latin America, Israel, Australia, Africa and Asia. The researchers could not attribute the activity to a specific phishing kit, provider, operator or threat group. The evidence supports only the finding of a shared phishing toolkit.

Technical Details

  • Researchers fingerprinted the infrastructure using an uncommon combination of GoFrame HTTP Server and Caddy, plus response behavior and recurring application behavior. This narrowed about 19,000 initial results to 322 candidate IP addresses.
  • Phishing content sits in regional directories, so the full URL is needed to see it. Lure URLs are likely distributed via SMS, email, WhatsApp and other private channels.
  • A case study of a rewards-themed domain targeting a Central American financial group showed the /pa path triggering a custom verification screen. The screen generated a session token before redirecting the visitor to the phishing workflow.
  • The platform supports many languages (English, Spanish, French, German, Portuguese, Arabic, Hebrew, Japanese, Korean, Hindi, Russian, Chinese).
  • Analysis of 500 domains showed shared APIs, configuration schemas, localization frameworks and session controls across campaigns with different brands, languages, currencies and reward catalogs. This points to a modular, reusable toolkit.
  • Domain and IP associations changed significantly between collection windows, so individual domains have limited long-term indicator value.

Remediation

  • Hunt on behavior rather than individual domains. Useful signals are concealed regional delivery, tokenized access, randomized API paths, reusable configuration schemas, localization frameworks and session-controlled workflows.
  • Treat a generic 404 or "Not Found" response with caution when other indicators suggest suspicious infrastructure.
  • Combine server behavior, technology fingerprints (GoFrame HTTP Server with Caddy), regional directories, locale parameters and token generation endpoints to find related deployments.

Linha do tempo

  1. blog.checkpoint.com ↗ · pub. 15/10/2026 10:00 · coletado 19/10 17:57 primeiro registro

    Check Point uncovers multi-region phishing infrastructure hiding live campaigns behind blank 404 pages across thousands of rotating domains

    ler a análise desta fonte

    Check Point Exposure Management researchers uncovered a large, multi-region phishing infrastructure that conceals active campaigns behind domains that look inactive. Root domains return blank or generic "Not Found" pages, while the phishing content is served only through concealed regional paths (for example /it, /de, /pa) and under specific conditions. One September collection window tied 10,187 domains to the cluster, 90% of them in the highest malicious category. A later snapshot held 5,785 domains, which shows heavy infrastructure churn. Campaigns target banking, government services, transportation, postal services and rewards programs in Southeast Asia, Europe, Latin America, Israel, Australia, Africa and Asia. The researchers could not attribute the activity to a specific phishing kit, provider, operator or threat group. The evidence supports only the finding of a shared phishing toolkit.

    Technical Details

    • Researchers fingerprinted the infrastructure using an uncommon combination of GoFrame HTTP Server and Caddy, plus response behavior and recurring application behavior. This narrowed about 19,000 initial results to 322 candidate IP addresses.
    • Phishing content sits in regional directories, so the full URL is needed to see it. Lure URLs are likely distributed via SMS, email, WhatsApp and other private channels.
    • A case study of a rewards-themed domain targeting a Central American financial group showed the /pa path triggering a custom verification screen. The screen generated a session token before redirecting the visitor to the phishing workflow.
    • The platform supports many languages (English, Spanish, French, German, Portuguese, Arabic, Hebrew, Japanese, Korean, Hindi, Russian, Chinese).
    • Analysis of 500 domains showed shared APIs, configuration schemas, localization frameworks and session controls across campaigns with different brands, languages, currencies and reward catalogs. This points to a modular, reusable toolkit.
    • Domain and IP associations changed significantly between collection windows, so individual domains have limited long-term indicator value.

    Remediation

    • Hunt on behavior rather than individual domains. Useful signals are concealed regional delivery, tokenized access, randomized API paths, reusable configuration schemas, localization frameworks and session-controlled workflows.
    • Treat a generic 404 or "Not Found" response with caution when other indicators suggest suspicious infrastructure.
    • Combine server behavior, technology fingerprints (GoFrame HTTP Server with Caddy), regional directories, locale parameters and token generation endpoints to find related deployments.