New research by Check Point has uncovered a particularly sophisticated phishing operation that manages to remain invisible to users and many detection tools.
Researchers identified thousands of phishing domains that appear to be simple error pages (Not Found or 404), giving the impression that they are inactive.
In reality, however, when someone visits them using specific geographic or language settings, they activate fully functional phishing environments tailored to the country and profile of each target.
The investigation began with a few suspicious URLs, but soon uncovered a wider, shared infrastructure used across multiple countries, languages and scam campaigns.
Rather than focus on the domains, which are constantly changing, the researchers mapped specific technical characteristics and behavioural patterns that remained consistent across the network.
Using this methodology, they were able to link thousands of domains to the same underlying platform, exposing an operation that relies on constantly rotating and replacing infrastructure to evade detection.
‘A 404 page is supposed to indicate that there is nothing there. In this case, however, the error page was part of the deception’, comments Check Point Security Researcher Yehonatan Wiesel.
‘The phishing content was hidden behind localisation mechanisms, verification processes and session checks designed to make things harder for both researchers and automated detection tools’.
The research also shows how organisations can identify such campaigns not only through their domains, but also by looking for shared technical and behavioural characteristics that remain unchanged even when the infrastructure changes.
The platform has been used in phishing campaigns impersonating banks, public services, transport companies, toll and parking services, courier companies and loyalty programmes in many countries and more than a dozen languages.