Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages

A domain returns a blank page. Maybe a generic “Not Found” message. There is no login form, suspicious branding, or obvious phishing content to investigate.

Yet the phishing site may still be there.

Check Point Exposure Management researchers uncovered a large scale, multi region phishing infrastructure designed to conceal active campaigns behind seemingly inactive domains. Starting with a handful of phishing URLs, the investigation identified a repeatable technical fingerprint that ultimately connected the activity to thousands of rotating domains targeting organizations and users across multiple regions.

The infrastructure uses regional paths, localization, session controls, and token gated access to determine when its phishing content appears. Visit the wrong URL and you may see nothing. Reach the right path under the right conditions and an active phishing workflow appears.

Figure 1. A blank “Not Found” page returned when the concealed directory is not accessed.

Key Takeaways

• Active phishing sites can appear inactive. Root domains frequently return generic 404 or “Not Found” pages while phishing content remains accessible through concealed paths and conditional routing.
• A technical fingerprint exposed a much larger network. Researchers combined GoFrame HTTP Server characteristics, Caddy, response behavior, and other signals to narrow approximately 19,000 initial results to 322 candidate IP addresses.
• The infrastructure connects to thousands of domains. One September collection window identified 10,187 associated domains, with 90% falling into the highest malicious category. A later snapshot contained 5,785 domains, highlighting significant infrastructure churn.
• Campaigns are built for regional targeting. Researchers observed phishing themes across Southeast Asia, Europe, Latin America, Israel, Australia, Africa, and Asia, covering banking, government services, transportation, postal services, rewards programs, and other sectors.
• The platform appears modular. Shared APIs, configuration schemas, localization frameworks, and session controls appeared across campaigns with different brands, languages, and regions.

Finding Phishing Behind the 404

The investigation began with a small set of known phishing URLs.

Researchers noticed that phishing pages were frequently hidden inside regional directories. An Italian themed domain served its phishing content through /it, while German themed infrastructure used /de. Visiting the root domain could return an unremarkable error page.

That creates a visibility problem. Full phishing URLs may be distributed through SMS, email, WhatsApp, and other private channels. Without the complete URL, traditional domain inspection may reveal little indication that a live phishing page exists.

Researchers turned to the underlying infrastructure for clues.

An uncommon combination of GoFrame HTTP Server and Caddy, combined with response characteristics and recurring application behavior, provided a fingerprint that could be used to hunt for related infrastructure.

Figure 2. Infrastructure discovery flow showing how researchers narrowed the initial footprint to 322 IP addresses and thousands of associated domains.

One Platform, Many Regions

Analysis of 500 domains from the cluster revealed campaigns spanning numerous regions and industries.

Southeast Asian campaigns heavily featured banks, financial services, and rewards programs. European themes included transportation, parking, taxation, public administration, and parcel delivery. Latin American campaigns impersonated financial institutions, government agencies, postal services, and social benefit programs. Researchers also observed localized targeting in Israel, Australia, Africa, and Asia.

The common infrastructure underneath these campaigns is significant. Different branding and languages can be swapped into a shared technical framework, allowing localized phishing experiences to be deployed across regions.

Getting Through the Verification Layer

One case study shows how deeply the phishing content can be concealed.

Researchers examined a rewards themed domain targeting customers of a Central American financial group. The root domain and one regional path returned “Not Found.” Accessing the /pa path triggered a custom verification screen.

Figure 3. Custom validation layer displayed after accessing the correct regional path.

The verification process generated a session token before redirecting the visitor into the phishing workflow. The platform also supported numerous languages, including English, Spanish, French, German, Portuguese, Arabic, Hebrew, Japanese, Korean, Hindi, Russian, and Chinese.

Behind that layer sat the phishing lure itself.

Figure 4. Main phishing lure page revealed after the validation process.

Researchers found equivalent API structures and configuration schemas across separate campaigns. Branding, language, currency, and reward catalogs could change while the core architecture remained consistent. These similarities point to a shared toolkit or operator supporting localized campaigns through a reusable platform.

Hunting the Behavior Behind the Domain

The infrastructure is highly dynamic. Domains and IP associations changed significantly between collection windows, reducing the long term value of individual domains as indicators.

The repeated behavior provides stronger hunting opportunities.

Researchers identified concealed regional delivery, tokenized access, randomized API paths, reusable configuration schemas, localization frameworks, and session controlled workflows as recurring characteristics that can reveal related deployments as visible infrastructure changes.

Security teams should also treat a generic 404 or “Not Found” response cautiously when other indicators suggest suspicious infrastructure. Combining server behavior, technology fingerprints, regional directories, locale parameters, token generation endpoints, and repeated application structures can provide a clearer view of what is hiding underneath.

The researchers could not conclusively attribute the infrastructure to a specific phishing kit, service provider, operator, or threat group. The available evidence supports a shared phishing toolkit finding, while named attribution would require additional evidence.

For the complete investigation, methodology, infrastructure analysis, case studies, and hunting recommendations, read the full report: Infrastructure Fingerprinting of a Multi Region Phishing Operation

Discover how Check Point Exposure Management helps organizations detect phishing sites and brand impersonation, uncover malicious infrastructure, and take action against threats targeting their organization.