This is a div block with a Webflow interaction that will be triggered when the heading is in the view.
Different Brands. The Same Traffic Machine.
Threat-intelligence programmes that filter for actors targeting one sector or region can miss a shared traffic platform that serves all of them. Malanta's lookalike monitoring flagged 466 brand lookalikes that redirected visitors to already-flagged destinations. Shared private nameservers opened about 115,000 front domains on 11 linked nameserver domains. Sector relevance alone can miss the platform.
Key findings
- 466 brand lookalikes flagged by Malanta; all but one carried at least two independent signal families. Together they impersonate 133 organizations in 18 industry sectors.
- About 115,000 domains delegated to 11 linked private nameserver domains (20 nameserver IPs). About 28% of fronts are lookalike names. 99.9% of address records point to 125 dense parking addresses.
- Imitated brands span every sector category Malanta uses, with main markets in 76 countries.
- Visitors are screened, then sold. Crawlers and cloud checks often see parking pages. Selected real-user profiles are handed to ad feeds.
- Observed landings include commercial offers, unanalysed downloads, and, in one case, a fake-CAPTCHA macOS dropper with a Polygon smart-contract dead-drop.
- A 25-domain batch registered 24 Sep 2025 was flagged by Malanta in Nov-Dec 2025, parked about eight months, then showed a coordinated Quad9 lookup burst in late Aug 2026.
- Infoblox (Dec 2025) named portfolios including
torresdnsandhastydns. This research places both, and nine more nameserver domains, on one co-located family. - Most of the durable layer sits in MITRE ATT&CK Resource Development (TA0042): domain acquisition, DNS servers, and dedicated parking infrastructure before delivery.
What is inside
- Executive summary
- Not my sector?
- Key findings
- From signals to shared infrastructure
- One operator's infrastructure
- Every sector, many markets
- Who sees what
- Threats running on the infrastructure
- Flagged months before it woke up
- What was already known, and what this adds
- Who gains what
- Defensive implications
- Methodology
- References
- Indicator appendix
Frequently asked questions
What is this paper?
A technical investigation of one shared traffic platform behind brand lookalike domains across every sector. It shows how pre-attack lookalike signals, correlated through private nameservers, open about 115,000 fronts that screen visitors and sell visits to whoever bids.
What is an IoPA in this context?
An Indicator of Pre-Attack describes infrastructure while it is still being built, held, or wired, before a conventional IOC. Here: multi-family lookalike signals, nameserver-family membership, gate fingerprints, seller identifiers, and staged domain batches flagged months before a traffic burst.
How does this relate to MITRE ATT&CK?
The operator layer maps primarily to Resource Development (TA0042), including Acquire Infrastructure for Domains, DNS Server, and Server. Traffic buyers can use malvertising-style delivery. One observed malware path used ClickFix and a blockchain dead-drop resolver.
Where is the full indicator set?
Nameserver domains and IPs, dense parking networks, behavioural strings, threat hosts, and recommended use notes are in the PDF appendix. The full indicator CSV (about 115,000 front domains with nameserver domain, plus control-plane and threat indicators) ships with the report.
What publishes with this paper?
The companion blog publishes the same day: Not my sector? Same traffic machine. Follow-on posts cover discovery method, screening, the ClickFix path, and the eight-month staging batch.
