From 466 lookalike IoPAs to one traffic machine
This is a div block with a Webflow interaction that will be triggered when the heading is in the view.
A single lookalike domain is easy to dismiss. Typos are common. Privacy WHOIS is everywhere. Expired names trade every day.
What made 466 of them worth following was not any one signal. It was the combination of independent evidence families, and then the infrastructure they shared.
Layer 1: raw signals on the seeds
In early October 2026, Malanta's lookalike monitoring flagged domains that redirected visitors to destinations already flagged by Malanta reputation or by multiple public DNS blocklists. All but one of the 466 seeds carried at least two independent signal families: lexical, registration, mail, content, and reputation.
Examples of seed profile (shares are of the set, not mutually exclusive):
- 100% redirected to a flagged destination
- 68% lexical typo of a monitored brand
- 68% privacy-protected registration
- 28% combosquat (brand plus a word)
- 27% re-registered after expiry
- 83% carried three or more signal families
None of those facts convicts a domain alone. Together they justified the next question: what do these domains share?
Layer 2: correlation through nameservers
All 466 sat on private-label nameserver domains. Ten nameserver domains held the seeds. Registration batches, shared and adjacent nameserver addresses, and nameservers inside parking networks linked those ten, and an eleventh, into one family.
That is the pivot most sector-scoped IOC workflows never take. The brand on the left of the lookalike changes. The nameserver on the right does not.
Layer 3: expansion and validation
A reverse nameserver lookup over Malanta DNS data on 20 October listed about 115,000 domains delegated to the family. Shared nameservers alone could mean a reseller, so further checks were required:
- Hosting concentration: 99.9% of address records pointed to 125 dense parking addresses in 21 networks
- Acquisition waves: bulk same-day registrations feeding specific nameserver domains through dominant registrars
- Behaviour on tested domains: shared gate fingerprint (loading page, signed Joken JWT, Cowboy server), shared routes through the same redirector, and one observed publisher account (
publisher=230041,pubfeed=965920) across six nameserver domains
Page-similarity hashing, certificate clustering, and IP geolocation were not used to build the set. Membership is defined by current nameserver delegation.
Our reading: one operator runs the nameservers, parking, gate, and routing observed on tested domains; several domain owners park inventory with it. High confidence for a shared platform. Medium for the exact owner/operator split.
What hunters should prioritize
Durable IoPAs for this family are relationship artifacts, not yesterday's landing page:
- The 11 nameserver domains and 20 nameserver IPs (RPZ
NSDNAME/NSIPcandidates after log-only assessment) - Dense parking networks listed in the appendix (validate; shared hosting risk)
- Gate strings: short Loading page,
?ch=1&js=, JWT audience claim for Joken,Server: Cowboy - Seller fields in proxy logs:
publisher=230041,pubfeed=965920 - New bulk delegations onto the family (hundreds of same-day registrations onto one nameserver domain)
Block confirmed threat hosts. Do not blanket-block shared ad-tech, CDNs, MEGA as a service, or public blockchain RPC providers.
The Bottom Line
IoPAs earn their name when raw signals survive correlation and validation. Here, multi-family lookalike evidence opened a nameserver family, and the nameserver family opened a six-figure domain inventory. Hunt the relationships that outlive any single lure.
Full tables, architecture diagram, and the indicator CSV: technical report. Next in this series: what different visitor profiles actually receive from the same front domain.
Pre-Attack Prevention. Hit the source.
