Not my sector? Same traffic machine.

On 20 October 2026, a Malanta researcher opened iuntuit[.]com, Intuit with one extra letter, in an ordinary browser. It sent them on to a page that asked them to prove they were human. Ticking the box silently copied a command that, if pasted into a terminal, would install a hidden macOS launch agent. That agent finds its command server through a smart contract on the Polygon blockchain.

That page sat on a domain registered the same day. Two weeks earlier, a visit to the same typo from a cloud address had found only a parking-style search page.

That typo is one of about 115,000 domains on the same private nameservers. They imitate banks, retailers, insurers, software vendors, government portals and gaming sites, and the brands' main markets span 76 countries. Many threat-intelligence programmes still filter for actors that target "our sector in our region." This infrastructure walks straight through that filter.

One machine, every sector

Malanta's lookalike monitoring flagged 466 brand lookalikes that sent visitors to destinations already flagged. Together they impersonated 133 organizations in 18 industry sectors. What they shared mattered more than the brands they imitated: all 466 delegated DNS to one family of private nameservers.

Following that family exposed the machine:

• Scale. About 115,000 front domains sit on 11 linked nameserver domains. 99.9% of their address records point to 125 dense parking addresses. The domains we tested showed one shared gate fingerprint, and sampled domains on six of the nameserver domains shared one ad-feed publisher account.
• Method. The operator does not pick targets by sector. It collects typing mistakes across brands, screens each visitor by device and location, and sells the visit to whoever bids.

Still growing, and switched on in batches

The inventory is not a relic:

• It keeps buying. About 15% of the domains were registered or re-registered in 2025-26, including roughly 13,500 in four months at the end of 2025.
• The lures are fresh. The fake-CAPTCHA page sat on a domain registered the day of the visit. A MEGA download sat behind a redirector six days old. A feed server changed its name while keeping its address.
• Names wait, then move together. 25 domains were registered on one day in September 2025, flagged by Malanta in late 2025, and left parked for about eight months. In late August 2026 their Quad9 lookups jumped to about seven times those of comparable domains, all at once, for about three weeks.

Same machine, different buyers

What a visitor finally receives depends on who buys the visit:

• brand-keyword search pages;
• adult and gambling offers;
• paid or affiliate routes that landed on at least 19 brands' own sites;
• a MEGA file behind a fresh redirector;
• an Android app pushed from outside Google Play.

What was already known, and what this adds

Infoblox Threat Intel described parked-domain traffic systems in December 2025, including nameserver portfolios that appear in this family. We credit that work. This research places torresdns, hastydns and nine more nameserver domains on one co-located infrastructure. It follows routing per visitor profile, and it publishes the expanded indicator set: nameserver IPs, dense parking networks, seller identifiers, gate fingerprints and new threat hosts.

Discovery started from pre-attack lookalike signals, not from scanning alone. Indicators of Pre-Attack (IoPAs) on the seeds were the door into the platform.

What to do with this

• Correlate across sectors.
• Act on what stays put: the nameserver family, parking networks, gate fingerprint and seller identifiers. The threat hosts on top rotate.
• Watch for bulk registrations delegated to the family. The batch that woke up in August was on Malanta's list eight to nine months earlier.
• Plan for replacement, not a single takedown.

The full evidence, methodology, MITRE mapping and indicator appendix are in the technical report. The indicator CSV lists about 115,000 front domains with their nameserver domain, plus control-plane and threat indicators, each with a recommended use.

The Bottom Line

"Not my sector" is a weak reason to ignore shared Resource Development infrastructure. This traffic machine is large, busy and still being restocked. It does not care which vertical owns the brand. It cares who mistypes, who looks like a real user, and who pays for the visit.

Read the full investigation: Different Brands. The Same Traffic Machine. The indicator package ships with the report.

Pre-Attack Prevention. Hit the source.