Anatomy of a typosquat: dissecting the latest banking phishing wave

PHISHING · 2026-06-30

Most phishing domains are not clever. They don't need to be. They need to survive a two-second glance on a phone screen, in a message the victim was half-expecting to receive. That is the entire engineering budget of a typosquat, and it is why the same handful of construction patterns keep appearing in every wave we take down.

The four constructions

Character swaps are the classic: a numeral "1" for a lowercase "l", "rn" standing in for "m". Suffix grafts append plausible security language to the real brand ("-secure", "-verify", "-support") and inherit the brand's trust while technically being a brand-new domain. IDN homographs go further, registering visually identical strings using Cyrillic or Greek codepoints, so even a careful reader sees nothing wrong. And subdomain stuffing puts the real brand name on the left of a junk registrable domain, betting that mobile browsers will truncate the part that matters.

Why the waves cluster

When we map a phishing wave instead of treating each domain as an isolated report, the same infrastructure keeps reappearing: one registrar with lax verification, one bulletproof host, one TLS issuer, wallets of domains registered minutes apart. Kits sold on dark-web markets ship with registration scripts, cloned login templates, and evasion baked in, which is exactly why one-at-a-time takedowns lag the attacker. The kit can mint a replacement domain faster than a manual report cycle can clear one.

What actually kills a wave

The effective countermove is to attack the shared layer, not the leaf nodes. A registrar complaint that cites the whole registration cluster puts every sibling domain in scope at once. A host abuse report backed by evidence of the cloned UI takes the content down even where the domain survives. Where the registrant digs in, UDRP or URS proceedings move the domain itself out of their hands. Sequencing matters: content first (stops the harvesting today), then registration layer (stops the resurrection tomorrow).

What to do before the wave

Register the obvious near-misses of your own brand before someone else prices them. Monitor certificate-transparency logs for your brand string; a TLS certificate is usually issued minutes after registration and hours before the lure goes out. And give your customers one canonical login URL, everywhere, so anything else is automatically suspect. None of this stops a determined attacker; all of it shortens the window in which their spend pays off.