Skip to content

Digital risk protection · Use cases

What it looks like in practice

In the examples below, attackers used their own domains, free site builders, social media platforms and text messages: infrastructure outside the targeted organization, which internal controls are not built to watch. The four cases come from BlueVoyant’s client base and are described by industry only; the campaigns are ones BlueVoyant’s analysts have tracked and published.

Talk to an advisorSee how takedown works
From the client base

Four cases

Construction: lookalike domains

Threat
Emails from lookalike domains, sent to the company’s clients and employees.
Response
Monitoring of newly registered domains and social profiles that closely resembled the company’s.
Outcome
The domains and profiles were removed before the spear-phishing campaigns took off.

Banking: cloned websites

Threat
Websites copying the bank’s content, code and design.
Response
Detection of newly activated domains reusing elements of the official site.
Outcome
Modified HTML clones were identified and taken down quickly.

Banking: an SMS campaign

Threat
A large phishing campaign distributed by text message.
Response
492 phishing websites were detected and taken down, and the infrastructure behind them investigated.
Outcome
Phishing kits and exposed victim logs were recovered and shared, so affected accounts could be protected. A flat fee covers all 492 takedowns; on packages of 50, if each takedown uses one unit, the campaign alone would need ten.

Banking: fake customer service pages

Threat
A network of fake “customer service” pages on Facebook impersonating banks.
Response
Analysts engaged the actors and mapped the scam: victims were pushed to install a remote-access app and make small test transfers.
Outcome
The pages were removed, and the tactics were shared so the banks could warn their customers.
Attack patterns

Five campaigns, and why internal controls miss them

CampaignTechniqueWhy it is hard to see from inside
Site-builder bank phishingFree website-builder templates reused as a phishing kit; more than 200 US banks targeted through lookalike subdomainsHosted on a trusted platform’s domain; no new domain registration to detect
Third-party payment phishingOne payment-brand kit lets victims choose their own bank from hundreds; the kit was published on a public code repositoryThe targeted bank’s name never appears in the domain
Malicious search adsPaid search ads lead to phishing sites; malicious ad creation grew 28% in 202370% of ad-linked phishing sites have no lookalike domain
“Customer service” pagesFake bank support pages on social media push victims to install remote-access tools and send transfersRuns entirely on a social media platform
Lookalike email domainsOne-letter domain variants used for invoice, recruitment and executive impersonation scamsThe mail goes to your partners and candidates, not through your gateway
Industries we protect

Who this is built for

  • Banks. Customers log in, move money and trust messages that appear to come from you. Every pattern on this page has been used against banks.
  • Insurers. Fake claim portals, fake policy renewals and lookalike domains used to collect payment details from policyholders.
  • Online retailers. Fake shops, fake support pages, rogue apps and search-ad phishing all trade on a brand people already buy from.
  • Postal and parcel delivery services. “Your parcel is waiting” text messages are among the most common smishing lures there are, and they use your name.
  • Public service providers, such as pension and health insurance funds. Citizens expect messages from you about money and personal data, which is exactly what makes impersonating you profitable.
  • Freight and logistics. Lookalike domains used for invoice and payment-redirection fraud against your customers and suppliers, who are often the last to tell you.
  • Electricity and gas utilities. Fake bills, fake refunds and fake disconnection warnings sent to customers, and lookalike domains aimed at suppliers. For entities under NIS2, impersonation is an external threat to the services you are required to protect.

NIS2 →

Organisations with visible executives, in any of these industries, face CEO impersonation and spear phishing built from personal footprints. Executive protection →

FAQ

Frequently asked questions

The questions we hear most often from security and IT leaders.

Something not covered here? Ask us directly

Part of the published research is US-based, but the techniques are not tied to one country. Site-builder phishing, search-ad phishing, fake support pages and lookalike invoice domains are used against European brands in the same way, and in the local language.

If customers log in to something of yours, pay you, download your app or follow your social accounts, someone can profit from pretending to be you. The question is usually not whether you are targeted, but whether you would find out.

Where to go next

Related pages

  • Brand impersonation

    Lookalike domains, phishing sites, fake social media profiles and rogue apps, found and taken down.

    Learn more

  • Takedown

    Three layers of removal, unlimited takedowns, and an 18-hour median for phishing sites.

    Learn more

  • How we compare

    Four ways to buy this, and what each approach leaves sitting with you.

    Learn more

Ready to get started?

Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.

Get in touch today