🚨 A Phishing Domain Targeting UAE ICP Smart Services A few days ago, while trying to access the #UAE ICP Smart Services portal, I accidentally typed the URL with a space — which redirected me to a Google search instead of the official site. While correcting the address, I noticed something suspicious: the third search result was a phishing domain impersonating the official Federal Authority for Identity, Citizenship, Customs & Port Security (ICP) website. The domain name looked almost identical to the legitimate one, even using what appeared to be a subdomain of the official ICP service. After a closer look, I found that the fake site presented itself as a “File Validity Check” and was collecting personal information from visitors. Out of curiosity, I entered fake data and noticed that the system perfectly mimicked ICP’s backend mechanisms, including the country code structure used by the real platform. All submitted data was being sent via an #API request to an unknown endpoint. Interestingly, the phishing domain had been active and indexed by Google since June 6, ranking third in search results, with no visible mitigation action. During further investigation, I also identified two additional related domains, which I’m currently analyzing. 🔎 Reminder: Just because a website appears in #Google search results doesn’t mean it’s legitimate. The safest approach is to bookmark or memorize official URLs for important government and financial services. Stay vigilant — #phishing campaigns are getting more sophisticated every day. #domain #dns #abuse #cybersecurity #scam #AE #emirates #dnsabuse

If you’re using data from URLAbuse (urlabuse.com), don’t miss our upcoming topDNS Best Practice Series webinar! 🚀
📅 Date & Time: 08 October 2025
🌐 Topic: How is DNS Abuse actually measured?
We’ll cover:
✅ The latest updates to the URLAbuse system
✅ How DNS abuse is measured in practice
✅ A first look at our brand-new platform 🎉

Speakers:
Maciej Korczynski (KOR Labs)
Sourena Maroofi (URLAbuse)
Rowena Schoo (NetBeacon Institute)
🔹 Moderated by Lars Steffen (eco – Association of the Internet Industry)
🔗 More details & registration: https://topdns.eco.de/events-archive/topdns-best-practice-series-how-is-dns-abuse-actually-measured/

If you work in cybersecurity, DNS operations, or anti-abuse, this is a great opportunity to learn, ask questions, and get a first look at what’s next.

#DNS #DNSAbuse #CyberSecurity #Infosec #Webinar #URLAbuse #topDNS

Phishing Domain Lifecycles

Phishers use a lot of domain names.

Our research shows that most phishing domains are registered by the phishers, often in bulk.

Phishers only have one purpose for these names: point them to fake pages and profit from victims lured there for as long as they can.

Investigators are constantly reporting phishing domains and these are blocklisted or shut down. Ideally, phishing domains have short lifetimes.

Is this conclusion fact or folklore?

Matt Piscitello begins a series of articles that look phishing domain lifecycles and lifetimes in https://interisle.substack.com/p/phishing-domain-lifecycles?r=59cehk

#phishing #domains #dnsabuse

Phishing Domain Lifecycles

Matt Piscitello

Interisle Insights

Phishing in the 2020s: What Can be Done to Reduce Phishing Attacks?

In this post we’ll look at what users can do to avoid becoming victims of phishing and, importantly, what domain name, subdomain, and hosting providers need to be doing to prevent criminals from using their services for malicious activities.

https://interisle.substack.com/p/phishing-in-the-2020s-what-can-be

You'll find more detailed recommendations in our Phishing Landscape Study

https://interisle.net/phishinglandscape2025

#phishing #cybercrime #dnsabuse

Phishing in the 2020s: Hosting Networks

In previous posts we looked at top-level domains and domain registrars that phishers most exploited over the past 5 years. In this post, we look at the hosting networks (ASNs) with the highest numbers of phishing attacks reported.

https://interisle.substack.com/p/phishing-in-the-2020s-hosting-networks

#phishing #ASN #hosting #cybercrime #dnsabuse #cybersecurity

If you like what you've been reading, subscribe.

https://interisle.substack.com/subscribe

Case study: How a single spam campaign affects service provider reputation

Matt Piscitello takes a close look at a spam campaign involving bulk registrations during the month of August 2025. He explains how #Interisle establishes evidence of bulk registration behavior, identifies what operators were affected, and discusses aspects of reputational harm resulting from the campaign.

https://interisle.substack.com/p/case-study-how-a-single-spam-campaign

#spam #bulkregistrations #dnsabuse #reputation #cybercrime #interisle

Cybercrime Activity Reported in August 2025

Interisle's monthly look at cybercrime activity during August 2025 is now posted. We point out anything that strikes us as particularly interesting in overall numbers as well as significant changes in ranking for Top Level Domains (TLDs), Registrars, and Hosting Networks.

https://interisle.substack.com/p/cybercrime-reported-in-august-2025

#cybercrime #malware #phishing #spam #dnsabuse

Phishing Landscape 2025 Report Released

Phishing Rises to New High of Nearly 2 Million Attacks over 12 Months According to New Interisle Report

Key report findings include:

Phishing attacks rose to 1.96 million a year, a 182% increase since 2021.

Domain Name Abuse Surges to New High: The total number of domain names used in phishing attacks rose 38% to over 1.5 million—the highest ever recorded.

Cybercriminal Domain Purchasing Soars: 77% of all domain names used in phishing attacks were maliciously registered by cybercriminals.

Bulk Registration Enables More Attacks: 37% of all phishing domains were acquired through bulk domain name registration services.

Over half of all phishing sites were hosted by U.S.-based companies. The U.S. has been the top hosting location for phishing for five consecutive years.

The report also examines how domain registration requirements and pricing affect phishing scores in gTLDs and ccTLDs.

https://interisle.substack.com/p/phishing-landscape-2025-report-released

#phishing #dnsabuse #dns #cybercrime

Phishing Trends: May - July 2025

Results for Phishing activity for the period May 1– July 31, 2025, are now available at the Cybercrime Information Center.

Phishing activity modestly declined in in early 2025, but it returned with vengeance in the spring and early summer:

- Phishing activity more than doubled to a staggering 1.3M attacks.

- Domains reported for phishing activity nearly doubled to just over 1M.

- Malicious domain registrations increased by 81%.

We take a long, hard look at ICANN's problem child... Dominet (HK).

https://interisle.substack.com/p/phishing-trends-may-july-2025

#phishing #cybercrime #dns #dnsabuse

Phishing in the 2020s: Bulk Registrations

This post continues the series that looks at aspects of phishing over the past five years.

A previous post examined malicious registration of domain names expressly for the purpose of phishing. In this post, we look at a subset of malicious domain name registratios: those domain names that were registered rapidly and in large numbers - in bulk - by phishers.

https://interisle.substack.com/p/phishing-in-the-2020s-bulk-registrations

#cybercrime #phishing #dnsabuse #fraud