As cited
Copy frozen at (site build).
threat intel
Silent Push Tracks a Mass Phishing Operation Through Fast Flux
Researchers at Silent Push purchased access to a fast-flux service to study how threat actors rotate DNS records across multiple IP addresses to evade detection in phishing campaigns. They identified thousands of live phishing domains, including a large operation targeting Canadian banks with nearly 2,000 domains and a separate callback phishing cluster affecting financial institutions across multiple countries. The infrastructure uses commercial traffic distribution systems to filter out security scanners, deliver customized phishing pages, and enable operator-driven account takeover.
Why it matters: Organizations relying on IP blocking to stop phishing face continuous evasion as fast-flux services rotate addresses within minutes; defenders need nameserver-level detection analytics, DNS-layer monitoring for high IP and autonomous system number diversity, and threat feeds that track both the delegated domains and rotating IP pools to stay ahead of these operations.
- Source published
- First seen by Cybersecurity Tracker