Summary
- Check Point identified 10,187 associated domains in one September collection window, not 10,187 confirmed active phishing pages.
- Root URLs can show blank or “Not Found” responses while regional paths and conditional checks expose scam content to selected visitors.
- European themes imitate transport, parking, tax and delivery services; the researchers have not identified the operator or counted confirmed victims.
Check Point researchers have mapped phishing infrastructure that can display blank or error pages to ordinary visitors while serving scam content through regional paths and access checks. A September collection window identified 10,187 domains associated with the cluster; that does not make every domain a confirmed active phishing page.
Check Point’s Exposure Management team says around 90% of the 10,187 associated domains received its highest malicious classification. Another collection window returned 5,785 domains. The change establishes turnover in the measured population, not the permanent removal of 4,402 operational scams, and the classification does not provide a tally of successful attacks or victims.
Depending on the address and circumstances of a visit, the infrastructure can return a blank page, generic “Not Found” message, or inactive-looking homepage. Check Point demonstrated that particular regional paths and verification steps could lead to phishing content. An associated domain that returns an error is not itself proof that a live phishing flow was available at that address during every scan.
Check Point identifies regional paths, language selection, session controls, and token-gated access as elements of the system. Some pages also present verification challenges before revealing their content. These techniques can prevent a researcher, crawler, or automated scanner from reaching the same page shown to an intended victim.
Across European campaigns, the infrastructure imitates parking operators, tax bodies, transport services, and parcel delivery companies. The same underlying toolkit is adapted for other regions by changing branding, language, and currency. Researchers say the broader operation supports 12 languages, allowing the fraud pages to appear familiar in different markets.
Phishing investigators often begin with a suspicious URL forwarded by an employee or user. If the domain appears empty when visited, that observation alone may be mistaken for evidence that the scam has been removed. Conditional delivery creates a gap between the state visible to an investigator and the version presented through the original attack path.
The research linked domains using repeated combinations of server and application behaviour rather than branding alone. Such fingerprints provide grounds for investigating related infrastructure after individual URLs change. However, a matching infrastructure signal is not equivalent to seeing a phishing form, observing a payment, or establishing that an individual visitor surrendered information.
The company reports extensive use of major cloud hosting providers. Hosting concentration does not establish involvement by those providers in fraud or prove that all infrastructure under a shared provider is malicious. Criminal groups can exploit legitimate low-cost services and replace addresses rapidly, leaving defenders to distinguish abuse from ordinary customer activity.
European campaign themes include parking fees, transport services, tax administration, and parcel delivery. The investigation concerns the underlying network rather than consumer-specific advice: frequently changing domains complicate the work of organisations whose brands are impersonated, while investigators may need the full path, redirect history, and session conditions to reproduce a suspicious page.
The two September snapshots capture a moving set of domain associations. Check Point has not publicly apportioned the change between takedowns, domain replacement, sampling differences, and loss of reachability, nor does its malicious classification establish criminal use of every domain. A specific prosecution or confirmed victim tally would require additional evidence beyond the technical similarities observed. The researchers’ discovery method therefore supports an infrastructure assessment rather than a census of simultaneously active scams.
The report does not identify an operator or establish how many people entered information into the observed phishing flows. Its central verified measurements are the 10,187 associated domains in one snapshot, the conditional delivery mechanism demonstrated on example sites, and repeated technical characteristics across regional campaigns. None should be equated with 10,187 successful attacks or confirmed active phishing pages.
