Map a phishing campaign from a single hijacked subdomain

After a client's employee signed in on a fake login page reached through a paid search ad, Reut Menashe of the security firm Tetrisponse ran most of the follow-up investigation through an AI agent. The agent got one dead subdomain and was asked to find the rest of the operation. It worked across certificate transparency logs, passive DNS, scan archives and domain registration records, cross-referencing them and building a timeline. The firm did not name the agent or model it used.

The agent turned one incident into a whole campaign: dozens of hijacked business domains, a shared cloaking page that kept the malicious ads past review, and a backend collecting Google logins. It spotted that the operator had put several victims on one TLS certificate and used that to find more, and it split the attacker's own throwaway domains from the hijacked ones. The firm reported the backend and a registrar took it down, but it came back on new domains within the week. The victim list also named five Israeli companies that were never compromised: they only shared Cloudflare IP addresses with attacker sites, and the agent wrote them up with the same confidence as the real finds.

Shared IPs behind a CDN are a weak link, and the agent treated them as proof. The team only counts a domain as a victim when a live host on it resolves to the attacker's server at the time of writing. This is a security firm's own write-up of its work, with the client unnamed and no indicators published.