Malte ZanderContents
You link cases through traces operators rarely change: servers and name servers, registrar and registration time, certificates covering several names, identical files and text, service identifiers and the destination a form sends its data to. The more unique a trace, the stronger the link. Linked cases make reports more convincing, show you the next fake earlier and give your law firm and the authorities a pattern instead of isolated incidents.
- Investigators linked at least 40,000 phishing domains to the single platform LabHost (BleepingComputer).
- In 35,067 phishing websites using cloaking tricks, researchers found 1,128 groups of related implementations, which they attribute to distinct threat actors (Zhang et al., IEEE S&P 2021).
- Microsoft traced phishing campaigns against more than 10,000 organisations to one and the same open-source kit (Microsoft).
- Publicly trusted certificates appear in Certificate Transparency logs, including every name they cover (Chrome).
Why is it worth linking cases?
Because you rarely fight a single page. Behind several fakes there's often the same operator or the same kit. Recognising that gives you four advantages: reports are more convincing when they show a pattern. Registrars can check other domains of the same registrant. You see where the next copy is likely to appear. And your law firm or the police get one weighty case instead of ten small incidents.
Which traces connect cases?
| Trace | Where you find it | Strength |
|---|---|---|
| IP address and network | DNS and network records | Low at large hosts, higher on small servers |
| Name servers | NS records | Medium, if unusual |
| Registrar and registration time | RDAP data | Medium, if many domains were registered in the same window |
| Certificate covering several names | Certificate, transparency logs | High, the names sit in the same certificate |
| Identical files | Page source, embedded images and scripts | High for rare files, low for widespread kits |
| Text and typos | Page content | Medium, the operator's own mistakes are often distinctive |
| Service identifiers | Page source, TXT records | High, such as the same analytics or verification code |
| Destination of form data | Page source, form target | Very high, the same destination means the same loot |
| Lures | Emails, ads, QR codes | Medium, the same template or campaign |
How strong is a link?
That depends on how many others share the same trace. Two fakes at a large host say little, since millions of sites live there. Two fakes whose forms send to the same destination almost certainly belong together. A useful rule of thumb:
Weak: the same large host, the same CDN, the same domain extension, the same free certificate authority.
Medium: the same small server, the same registrar in the same time window, the same naming pattern, the same text.
Strong: the same certificate for several domains, identical rare files, the same service identifier, the same destination for form data.
Only link cases from one strong or several medium traces. Be careful with phishing kits: if a kit was sold to thousands of users, as LabHost's were, the same kit doesn't yet mean the same actor.
Where do you find the traces?
In the data you secure anyway. Registration data, DNS records, network records, the certificate, the page source and the archived copy contain almost everything in the table. That's why complete preservation of the first case is so valuable: it becomes the reference for all later ones. How it's done is in Securing evidence of a fake website, what the certificate reveals in Reading TLS certificates and what DNS records reveal in DNS records explained.
How do you document links?
As entries of their own, not as gut feeling. For each connection, record which cases it connects, through which trace, with what evidence and how strong you judge it to be. That keeps it clear why you merged cases, and a wrong link can be undone later. Over time, a network of cases emerges that shows which operators attack you repeatedly.
What do you do with linked cases?
Report with the pattern: name the linked cases and ticket numbers in every report. Ask registrars explicitly to check other domains of the same registrant.
Watch deliberately: traces such as naming patterns, servers or certificate habits show where the next copy will appear. More in The resurfacing problem.
Escalate: a pattern of many cases is a reason to bring in your legal team or the police.
Report upwards: show management how many cases go back to a few operators. That makes risks tangible.
How does AI Fraud Protect help?
AI Fraud Protect secures the complete evidence package for every find and matches new finds against earlier cases. Comebacks and related fakes are linked, so reports can be prepared with references to earlier cases. A person reviews and sends every message, and open cases stay on the follow-up list.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Can I identify the perpetrator by name this way?
Rarely. Linking shows that cases belong together, not who is behind them. Names are for the authorities to find, and linked cases help them do it.
How many cases do I need before linking pays off?
From the second case on. The earlier you capture traces systematically, the faster you see patterns.
May I test form destinations myself?
No. Don't send any data to a fake, not even made-up data. Read the destination from the page source.
What if a link turns out to be wrong?
Then undo it and note why. That's why every connection records the trace it rests on.
Sources
BleepingComputer: LabHost disrupted, 18 April 2024
Zhang et al.: CrawlPhish, Large-scale Analysis of Client-side Cloaking Techniques in Phishing, IEEE Symposium on Security and Privacy 2021
Microsoft Security: from cookie theft to BEC, AiTM phishing as an entry point to financial fraud, 12 July 2022