The Anatomy of a Phishing Attack

Phishing is social engineering delivered through technology. An attacker creates a fake website that mimics a legitimate service — a bank login page, a corporate email portal, a shipping notification — and tricks the victim into entering real credentials on the counterfeit page. The stolen credentials are immediately forwarded to the attacker, who uses them to access accounts, steal funds, or pivot into corporate networks.

What makes phishing so effective is that it targets the human layer rather than technical vulnerabilities. You don't need to find a zero-day exploit in someone's browser when you can simply ask them to type their password into a page that looks exactly like their bank. Anti-phishing working group data consistently shows that phishing attacks account for more initial compromises than any other attack vector, including vulnerability exploitation and brute force combined.

The domain name is the most critical component of a phishing attack. Users have been trained to "check the URL" before entering credentials, so attackers invest significant effort in making their domains look legitimate at a glance. Understanding the patterns they use is essential for both human awareness and automated detection.

Phishing Domain Patterns

Attackers use several well-established techniques to create domains that fool both humans and basic security filters.

Typosquatting — Registering domains that are one character off from the real thing. Examples: g00gle.com (zeros for o's), microsofft.com (double f), amazom.com (m for n). IDN homograph attacks take this further by using Cyrillic or Greek characters that visually match Latin letters — a Cyrillic "a" looks identical to a Latin "a" but resolves to a completely different domain.
Lookalike domains — Domains that include the brand name but aren't the official domain. Examples: paypal-security-update.com, apple-id-verify.net, netflix-billing-support.site. These work because users see the brand name in the URL and assume it's legitimate, without checking the actual registrable domain.
Subdomain abuse — Using the target brand name as a subdomain on an attacker-controlled domain. Example: login.paypal.com.attacker-domain.xyz. On mobile devices where the address bar is truncated, users may only see "login.paypal.com" and never notice the actual domain at the end. This technique is especially prevalent in SMS phishing (smishing) campaigns.
Compromised subdomain takeover — Attackers find abandoned subdomains of legitimate organizations (e.g., a CNAME pointing to a deprovisioned Azure instance) and claim the underlying resource. The phishing page then runs on a subdomain of a real, trusted domain — bypassing most detection.
URL shorteners and redirectors — Services like bit.ly, t.co, and tinyurl.com hide the actual destination. Open redirects on legitimate sites (e.g., google.com/url?q=evil-site.com) are particularly dangerous because the initial URL passes reputation checks.

How Phishing Domains Work Technically

Setting up a phishing site is disturbingly easy and cheap. The entire technical process can be completed in under an hour with free tools.

Domain registration: Attackers use registrars with minimal verification, often paying with cryptocurrency. Cheap TLDs like .xyz ($1/year), .site ($2/year), .top ($1/year), and .sbs ($2/year) are heavily favored because the cost is negligible. Some attackers register dozens of domains at once, using each for a single campaign before abandoning it.

Free SSL certificates: Let's Encrypt issues certificates to any domain that can prove control, with no identity verification. This means phishing sites display the padlock icon in the browser address bar, which many users still interpret as a sign of legitimacy. The "check for the lock" advice, once valid, is now actively misleading — over 80% of phishing sites use HTTPS.

Hosting: The phishing page itself is typically a cloned copy of the real login page, modified to POST credentials to the attacker's server. Phishing kits — pre-packaged archives containing everything needed to impersonate a specific brand — are sold on underground forums for $20-50. Some kits include real-time session hijacking capabilities that bypass two-factor authentication by proxying the victim's session through the attacker's server.

Evasion techniques: Advanced phishing pages use cloaking (showing the phishing page only to targeted visitors and a benign page to security researchers), geofencing (only targeting specific countries), and anti-bot measures (CAPTCHAs, JavaScript challenges) to evade automated detection.

The Phishing Lifecycle

Most phishing campaigns follow a compressed lifecycle, designed to maximize credential harvesting before takedown defenses can react.

Register domain — Often hours before the campaign launches. Newly registered domains are a strong phishing indicator. (Hour 0)
Deploy phishing kit — Upload the cloned login page, configure credential forwarding, obtain SSL certificate. (Hour 1-2)
Launch spam campaign — Send emails or SMS messages to the target list. Volumes can range from hundreds (spear phishing) to millions (mass campaigns). (Hour 2-4)
Harvest credentials — The bulk of credential theft happens in the first 24 hours, before the domain appears on blocklists. (Hour 4-24)
Cash out and abandon — Stolen credentials are used immediately (account takeover, wire fraud) or sold on credential markets. The domain is abandoned. (Hour 24-72)

The typical phishing domain is active for just 24 to 72 hours. This compressed timeline means that traditional blocklist-based defenses are often too slow — by the time a domain is reported, investigated, and added to blocklists, the campaign is already over and the attacker has moved on to a fresh domain.

TLD Patterns in Phishing Campaigns

Analysis of malware and phishing URLs tracked by WAYSCloud shows heavy concentration in certain top-level domains. While any TLD can host phishing, the cheapest and least regulated ones see disproportionate abuse:

.xyz — Among the cheapest TLDs, heavily used in disposable phishing campaigns
.site, .top — Low cost and minimal registration requirements
.sbs — Relatively new TLD with high abuse rates
.ru, .cn — Cheap ccTLDs with high volumes of phishing registration
Dynamic DNS subdomains (e.g., .duckdns.org, .no-ip.org) — Free, no registration required, frequently abused for C2 and phishing

That said, attackers also register .com domains when impersonating well-known brands, because users are more likely to trust a .com URL. TLD analysis is one signal among many — never the sole indicator.

How to Check if a Domain is Phishing

If you encounter a suspicious domain in your email, logs, or browsing, there are several checks you can perform.

WAYSCloud domain lookup

Search for the domain directly on WAYSCloud to check if it appears in our threat intelligence feeds:

# Check domain intelligence
https://ip.wayscloud.services/domain/suspicious-domain.xyz

# Search via API
curl -s "https://ip.wayscloud.services/search?q=suspicious-domain.xyz&type=domain"

The domain intelligence page shows associated malware URLs, resolved IPs, threat classification, and status history.

WHOIS age check

Newly registered domains (less than 30 days old) that mimic well-known brands are almost certainly phishing. Legitimate companies don't register new domains for their login pages.

# Check domain registration date
whois suspicious-domain.xyz | grep -i "creation\|created"

SSL certificate inspection

Legitimate organizations use Extended Validation (EV) or Organization Validated (OV) certificates. Phishing sites almost always use Domain Validated (DV) certificates from Let's Encrypt or ZeroSSL. While a DV certificate alone doesn't indicate phishing, a DV certificate on a domain claiming to be a major bank is a red flag.

# Check SSL certificate details
echo | openssl s_client -connect suspicious-domain.xyz:443 2>/dev/null \
  | openssl x509 -noout -issuer -subject -dates

Visual comparison

Open the suspected phishing page in an isolated environment (sandbox, VM, or browser with JavaScript disabled) and compare it to the real site. Look for subtle differences: wrong favicon, missing footer links, broken images, and form actions that POST to a different domain.

Organizational Defense Against Phishing Domains

For organizations, defending against phishing requires both technical controls and user education:

DMARC enforcement — Publish DMARC records with p=reject to prevent spoofing of your domain in phishing emails
Brand monitoring — Use certificate transparency logs and domain monitoring services to detect lookalike domain registrations
FIDO2/WebAuthn — Phishing-resistant authentication that binds credentials to the legitimate domain. Even a perfect phishing page cannot intercept FIDO2 tokens because the browser verifies the origin
DNS-layer protection — Block resolution of known phishing domains at the network perimeter
Simulated phishing campaigns — Regular testing with realistic scenarios reduces click rates and builds muscle memory for reporting suspicious messages

What is a Phishing Domain?