Phish Watch · No. 2 · 24 Sep – 31 Oct 2026

Our most common phishing lure came from domains that can't exist

Thirty-seven more days of the same spam folder. A fake "storage full" bill made up most of the credential phishing, sent from top-level domains that aren't in the root zone. A casino operator replaced every domain name it used in September and kept its address block. And the website-form relays came back, pointing at Telegraph pages.

By Josh Jenkins, Vorant · 3 November 2026

This issue picks up one second after No. 1 stopped counting, on 24 September, and runs to the end of 31 October. As before, Gmail had already filed every message as spam, so this is what is being sent, not what got through. Of the 58 malicious messages, 30 passed DMARC. Sixteen of those came from domains the attacker had set up properly, ten of them from one casino operator. The other 14 came through someone else's domain: six personal mailboxes (three Gmail accounts and three mailboxes at internet providers), three real websites' forms, three accounts on marketing or feedback platforms, and the mail systems of a company and a government ministry.

1The most common phish came from domains that can't exist

Ten of the 16 credential-phishing lures were one fake bill: "Payment failed for your Cloud storage renewal … your payment method has expired", under subjects like "Action Required: Storage 100% Full". Every one was sent from a made-up address such as ovvno[.]ptu or xxovr[.]afi: five random letters on a three-letter top-level domain that isn't in the internet's root zone. We checked all ten against IANA's list on 3 November. A domain like that can't be registered or looked up, so it can't publish a DMARC policy, and none of the ten got a DMARC result. The envelope sender, which is what SPF checks, was a numbered subdomain (sb012, sb017, sb020 …) of Indonesian .my.id and .biz.id domains, and it passed. The mail came from seven addresses; the three we looked up belong to OVH.

Every link went to an HTML page in a Google Cloud Storage bucket, five buckets in all, with the same affiliate-style tracking query ending in cid=422302. The lure reached the trap three times in the last ten days of No. 1 and ten times in this issue. The last one arrived on 26 October. That query makes a precise pattern: over everything the trap has stored since 25 August, it matches 13 messages, the three in No. 1 and these ten, and nothing else.

storage\.googleapis\.com/[^/]+/[^/]+\.html\?act=cl&.*cid=422302

If you run a mail gateway: a From domain under a top-level domain that isn't delegated can't be legitimate. The root-zone list is public and short. Check that your gateway rejects such mail or scores it heavily, rather than leaving it to DMARC, which has nothing to evaluate. Hunt for it: search proxy and mail logs for the pattern above.

2One casino operator, six new names, the same address block

In No. 1, four "RewardHub" domains sent a cash-back lure from 103.129.44.0/22. That block sent ten more messages in this issue, from nine addresses and six new domains: trykaramba, adeaseinc, truetrustline, trustifyapp, usa-sw and vipvnn, all .com. All ten passed SPF, DKIM and DMARC. The pitch changed from cash back to an online-casino welcome bonus, written as a chatty personal note ("A friend once told me she only signs up for things that spell out the deal upfront"). One address, 103[.]129[.]44[.]93, sent in both issues, and when we looked in October two of the new domains used the same registrar and name servers as one of No. 1's.

Casino offers were the biggest single group in this issue: 18 of the 40 scams. Besides this operator's ten, five came through the redirect broker in finding 3, and three were bonus mails ("Your £4,000..Welcome Bonus + 210 Free Spins", "You received a payment of 7,000.00 $ as a bonus") linking to two more storage buckets.

For sender reputation: scored one domain at a time, this operator is six clean newcomers. Scored by network block, it is one sender that has used ten domains across the two issues.

3The redirect broker went quiet on 18 October

No. 1 traced eleven Google Cloud Storage buckets to one spam traffic broker by a token in every link, 1626b9s. The token appeared in ten more messages in this issue, through seven buckets, three of them already seen in No. 1. The offers stayed mixed: a fake "direct deposit" of $13,963.99 that leads to an online casino (five), sexual-enhancement pills (three) and, new this time, a credential lure: "Your Account Has been Blocked! Your Photos and Videos will be Removed" (two). As in No. 1, none of its mail had a DMARC result. The last message arrived on 18 October and nothing has come since: 22 messages in all, from 26 August.

No. 1's pattern matched all ten. The five "direct deposit" messages, like three in No. 1, also had envelope senders of one shape, <word>.<word>.funbet1.inc-org.<domain>, on eight different domains between them.

storage\.googleapis\.com/[^/]+/[^/]+\.html#/.*(1626b9s|2e\.31\.36\.32\.36\.62\.39\.73)

4The website-form relays came back, with Telegraph pages

No relayed lure arrived between 21 September and 17 October. Then five came in under two weeks: three from Japanese companies' contact forms and two from WordPress sign-ups, on an Italian site and a Greek one. The method is the one No. 1 described: the attacker types the lure into a name or username field, and the site's own confirmation email delivers it. Three of the five passed DMARC as the site itself. The three Japanese ones name exchanges (Kraken, Binance, Coinbase) and point to Telegraph pages with ticket-style titles, such as graph[.]org/Notification-506935-10-22. The two WordPress ones point to numbered Cloudflare Pages sites, now called id5967 and eventid4137 rather than transfer40x. Relays fell from 18% of the malicious mail to 9%.

If you defend a mailbox: an exchange's name, a crypto amount or a Telegraph link inside a "thanks for contacting us" or "your login details" email is a near-certain sign of form relay. None of the five sites is compromised, so we don't name them.

5Callback lures nearly stopped

No. 1 had seven callback lures, Norton renewals and Robinhood sign-in alerts. None arrived between 16 September and 27 October. Then two: a $441.35 Geek Squad "auto-debit" invoice sent from a university's hijacked mailbox, which failed DMARC, and a $130.99 Microsoft 365 renewal sent from a Gmail account. Neither carried a link. The numbers to call are the only indicators, so they are listed below.

Since No. 1

The two issues cover different lengths of time (30 and 37 days), so compare rates and shares, not totals.

Seen in both issues: six storage buckets and three sending addresses, marked in the indicator lists below. None of the domains or callback numbers listed in No. 1 came back.

The issue in numbers

52% passed DMARC, 2% failed it, and 47% got no DMARC result at all. 12% set a Reply-To address on a different domain from the sender. About two-thirds of the lures that carried a link pointed it at a legitimate platform: Google Cloud Storage (26), Telegraph (3), Cloudflare Pages (2), Microsoft Forms (1), Amazon S3 (1), plus one link shortener. One message, a credit-card offer, carried a real file, a PDF of about 12 KB that we did not open. A life-insurance lure carried the same empty decoy "PDFs" as in No. 1.

Indicators

Defanged, and taken only from mail judged malicious. Relay websites, the hijacked mailboxes of a ministry, a university and two companies, the platform accounts that carried lures, and Google's and Amazon's own mail servers are deliberately left out: they belong to victims or to shared infrastructure, not to attackers.

Download: CSV · STIX 2.1 bundle (not defanged, for direct import into your tools; released as TLP:CLEAR, free to use)

Detection patterns

storage\.googleapis\.com/[^/]+/[^/]+\.html\?act=cl&.*cid=422302
storage\.googleapis\.com/[^/]+/[^/]+\.html#/.*(1626b9s|2e\.31\.36\.32\.36\.62\.39\.73)

Method and limits

The trap is the same: the spam folder of one long-lived personal inbox, read without modifying it. Each message is broken down into headers, the receiving server's authentication verdicts, every link and every attachment. Nothing is visited or opened. The recipient's name and address are removed before anything is stored. A model labels each message; for this issue every one of the 252 was then reviewed by hand, the malicious ones message by message, the marketing by sender, subject and links, and the misfiled legitimate mail only counted. The review changed two labels, both in one campaign (below), and found no lure hiding among the marketing.

One campaign was labelled two ways. The broker's fake "direct deposit" leads to an online casino, and we count all five here as scams. No. 1 counted one of its three as credential phishing. Moving it would change No. 1's credential-phishing share from 22% to 20% and its scam share from 64% to 66%. No headline or finding there depends on it.

This is still a sample of one personal inbox, so read it as a snapshot, not a trend. No. 1 said the next issues would add trap addresses on a business domain. That hasn't happened yet: this issue is the same single inbox, and it leans the same way, towards consumer scams. Percentages here describe this trap and nothing wider.