Check Point finds phishing network hiding live lures behind 404 root pages across 10,187 domains
Check Point researchers tied 10,187 domains in one September window to a phishing network whose root pages return 404 while lures sit on hidden paths. A root-page check can clear a live site when the full URL arrives by SMS, email or WhatsApp.
The Watch · Security desk
Share: 322 candidate IP addresses out of approximately 19,000 initial results, narrowed by combining GoFrame HTTP Server characteristics, Caddy, response behavior and other signals.
- Candidate IPs of initial results, claim 4 322 of 19,000 results, approximately 1.7% computed
Candidate IPs of initial results The whole
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Candidate IPs of initial results | 322 results, approximately | 19,000 results, approximately | 1.7% (computed) | 4 |
What happened
- Lures sat in regional directories: an Italian-themed domain served its phishing content through /it and German-themed infrastructure used /de, while the root returned an error page.
- A later snapshot contained 5,785 domains, a drop Check Point describes as significant infrastructure churn.
- In 500 domains from the cluster, researchers saw banking, government, transport, postal and rewards themes across Southeast Asia, Europe, Latin America, Israel, Australia, Africa and Asia.
- In one case study, a rewards lure aimed at a Central American financial group showed 'Not Found' at the root and only revealed itself at /pa, behind a verification screen that issued a session token.
Why it matters
- Who's exposed exposure Any process that scores a domain from its root response can file a live phishing site as dead, and the complete URLs may only reach targets through private channels.
- What it costs cost Blocking domain by domain means chasing a list that fell from 10,187 to 5,785 between counts. The 322 candidate IP addresses are a shorter list to watch.
- What it limits constraint Reproducing the hunt takes several correlated signals, not one header match. Check Point used server, response and behavior signals together to reach 322 addresses.
- What's now possible capability Brands and languages swap into a shared framework, so the operator can stand up a new regional lure without rebuilding the platform.
Root-page triage fails here by design. The network decides what to show from the path, the locale, the session and a token [2], so a fetch of the bare domain meets the one configuration built to look empty [1]. Check Point says full URLs may travel by SMS, email, WhatsApp and other private channels, and that without the complete URL, traditional domain inspection may reveal little [10]. In our view, a pipeline that scores a domain from its root response will file these sites as dead.
The fingerprint is where defenders get traction. Researchers paired an uncommon GoFrame HTTP Server and Caddy combination with response characteristics and recurring application behavior [14]. Those signals, with others, took roughly 19,000 initial results down to 322 candidate IP addresses [4], about 1.7 percent of the starting set [16]. We'd expect a hunt on a single header to return more noise than 322 addresses.
Rotation is the cost. One September collection window identified 10,187 associated domains [5], and 90 percent of them, roughly 9,170, fell in the highest malicious category [19]. A later snapshot contained 5,785 [6], which is 4,402 fewer than the September count [17]. A collection window and a snapshot are different measures, so we would not read the drop as a takedown count.
The campaigns differ in brand, language and region, yet Check Point found shared APIs, configuration schemas, localization frameworks and session controls across them [8]. The platform it examined supported at least 12 languages [18]. We think that points to a sustained platform with swappable themes. Check Point's summary does not attribute the network to a named actor, and everything above is Check Point's account of its own research.
What to watch
- Whether Check Point or other vendors publish the 322 IP addresses and the domain set as indicators defenders can load.
- Whether later counts fall below the 5,785-domain snapshot or rebound toward the 10,187 seen in September.
- Whether the GoFrame and Caddy pairing changes after publication, which would show the operators adapting to the fingerprint.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+10
- Incentives55
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Check Point Exposure Management researchers uncovered a large-scale, multi-region phishing infrastructure designed to conceal active campaigns behind seemingly inactive domains.
- [2]
The infrastructure uses regional paths, localization, session controls and token-gated access to determine when its phishing content appears.
- [3]
Root domains frequently return generic 404 or 'Not Found' pages while phishing content remains accessible through concealed paths and conditional routing.
- [4]
Researchers combined GoFrame HTTP Server characteristics, Caddy, response behavior and other signals to narrow approximately 19,000 initial results to 322 candidate IP addresses.
- [5]
One September collection window identified 10,187 associated domains, with 90% falling into the highest malicious category.
- [6]
A later snapshot contained 5,785 domains, which Check Point describes as significant infrastructure churn.
- [7]
In analysis of 500 domains from the cluster, researchers observed phishing themes across Southeast Asia, Europe, Latin America, Israel, Australia, Africa and Asia, covering banking, government services, transportation, postal services, rewards programs and other sectors.
- [8]
Check Point says the platform appears modular: shared APIs, configuration schemas, localization frameworks and session controls appeared across campaigns with different brands, languages and regions.
- [9]
An Italian-themed domain served its phishing content through /it, while German-themed infrastructure used /de; visiting the root domain could return an unremarkable error page.
- [10]
Full phishing URLs may be distributed through SMS, email, WhatsApp and other private channels; without the complete URL, traditional domain inspection may reveal little indication that a live phishing page exists.
- [11]
In a case study of a rewards-themed domain targeting customers of a Central American financial group, the root domain and one regional path returned 'Not Found', while the /pa path triggered a custom verification screen.
- [12]
The verification process generated a session token before redirecting the visitor into the phishing workflow.
- [13]
The platform supported numerous languages, including English, Spanish, French, German, Portuguese, Arabic, Hebrew, Japanese, Korean, Hindi, Russian and Chinese.
- [14]
An uncommon combination of GoFrame HTTP Server and Caddy, combined with response characteristics and recurring application behavior, provided a fingerprint for hunting related infrastructure.
- [15]
Different branding and languages can be swapped into a shared technical framework, allowing localized phishing experiences to be deployed across regions.
- [16]
322 candidate IP addresses is about 1.7% of the roughly 19,000 initial results.
- [17]
The later snapshot of 5,785 domains is 4,402 fewer than the 10,187 counted in the September window (about 43% fewer), though the two figures come from different measures.
- [18]
At least 12 languages are named for the platform.
- [19]
90% of 10,187 domains is roughly 9,170 domains in the highest malicious category.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- blog.checkpoint.comResearchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Threat Intelligence and Incident ResponseFollow
- Detection evasionFollow
- PhishingFollow