CTM360 Reports 11,000+ Domains in Global Government-Impersonation Campaign
Summary
CTM360’s GovTrap research identifies more than 11,000 domains impersonating government services. The campaign uses localized messages and fake portals to collect personal, login, and payment data for fraud and resale.
Key points
- CTM360 reports identifying more than 11,000 malicious domains impersonating government services across multiple regions and public-service sectors.
- Fake portals mimic government branding, language, workflows, and services including tax, licensing, vehicle registration, and fine payments.
- SMS, email, and social media messages use localized, urgent prompts about fines, deadlines, or refunds to direct people to the portals.
- The article says attackers rapidly rotate low-cost domains, replacing sites after takedowns.
- The portals solicit personal information, login credentials, and payment-card data; the article describes fraudulent charges, resale, and reuse of stolen data.
- The report describes data being stored on attacker-controlled servers or sent through scripts, email endpoints, and Telegram bots.
Article Details
- Publisher
- CTM360
- Scope
- Global government-impersonation campaigns targeting citizens through fraudulent public-service portals.
- Sample Size
- More than 11,000 malicious domains identified.
- Key Statistics
- CTM360 identified more than 11,000 malicious domains associated with government-impersonation campaigns.
- Recommendations
- Adopt a proactive, intelligence-driven approach rather than relying only on reactive takedowns.
- Continuously monitor domain activity, phishing infrastructure, and impersonation patterns.
- Assess visibility across the fraud lifecycle, including distribution channels, impersonation tactics, and monetization flows.
MITRE ATT&CK
T1056.003 · Web Portal CaptureFraudulent government portals prompt victims to submit login credentials and other sensitive information.T1566 · PhishingThe campaigns use phishing distributed through email, SMS, and social media.T1583.001 · DomainsThe report says attackers register disposable domains for fraudulent government portals.T1657 · Financial TheftThe report describes unauthorized charges and other financial exploitation using captured payment data.