Fictional example · operation mapping is on the Enterprise plan
OP-2291: Acme payroll sign-in impersonation
One operation, traced from a single phishing domain to the hosting and certificate behind it,
with related social and app findings and the takedown status for each. It illustrates what our
team can assemble for Enterprise customers; there is no self-serve operation report yet.
Every name here is made up: the brand is a fictional “Acme”,
domains use the reserved .example name, and addresses come from documentation ranges.
Summary
Acme, a fictional payroll customer, was targeted by a credential-phishing operation built around a spoofed payroll sign-in page. Fourteen phishing domains appeared over eight days. They share two hosting networks and, for the first nine, one TLS certificate, which is what tied them into a single operation rather than fourteen separate alerts. An HR-support impersonation account and a copycat “Acme Pay” app on the Apple App Store were found at the same time and are reviewed alongside it; they are not part of the domain grouping.
At the time of this report, 8 of 14 domains have been taken down, 4 are submitted and awaiting a registrar response and 2 are to approve. 6 domains are still live.
Timeline
- Day 0 First phishing domain seen
A phishing domain imitating Acme's payroll sign-in page turns up in phishing intelligence and is matched to Acme.
- Day 1–2 Cluster grouped
Eight more phishing domains appear on the same hosting network and present the same TLS certificate. They are grouped into one operation, OP-2291, by the infrastructure they share.
- Day 3–4 Operation widens
A second hosting network comes online with three more domains. An HR-support impersonation account and a copycat “Acme Pay” app also turn up and are reviewed alongside the operation; they are not part of the domain grouping.
- Day 4 Takedowns requested
Evidence packages go to the registrars and hosting providers for the domains found so far; the impersonation account and the copycat app are drafted with evidence, ready to file with each platform. Later domains are added for approval as they appear.
- Day 5–8 First takedowns
Eight domains are taken down, starting with the original hosting network.
- Day 9 Report assembled
Four domain takedowns are submitted and awaiting a registrar response, and two are to approve. The impersonation account and copycat app cases remain open.
Linked indicators
14 phishing domains. “Day” counts from first sighting. All names are fictional.
| Domain | Seen | Hosting | Address | Shared cert | Takedown |
|---|---|---|---|---|---|
acme-payroll-login.example | Day 0 | Network A | 192.0.2.14 | Yes | Taken down |
acme-payrol1.example | Day 1 | Network A | 192.0.2.14 | Yes | Taken down |
acmepayroll-portal.example | Day 1 | Network A | 192.0.2.21 | Yes | Taken down |
login-acme-hr.example | Day 1 | Network A | 192.0.2.21 | Yes | Taken down |
acme-hr-support.example | Day 1 | Network A | 192.0.2.33 | Yes | Taken down |
my-acmepay.example | Day 1 | Network A | 192.0.2.33 | Yes | Taken down |
acme-benefits-portal.example | Day 2 | Network A | 192.0.2.47 | Yes | Taken down |
acme-timesheets.example | Day 2 | Network A | 192.0.2.47 | Yes | Taken down |
secure-acme-pay.example | Day 2 | Network A | 192.0.2.52 | Yes | Submitted |
acme-payroll-update.example | Day 3 | Network B | 198.51.100.8 | No | Submitted |
acmepay-verify.example | Day 3 | Network B | 198.51.100.8 | No | Submitted |
acme-employee-id.example | Day 4 | Network B | 198.51.100.19 | No | Submitted |
acme-payslips.example | Day 6 | Network B | 198.51.100.19 | No | To approve |
acme-direct-deposit.example | Day 8 | Network B | 203.0.113.40 | No | To approve |
Hosting
| Operator (fictional) | Domains | Note |
|---|---|---|
| Example Hosting Network A | 9 | Original infrastructure; most domains taken down. |
| Example Hosting Network B | 5 | Second wave; later domains. |
Shared TLS certificate
Nine domains on Example Hosting Network A present the same certificate, serial 4F:2A:91:C7:0B:3E:D8:65 (fictional), issued by
“Example Certificate Authority”. A shared serial across unrelated-looking domains is strong
evidence of one operator, and it is what lets the operation be grouped before every domain is found.
Other surfaces
@acme_hr_support (example handle). The handle closely matches Acme's name. It is reviewed alongside the operation and is not linked to its domains.
“Acme Pay” on the Apple App Store. Uses Acme's name; the publisher is unrelated to Acme.
Takedown status
| Surface | Target | Status |
|---|---|---|
| Phishing domains | Registrars and hosting providers | 8 taken down · 4 submitted · 2 to approve |
| Impersonation account | @acme_hr_support (example handle) | To approve · drafted with evidence |
| Copycat app | “Acme Pay” on the Apple App Store | To approve · drafted with evidence |
Recommended actions
- Block the 14 domains and their addresses
Add the indicators below to your mail, web and DNS filters now; don't wait for the takedowns to complete.
- Warn payroll and HR staff
The lures impersonate payroll sign-in, payslips and direct-deposit changes. A short reminder to use bookmarked links only is enough.
- Move Acme's DMARC policy past “none”
Acme's own domain publishes DMARC at p=none, so spoofed mail from it is delivered. Step up to quarantine, then reject, once reports look clean.
- Report the copycat app to the store and tell your mobile team
Tell customers and staff that the only official Acme Pay app is the one listed on your site.
- Keep watching for re-registration
Operations like this tend to return on new names. Monitoring stays on Acme's name, and new phishing domains on the same hosting or certificate join this operation.
Fictional example · operation mapping is on the Enterprise plan. See how we count the numbers on our homepage.
See what is aimed at your brand
Run the free scan, or book a walk-through of a report built from your own data.