Domains of the Living Dead
Summary: Cisco Talos described "zombie domains" - legitimate domains compromised and repurposed for phishing - citing gfmqatar.com, registered October 16, 2014, which was serving Google-impersonating phishing content from its DNS server by Halloween 2014 and continued into 2015. In Talos's dataset, 31% of domains had served phishing hostnames for over three years, 58% showed first phishing activity within the past six months, and 36% published five or more phishing-related hostnames.
Key Takeaway: Attackers are borrowing the reputation of neglected domains - and in the flakyfolks.com case, likely stolen ztomy.com parking account credentials that could expose a whole portfolio of parked domains - so a clean domain history is no proof of safety when a phish lands in an inbox.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026