Typosquatted domain with a fake login page
Shortly after appearing in certificate transparency logs, the freshly registered domain began serving a copy of the organisation's login page that posted credentials to a third-party server.
3 modules
Critical
Example scenario
Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on a Telegram channel.
- Case no
- IG-UC-2026-001
- Threat
- A session cookie and password for the corporate VPN appeared for sale in an infostealer log.
- Sectors
- Banking & finance, E-commerce, Telecommunications
- Roles
- CISO, SOC Analyst
- Outcome
- Password reset and session revocation within the first hours of publication.
The InsightGuard approach
InsightGuard matched the URL in the log to the organisation's VPN domain and classified the record as 'employee'. The entity graph attached the other records exfiltrated from the same device to one case and flagged the session cookie as still valid.
Timeline
Situation → Outcome
-
Personal device infected
The employee signs in to the VPN portal from a non-corporate machine on which an infostealer had already run.
-
The log enters a bulk package
The record is shared on a Telegram channel as part of a 12,000-line stealer log package.
-
Domain match
InsightGuard parses the package; the vpn.<org>.com.tr line matches a monitored asset and a critical-severity case is opened.
-
Session revocation
The SOC team takes the case, the password is reset and the cookie is invalidated. IOCs are pushed to the SIEM.
-
Closure
The case closes with the affected account scope and device quarantine note. A watch rule is left for further records from the same device.
Related files
Third-party risk through a supplier breach
The supplier's customer portal was leaked. The published dataset included API keys, webhook URLs and technical contact emails.
3 modules
Exposed admin panel on a forgotten subdomain
A subdomain left running after a marketing campaign ended stayed up on an outdated CMS version, with its panel exposed to the internet.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.