Employee credentials in a stealer log
An infostealer on an employee's personal device exfiltrated credentials and an active session cookie for the corporate VPN portal. The record surfaced inside a bulk sale package on …
4 modules
High
Example scenario
Typosquatted domain with a fake login page
Shortly after appearing in certificate transparency logs, the freshly registered domain began serving a copy of the organisation's login page that posted credentials to a third-party server.
- Case no
- IG-UC-2026-002
- Threat
- A one-character variation of the corporate domain was registered and served a pixel-perfect copy of the login page.
- Sectors
- Banking & finance, E-commerce
- Roles
- SOC Analyst, Brand / Legal
- Outcome
- A takedown request was filed the same day the page went live.
The InsightGuard approach
InsightGuard continuously watches homoglyph and keyboard-adjacency variations. The domain was detected the moment it obtained a certificate; the page was visually compared to the real one and impersonation confirmed.
Timeline
Situation → Outcome
-
Domain registered
A one-character variation of the corporate domain is bought from a registrar.
-
Certificate and publication
A free certificate is issued and a copy of the login page goes live.
-
CT log match
The new certificate transparency entry matches the variation list and a screenshot is captured.
-
Takedown and blocking
Requests go to the registrar and host; the domain is blocked in internal DNS and mail filtering.
-
Monitoring continues
The case stays open until the domain is suspended. How long that takes depends on the registrar and host; meanwhile the domain stays blocked internally and new look-alike registrations attach to the same case.
Related files
Third-party risk through a supplier breach
The supplier's customer portal was leaked. The published dataset included API keys, webhook URLs and technical contact emails.
3 modules
Exposed admin panel on a forgotten subdomain
A subdomain left running after a marketing campaign ended stayed up on an outdated CMS version, with its panel exposed to the internet.
3 modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.