Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

330 custom email domains, and what this tells us about how attackers build infrastructure for fake account creation

0
Medium
Published: Tue Nov 18 2025 (11/18/2025, 21:53:43 UTC)
Source: AlienVault OTX General

Description

A large-scale fake account creation campaign was detected involving tens of thousands of bot-driven registrations using 330 unique custom email domains created within a short timeframe. Attackers used a modified Chrome browser with anti-detection techniques such as canvas randomization to evade fingerprinting and detection. The use of numerous custom domains, which appeared legitimate and were not on public blocklists, complicated traditional anti-abuse defenses. This campaign highlights the limitations of static disposable domain lists and underscores the need for multi-layered defenses including behavioral analysis, proxy detection, fingerprinting, and email intelligence. The threat is medium severity due to the complexity of evasion and potential for abuse but does not involve direct exploitation or system compromise. European organizations with online services requiring account creation are at risk, especially those lacking advanced bot and fraud detection capabilities. Countries with high digital service adoption and significant online user bases are more likely to be targeted. Defenders should implement dynamic domain reputation systems, advanced browser fingerprinting, and continuous behavioral monitoring to mitigate this threat effectively.

AI-Powered Analysis

AILast updated: 11/18/2025, 22:16:41 UTC

Technical Analysis

This threat involves a sophisticated fake account creation campaign detected and blocked by security researchers. Attackers employed tens of thousands of bot-driven registration attempts using a modified Chrome browser equipped with anti-detection features such as canvas randomization, which alters browser fingerprinting signals to evade detection. A notable aspect of this campaign is the creation and use of 330 unique custom email domains registered over a short period (August 16 to September 8, 2025). These domains were specifically designed to bypass anti-abuse mechanisms that rely on static disposable or known malicious domain lists, as the domains appeared legitimate and were not listed on public blocklists. The campaign demonstrates how attackers build resilient infrastructure for fake account creation by combining domain registration strategies with advanced browser evasion techniques. The investigation emphasizes that relying solely on static domain blacklists is insufficient. Instead, a multi-layered defense approach is necessary, incorporating fingerprinting technologies to detect browser anomalies, behavioral analytics to identify suspicious registration patterns, proxy and VPN detection to spot anonymized traffic, and email intelligence to assess domain reputation dynamically. Although no direct exploitation or malware delivery is involved, the campaign poses significant risks by enabling large-scale fake account creation, which can facilitate fraud, spam, misinformation, and further attacks leveraging these accounts.

Potential Impact

For European organizations, especially those offering online services requiring user registration, this campaign poses a significant risk of large-scale fake account creation. Such fake accounts can be used to perpetrate fraud, manipulate online platforms, spread misinformation, or conduct further attacks such as credential stuffing or social engineering. The use of numerous custom domains that evade traditional blocklists makes detection and prevention more challenging, potentially increasing the volume of fraudulent activity. This can lead to reputational damage, increased operational costs for fraud management, and potential regulatory scrutiny under GDPR if personal data is mishandled or abused. Organizations with less mature bot detection and anti-fraud capabilities are particularly vulnerable. The campaign also stresses the importance of evolving defenses to address increasingly sophisticated evasion techniques. Failure to adapt may result in higher false negatives in abuse detection, undermining trust in digital services and impacting user experience.

Mitigation Recommendations

European organizations should adopt a multi-layered defense strategy beyond static domain blacklists. Implement dynamic domain reputation systems that analyze newly registered domains in real-time, including WHOIS data, registration patterns, and domain age. Deploy advanced browser fingerprinting techniques that detect anomalies such as canvas randomization and other anti-detection methods used by modified browsers. Incorporate behavioral analytics to monitor registration patterns, flagging rapid or repetitive sign-ups from similar IP ranges or device fingerprints. Use proxy and VPN detection tools to identify and block anonymized traffic commonly used by attackers. Integrate email intelligence services that assess the legitimacy of email domains dynamically rather than relying on static lists. Regularly update detection rules and machine learning models to adapt to evolving attacker tactics. Additionally, consider implementing multi-factor authentication and email verification challenges that are resistant to automation. Collaborate with threat intelligence providers to share indicators and stay informed about emerging fake account creation campaigns. Finally, ensure compliance with data protection regulations by monitoring and controlling account creation processes to prevent abuse.

Need more detailed analysis?Get Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://securityboulevard.com/2025/11/330-custom-email-domains-and-what-this-tells-us-about-how-attackers-build-infrastructure-for-fake-account-creation/"]
Adversary
null
Pulse Id
691ceae73fedb4c4eb5d0c5a
Threat Score
null

Indicators of Compromise

Domain

ValueDescriptionCopy
domainainchemails.store
domainalderstone.store
domainalevra.biz
domainalphacore.biz
domainaltaris.store
domainaltavero.store
domainalturabiz.biz
domainalturion.biz
domainalverton.store
domainanadolugroup.biz
domainankatech.biz
domainarventa.biz
domainashbournevale.store
domainashbury.store
domainasilnet.biz
domainastrego.biz
domainaurevix.store
domainaventrix.biz
domainaxenor.biz
domainaxenor.store
domainaxiora.biz
domainaxtongroup.store
domainbeyazyol.biz
domainbirikim.biz
domainbizfusion.biz
domainblackford.store
domainblockvia.store
domainblueledger.store
domainboldmark.biz
domainboldstep.biz
domainbraveey.store
domainbravento.biz
domainbriarcliff.store
domainbrightleap.biz
domainbrightora.biz
domainbrightweld.store
domainbriventa.biz
domainbrontiva.biz
domaincapitalpoint.biz
domaincertivia.store
domaincinchemails.store
domaincircuitra.store
domainclearhaven.biz
domaincloudence.store
domainclovira.biz
domainclyrion.biz
domainclyron.store
domainclyvera.biz
domaincodevia.store
domaincodezap.biz
domaincognira.store
domaincoltris.store
domaincorelnex.store
domaincoreviax.store
domaincorptora.store
domaincorvantis.store
domaincorvexis.store
domaincrafttide.store
domaincredaro.store
domaincredovia.store
domaincrestmore.store
domaincresventa.store
domaincrosvia.store
domaincrownvale.store
domaincryonix.biz
domaincyberlinq.store
domaindarlie.store
domaindataforgex.store
domaindatavero.store
domaindatiora.biz
domaindatiora.store
domaindigivesta.store
domaindomerra.store
domaindomivex.store
domaindorantis.biz
domaindoruktech.biz
domaindoverton.store
domaindravion.biz
domaindravorex.biz
domaindunleigh.store
domaindynetra.biz
domaineastminster.store
domaineinchemails.store
domaineldermore.store
domainelvora.biz
domainequinoxa.store
domaineryvon.biz
domainevertonic.store
domainevolventa.store
domainexovian.biz
domainfairbrooke.biz
domainfairmontic.store
domainfeltrion.biz
domainfelvora.biz
domainfervia.store
domainfinbiznet.biz
domainfinchemails.store
domainfintravo.store
domainfintrix.store
domainfirmalix.store
domainfirmantis.store
domainflowmark.biz
domainfuturenest.biz
domainfyntriva.biz
domainfyntrix.biz
domainfyrox.store
domainglaventa.biz
domainglobantis.biz
domainglobantis.store
domaingloventa.store
domaingranford.store
domaingranitec.store
domaingranitefield.biz
domaingravisio.store
domaingrenton.biz
domaingridlocke.store
domainhalberg.store
domainharlington.store
domainharperston.store
domainhedefler.biz
domainhexablend.store
domainhexora.biz
domainhexorvia.biz
domainhighlandic.store
domainhitcornika.biz
domainhukinge.store
domaininfranova.store
domainintervexa.store
domaininterviax.store
domainjinchemails.store
domainjukengi.store
domainjukinge.store
domainjuravia.store
domainkalegroup.biz
domainkendrix.biz
domainkensworth.store
domainkeyvora.biz
domainkiklume.store
domainkimderdiki.biz
domainkinchemails.store
domainkingshaven.store
domainkingsmere.store
domainkingsvale.store
domainklyptus.biz
domainklyvante.biz
domainklyvera.biz
domainkryvent.biz
domainkyntravo.biz
domainkyroa.store
domainkytrion.biz
domainkyvera.biz
domainlaryvo.biz
domainlegatora.store
domainlexindus.store
domainlinchemails.store
domainloomflow.store
domainlorix.store
domainlorvex.biz
domainloryvia.biz
domainlucivon.biz
domainluxtrion.biz
domainlyvantis.biz
domainmagnaris.store
domainmagnora.biz
domainmarketvibe.biz
domainmarketzap.biz
domainmaxrion.biz
domainmeriona.biz
domainmeriton.store
domainmillhaven.store
domainminchemails.store
domainmiravon.biz
domainmontcrest.store
domainmontorra.biz
domainmyntis.store
domainmyntivar.biz
domainmyntora.biz
domainmyronex.biz
domainneurovia.biz
domainnexabiz.biz
domainnexiron.biz
domainnexuswave.biz
domainnexverra.store
domainnorthcrest.store
domainnorthdale.store
domainnorthminster.store
domainnorthvale.biz
domainnovabiz.biz
domainnovizo.biz
domainnoxenta.biz
domainoakleigh.store
domainoakmere.store
domainoceansky.biz
domainolinge.store
domainolyvante.biz
domainomniglobe.store
domainomnilis.store
domainomnitor.biz
domainomnivera.biz
domainomvex.biz
domainomvex.store
domainomviora.biz
domainoptimobiz.biz
domainoptiron.biz
domainoptivex.biz
domainoptivex.store
domainoptivora.biz
domainorvelta.biz
domainorvenix.biz
domainoryvia.biz
domainovrix.store
domainoxio.store
domainoxirax.store
domainpeakfold.store
domainpeakpoint.biz
domainpinchemails.store
domainplenxor.biz
domainplorantis.biz
domainprimebiz.biz
domainprimetra.store
domainprimetrax.store
domainprionix.store
domainpryva.store
domainpryvista.biz
domainpyloria.biz
domainpylorix.biz
domainqenzor.biz
domainqeyra.store
domainqryvion.biz
domainravencrest.store
domainredmont.store
domainridgefield.store
domainridgehaven.store
domainridgepoint.biz
domainridgewell.store
domainrisepoint.biz
domainrisevibe.biz
domainrovexa.biz
domainsavorent.biz
domainservebiz.biz
domainshopease.biz
domainsilverbrook.store
domainsmartobiz.biz
domainsmartpeak.biz
domainsoftpeak.biz
domainsolidora.biz
domainsolvira.biz
domainstatora.store
domainstonewell.store
domainstrathmore.store
domainstratmore.store
domainstratovix.store
domainstravica.biz
domainstravion.biz
domainstrivaro.store
domainstrovian.biz
domainsummitline.biz
domainsummittrust.store
domainswifttrend.biz
domainsylvora.biz
domaintechbizgroup.biz
domaintechspire.biz
domaintechthrive.biz
domaintinchemails.store
domaintkilima.online
domaintopgoal.biz
domaintoptrust.biz
domaintorvantis.biz
domaintorvento.biz
domaintransico.store
domaintrelyon.biz
domaintrevia.biz
domaintrevox.store
domaintreya.store
domaintrivora.biz
domaintrovantis.biz
domaintruetrend.biz
domaintruevale.biz
domaintrustgate.biz
domaintrustovia.store
domaintrustvia.store
domaintulvora.biz
domainuinchemails.store
domainulyvora.biz
domainumutlar.biz
domainunitara.store
domainunitrex.store
domainunivesta.biz
domainurbanconsult.biz
domainurbanpeak.biz
domainurbantrade.biz
domainustravon.biz
domainvalentra.biz
domainvalorcrest.biz
domainvelantis.biz
domainveliona.biz
domainventaris.biz
domainveradix.store
domainveylor.biz
domainveyora.biz
domainvinchemails.store
domainvirtelon.store
domainvisionpartners.biz
domainvitalpath.biz
domainvoltrix.biz
domainwestbridge.store
domainwestgrove.store
domainwetherby.store
domainxerovian.biz
domainxonitra.biz
domainxyden.store
domainxyntra.store
domainyeniufuk.biz
domainyinchemails.store
domainzaferyolu.biz
domainzelixo.biz
domainzenithra.biz
domainzenqora.biz
domainzentivo.biz
domainzentrium.store
domainzerico.store
domainzerla.store
domainzerya.store
domainzonelush.store
domainzuhanga.store
domainzyntravo.biz
domainzyphobiz.biz
domainzyrantis.biz
domainzyricon.biz
domainzyvantis.biz

Threat ID: 691cecc0be2811888e44fead

Added to database: 11/18/2025, 10:01:36 PM

Last enriched: 11/18/2025, 10:16:41 PM

Last updated: 11/21/2025, 10:13:04 PM

Views: 22

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats