What is the best way to investigate a phishing campaign across domains?

How do you trace a phishing campaign across domains without losing the thread?

Start by treating each domain as one possible node in a larger delivery chain, not as an isolated site. The useful work is to connect email evidence, DNS records, hosting patterns, redirect behaviour, and page assets into a single timeline, then decide whether the domains share infrastructure, registration signals, or reused kits.

That approach matters because phishing campaigns often split across many domains to evade blocks. A single URL may be disposable, but the infrastructure behind it, certificates, nameservers, analytics tags, reused images, and page code often exposes the campaign family.

What signals help you cluster related domains?

Look for shared registration data, but do not overtrust whois alone because privacy services and resellers can hide obvious linkage. Stronger grouping usually comes from combined signals: identical redirect chains, the same hosting ASNs or IP ranges, common TLS certificate patterns, repeated favicon hashes, matching page templates, and identical form endpoints or brand impersonation assets.

When the page content is copied and rehosted, compare HTML structure, script references, image paths, and parameter names. If the campaign uses lookalike domains or path-based lures, the surrounding infrastructure still tends to repeat enough patterns to support clustering.

Certificate and DNS review is especially valuable when the adversary rotates domains quickly. Monitoring Certificate Transparency Guide helps you spot newly issued certificates that align with the phishing brand, while DNS history can reveal fast-flux behaviour, hidden pivots, or a shared resolver and hosting footprint.

How should the evidence be turned into actionable response?

Build the case in a way that supports both immediate disruption and later enrichment. Preserve raw headers, DNS answers, screenshots, HTML sources, certificate details, and timestamps before you block or sinkhole anything. Then pivot from one confirmed indicator to the next, so you can map the campaign graph, separate one-off noise from repeated infrastructure, and hand defenders a defensible set of indicators rather than a single URL list.

That same graph should feed multiple response paths. Mailbox and web filters can block related domains and sender infrastructure, SOC analysts can hunt for follow-on clicks or credential use, and abuse teams can submit takedown requests with evidence that shows common ownership or reuse rather than isolated abuse reports.

Use the Phishing Guide as a broader reference for campaign patterns such as lookalike domains, HTML and SVG smuggling, and layered detection, then apply those patterns to the domains you uncover in the investigation.

Risk and Threat Considerations

Phishing across domains is designed to fragment the defender's view. If you investigate each domain separately, you can miss the shared infrastructure that enables persistence, re-registration, and rapid relaunch after takedown. The bigger risk is not just one malicious domain, but the campaign's ability to regenerate from the same operational playbook.

Failure mechanism: Attackers reuse certificates, templates, redirectors, and hosting patterns while swapping domain names, which breaks single-point blocking and makes isolated triage look complete when it is not.

Impact: Incomplete clustering leads to missed sibling domains, delayed containment, and weaker takedown evidence, while the campaign continues delivering lures from adjacent infrastructure.

Practitioner Guidance

What to verify: Confirm that each domain you cluster shares at least one durable signal, such as certificate overlap, redirect behaviour, or page asset reuse, before you label it part of the same campaign. A shared brand name alone is not enough for response decisions.

Implementation sequence: Start with the original email and URL, then move outward through DNS, certificates, hosting, and web content. Only after that should you widen to registration patterns and adjacent domains, because early overexpansion creates noisy clusters that are hard to defend operationally.

Practitioner takeaway: The best investigation method is evidence chaining, not URL counting, because durable infrastructure signals are what let you prove campaign reuse and drive blocking, hunting, and takedown with confidence.

Related resources from NHI Mgmt Group

• What is the best way to reduce brand abuse across domains and hosting?
• What is the best way to block phishing domains before users connect?
• What are the best practices for limiting the damage from a successful phishing campaign?
• What are the signs that a phishing campaign is using the same actor infrastructure across different lure themes?