Executive Summary
- Roughly 2,700 malicious URLs enforced over one quarter against a single global consumer software brand. Not one sat on a domain the attackers registered.
- 2,541 were Blogspot pages posing as technical support, with the remainder published on Webflow and WordPress.com.
- No malware, and no credential form anywhere. Each page existed to make a toll-free number look official, which moved the fraud onto a phone call.
- Blogger mirrors one post across 67 country-code variants, averaging 74 separately reportable URLs for every page an operator actually published.
- Deduplicated, 2,194 URLs collapse to 116 distinct assets, and Webflow overtakes Blogger as the largest platform in the campaign.
- By April we had cleared 85% of the enforced Blogspot URLs, with 326 still live.
Key Findings
- The attackers never acquired anything. No registration, no hosting to stand up, and no certificate to issue. Every signal registration-based monitoring watches for assumes the adversary had to buy something first. These operators inherited the platform’s reputation on day one and published at whatever volume it allowed.
- The page that catches victims doesn’t steal anything. There’s no harvesting form and no payload, nothing to score as malicious. The conversion point is a phone number styled as a helpline, which means the theft happens in a live conversation that no security control is positioned to observe.
- The asymmetry is structural. Publishing costs one action. Enforcement costs one evidence package per URL, per submission, per follow-up. The defender’s workload scales with platform architecture while the attacker’s stays flat.
- URL volume describes the platform, not the adversary. Counting addresses makes Blogger the entire problem and Webflow a rounding error. Counting published pages inverts that, which is a different threat picture and a different set of priorities.
- Enforcement submitted is not enforcement completed. 326 URLs remained live at the end of the quarter against a backlog that refills weekly. Median time to mitigation is a more honest measure of a program than takedown count, and it’s the one that shows where the queue actually stalls.
- Nothing malfunctioned, which is the uncomfortable part. Domain monitoring didn’t miss these pages. It was never handed an event to detect, and that’s a different problem from a false negative. Tuning the same signals harder doesn’t solve it.
The Investigation
Most impersonation work starts with a domain. Somebody registers something a character off from a customer’s name, parks it on hosting with no reputation to lose, and the job is to get it down before enough people find it. That shape is consistent enough that plenty of external threat programs are built entirely around catching it.
The campaign I want to walk through never produced one. Between January and April of 2026, Bolster AI enforced takedowns on roughly 2,700 malicious URLs impersonating a single global consumer software brand. They targeted paying subscribers rather than employees, and they converted victims through a phone call instead of a credential form.
Not one of those URLs sat on a domain the attackers registered. The overwhelming majority were Blogspot pages posing as technical support, with a smaller set published on Webflow and WordPress.com. If your program is organized around watching for lookalike domains, this quarter would have been invisible to you. That’s the first problem. The second surfaced later, once we started grouping the URLs by what actually sat behind them, and it has the wider implications of the two.
What the Pages Did
The pages followed a consistent template, and the consistency held across the entire quarter, which by itself says something about how little pressure these operators were under to change anything. Each one presented itself as an official technical support resource for the impersonated brand, complete with logo, product imagery, and reassuring copy about installation help, virus removal, and subscription troubleshooting. Every one pushed toward the same conversion point: a toll-free support number, repeated three or four times, styled as a helpline.
There’s no malware on these pages, and no credential harvesting form. The page exists to make a phone number feel legitimate. That is the entire function.
Over the quarter we enforced 2,541 Blogspot URLs. By April, 2,172 were confirmed removed and 326 remained live in the open bucket.
Why 2,541 Isn’t 2,541
The enforced URLs didn’t cluster on blogspot.com. They spread across 67 country-code variants of the Blogspot domain, including blogspot.cz, blogspot.cl, blogspot.co.nz, blogspot.si, and blogspot.com.cy, every one registered to Google through MarkMonitor between 2007 and 2012.
None of that is attacker infrastructure. It’s a legacy of how Blogger localized content, serving the same blog under a reader’s regional Blogspot domain. A scammer publishes one post, the platform mirrors it across the full ccTLD set, and our crawlers, the brand’s customers, and search engines all encounter it as dozens of separate, individually reportable URLs. Across the quarter, 1,997 enforced URLs traced back to 27 underlying posts, an average of 74 reportable addresses for every page an operator actually published.
That distorts the economics in a way worth being precise about. Publishing costs the operator one action. Enforcement costs us one evidence package per URL, per submission, per follow-up, which means a single blog post can generate seventy or more takedown requests. The defender’s workload scales with platform architecture while the attacker’s stays flat, and anyone working that queue manually is losing the trade badly.
It also breaks URL volume as a measure of adversary scale, and the full quarter makes the point harder than the Blogspot numbers alone. Cluster 2,194 enforced URLs by the content behind them and you’re left with 116 distinct published assets, a 94.7% reduction. More useful than the reduction is what it does to the ranking. Blogger accounts for 91% of the URLs and 23% of the assets. Webflow accounts for 5.6% of the URLs and 53% of the assets, which makes it the largest platform in the campaign once you stop counting addresses. A quarterly report built on URL volume would have shown Webflow as a rounding error and Blogger as the entire problem. Neither is true.
What follows is that the unit of enforcement should be the asset rather than the address. Removing the underlying post kills every mirror simultaneously, while chasing the mirrors one at a time is how backlogs form. Detection that fingerprints content, layout, and callback number rather than hostname collapses the list before enforcement ever starts, which is the logic behind Bolster AI’s patented detection approach.
The free-hosting pattern isn’t unique to Blogger, though the multiplication effect largely is. Webflow averaged 2.0 URLs per published page and WordPress.com 2.8, against Blogger’s 74. Same absence of a registration event, same inherited reputation, and a fraction of the address inflation. What generalizes is the acquisition problem rather than the arithmetic.
What Happens After the Call
The theft in this campaign lands somewhere no security tool is watching, and it’s worth walking through slowly for that reason.
The victim finds the page, usually while looking for help with a product they already pay for. Everything on it reinforces the impression that they’ve reached the vendor: the logo is right, the product imagery is right, and the copy speaks to the problem they came in with. Then they dial the number, which is the only thing the page ever asked them to do.
From there the fraud is a conversation. A scripted “technician” answers, establishes a problem worth solving, and walks the caller through installing remote access software so it can be diagnosed. Payment details come out at the end, framed as a subscription correction, a refund that needs processing, or a service fee.
Nothing in that sequence produces the artifacts detection is built to find. No credentials crossed the wire, nothing executed, and the page that started it was served by a trusted platform with nothing on it that would fail a scan. For the brand, the first evidence any of it happened is usually a customer complaint.
Why Domain Monitoring Can’t See This
Registration-based detection works by watching for events: a new domain appears, a certificate gets issued, DNS records resolve somewhere new. Every one of those signals assumes the attacker had to acquire something.
Free hosting removes the acquisition step entirely. There’s nothing registered to catch, no certificate to watch, and no reputation penalty to accrue. The scammer inherits the platform’s trust on day one and publishes at whatever volume the platform allows.
Worth being clear about what that means, because it isn’t a miss in the ordinary sense. Nothing in the detection stack malfunctioned over these three months. It was never handed an event to detect, and tuning the same signals harder would not have surfaced a single one of these URLs. That’s why phishing and scam protection built primarily around domain signals will systematically undercount campaigns like this one. The threat isn’t that attackers found a clever bypass. It’s that they never triggered the logic in the first place.
Enforcement Is the Slow Part
At the end of the quarter, 326 Blogspot URLs remained enforced but not yet remediated, an 85% clearance rate against a backlog that refills every week.
Platform abuse channels weren’t built for volume of this kind. Each submission requires evidence packaging, each one sits in a queue, and new URLs surface continuously on top of what’s already pending. When the platform is also mirroring content across 67 hostnames, a single unresolved post can account for a meaningful slice of the open bucket on its own.
That dynamic isn’t a failure of the enforcement process. It’s the actual economics of the problem, and it’s why the useful measurement isn’t “did we take it down” but rather median time to mitigation, which hosting providers respond fastest, which abuse types stall, and how often the same content reappears after removal. Bolster AI’s automated takedown workflow exists to compress the first part, with human analysts handling the edge cases that automation shouldn’t decide on its own.
What Has to Change
The adjustment I’d argue for is less about adding tools than about changing what gets counted and what gets reported.
Deduplicate before you count. Group URLs by content fingerprint and callback number before anything reaches a dashboard, because the clustered number is the one that describes the problem, and it’s the one worth putting in front of an executive. In this dataset the clustered view didn’t just shrink the number, it changed which platform mattered most.
Watch platforms rather than perimeters. Free hosting, document sharing, and publishing tools are all delivery infrastructure now, and continuous monitoring of your brand’s appearance on third-party platforms catches what registration-based monitoring structurally cannot.
Treat the phone number as an indicator in its own right. Across hundreds of URLs it was the most stable artifact in the dataset, because domains rotate and copy gets reworded, but changing a callback number costs the operator real money.
Enforce upstream wherever the platform allows it, since one accepted request against the underlying post is worth seventy against its reflections. And measure the backlog honestly, because reporting that stops at the first number will tell you the problem is solved while a meaningful share of the campaign is still live. Building that visibility in from the start is what separates a real digital risk protection program from an alert feed.
The attackers in this dataset bought nothing at all. They published once, let the platform multiply the footprint for them, and waited for the phone to ring.
Your customers weren’t looking at a domain. They were looking for help, and what they found was a page that gave them a number to call.
To see how Bolster AI handles domain monitoring and takedowns alongside the platform surfaces that domain monitoring alone will never reach, request a demo.
