Spotting phishing campaigns hidden in unmonitored subdomains

Phishing remains one of the most persistent cyber threats facing Australian businesses and households. According to the Australian Cyber Security Centre, thousands of reports are filed every year, with email-borne fraud accounting for a large share of the financial damage recorded by Scamwatch across cities such as Sydney, Melbourne and Brisbane. While most users now recognise suspicious attachments from obvious impersonators, attackers have shifted toward trickier methods that borrow credibility from somewhere else entirely.

One increasingly common tactic is the abuse of subdomains belonging to legitimate but forgotten parent domains. The website looks authentic, the DNS infrastructure resolves correctly, yet nobody at the organisation is publishing new content or revoking unused records. Threat operators spot those gaps and quietly point abandoned hosts toward phishing kits designed to harvest credentials, MFA codes and banking details. Detecting this style of campaign demands a combination of DNS analysis, email authentication review and continuous domain reputation checks.

Why unmonitored domains become a phishing risk

Most organisations hold onto legacy domains acquired during mergers, marketing pushes or product launches and later forget about them. The site might be offline for years while the DNS zone stays live, leaving CNAME, A or NS records pointing to cloud services that attackers can claim through subdomain takeover techniques. When nobody is reviewing the zone, criminals register the orphaned resource and stand up a convincing clone of a login page.

In Australia, this risk grows with the spread of .com.au and .net.au registrations, where brand protection rules demand active use but enforcement depends on periodic audits. Smaller teams in Adelaide or Perth often have several microsites left over from past conferences that quietly become soft targets. A subdomain that once hosted a registration form may today serve a counterfeit Westpac or ANZ credential page, and few realise it until customers complain.

Common patterns in subdomain-based phishing

Look-alike branding is rarely the giveaway in these attacks because the domain itself is real. Instead, attackers manipulate what comes before the brand name, adding words such as secure-, login- or verify- to trusted subdomains, or stacking long chains like support.update.account.brand.example.com.au. On a phone screen, users focus on the right-hand segment and miss the rest of the chain.

HTTPS on freshly issued certificates no longer proves safety either. Phishers routinely obtain free SSL through automated services, so the padlock icon can appear within minutes. The hostname might resolve to a server located in a different jurisdiction, often outside Australia, while the email headers still claim to originate from the parent domain. Watching for unusual geographic hosting combined with new subdomain creation is a strong early indicator.

Tools and DNS records that reveal abuse

A practical defence starts with regular DNS hygiene work. Pulling every subdomain through certificate transparency logs exposes hosts that nobody remembers creating in the first place. Cross-referencing those entries against hosting ranges and historical WHOIS data highlights zones where the registrant has changed several times without any website content appearing.

Monitoring DMARC reports adds another layer, because spoofing attempts that piggyback on a trusted parent domain often leave traces in aggregate and forensic reports. Keeping a close eye on DMARC external reports reveals whether unknown IPs are sending mail under your branding. For administrators juggling many zones, an audit cycle that checks DNS, certificate and authentication posture together is far more effective than reviewing each system in isolation.

Cross-checking email logs with authentication reports

When a suspicious message reaches an inbox, defenders usually look at headers, but the mail server logs tell an even richer story. Matching DKIM signatures, SPF results and sending IPs against the legitimate infrastructure of the brand quickly reveals impersonation. If the same subdomain appears in both successful legitimate mail and a phishing sample, the campaign is almost certainly abusing an overlooked host.

A structured process helps, especially when staff turnover is high. Walking through a log cross-check process on a recurring basis catches anomalies that automated filters miss. For Australian entities operating under the Notifiable Data Breaches scheme, this kind of audit trail also strengthens compliance evidence if an incident ever needs to be reported to the Office of the Australian Information Commissioner.

Building developer workflows for continuous monitoring

Manual reviews do not scale once an organisation owns dozens of domains. Engineers benefit from small scripts that enumerate subdomains, resolve each one and check for unexpected banners, certificates or HTTP responses. Storing the results in version control turns the inventory into living documentation rather than a forgotten spreadsheet sitting on someone's laptop.

Security teams that want to verify trust signals programmatically can turn to trust verification tools and integrate reputation scores directly into ticketing platforms. A workflow that raises a ticket whenever a new subdomain appears, or when an existing one switches hosting providers, keeps the issue in front of the right people without waiting for a quarterly review.

Practical habits for Australian organisations and individuals

For businesses, the safest routine is to keep an accurate register of every domain owned, including subsidiaries and past campaign names, and review it at least twice a year in line with the Australian Privacy Principles. Revoking DNS records for retired products, or pointing them to a simple parked page, removes the easy wins that phishers rely on. Where a domain must remain live for legal or historical reasons, redirecting it to the main corporate site preserves brand presence while closing attack surfaces.

Individuals can help by treating any unexpected request for credentials, even one that appears to come from a familiar brand, as a potential trap. Hovering over links to inspect the full hostname, verifying the request through a separate channel, and reporting suspicious messages to the ACSC or Scamwatch all contribute to wider community defence. A culture of cautious verification is what eventually stops the quiet abuse of legitimate but unmonitored domains from paying off.