Domain Registration and Lookalike Domains Enabling Large-Scale Phishing and Fraud

A senior U.S. Secret Service official warned that weaknesses in the internet’s domain registration and governance model are being actively exploited to scale phishing and fraud, citing the ease with which attackers can register deceptive, brand-imitating domains and then force defenders into reactive, court-driven takedowns. The official argued that insufficient identity validation in domain registration and abuse concentration in certain networks (e.g., via ASNs) represent systemic gaps that enable business email compromise and link-based phishing campaigns across SMS and email.

Threat intelligence reporting on Canada-linked fraud activity illustrates how these domain-registration weaknesses translate into operational campaigns: attackers are using lookalike domains, SMS lures, and paid ads to drive victims to convincing fake portals impersonating PayBC, ServiceOntario, Canada Post, CRA, and Air Canada to steal credentials and payment data. CloudSEK attributed much of the activity to the “PayTool” phishing ecosystem, describing reusable phishing kits and shared infrastructure that can be rapidly rebranded and expanded from provincial payment portals into broader “Government of Canada” themed entry points. Separate coverage of Anguilla’s .ai domain boom is primarily economic/industry-focused and does not provide substantive security reporting tied to the phishing and domain-abuse problem described above.