PhishNet
EU phishing intelligence
External threat exposure brief
05 June 2026 · passive OSINT
SAMPLE · NOT A REAL INSTITUTION
Prepared for Sample Bank · Belgium

Someone is building a copy of your bank.

Across three independent threat feeds, we are tracking a coordinated effort to impersonate your brand and harvest live customer credentials. This is the most impersonation activity we see against any Belgian bank in our sample set — by an order of magnitude.

428
live malicious assets impersonating the brand
11 high-severity · risk up to 88 · 3 independent feeds
Prepared for Sample Bank · BE-RETAIL-01
CISO · fraud · board
Indicators defanged · live as of 05 Jun 2026
Galactic Automation BV
PhishNet — EU-sovereign CTI
Zottegem, Belgium
The 60-second readout

If you read nothing else.

Five findings, in order of how much they should worry you. Every one is backed by defanged, independently verifiable evidence later in this brief.

Executive readoutSample Bank · Belgium
  1. You are the most-impersonated bank in the set — and it isn’t close. 428 live fakes, roughly 6× the next Belgian bank.
  2. This is targeted, not opportunistic. A credential-harvesting page runs on dedicated attacker infrastructure (203.0.113.70, risk 88) — stood up to target you, not a hijacked site.
  3. The fakes are industrialised. A single kit fingerprint links 30+ mobile-app and online-banking clones to one operator.
  4. The evidence would hold up. Every indicator is SHA-256 hashed and RFC 3161 timestamped — admissible to an auditor, insurer or court, not a screenshot.
  5. A snapshot is the floor, not the picture. New look-alikes register faster than they can be removed; only continuous monitoring closes the exposure window.
01

The lead: a bank that doesn’t exist

dedicated infrastructure

One of the 428 assets is not like the others. Most phishing reuses a hijacked website or a free host — cheap, disposable, gone in days. This one is different: a credential-harvesting page running on a fixed IP address stood up specifically to target your customers. It serves a pixel-accurate copy of your online-banking login, captures whatever a customer types, and relays it onward in real time. It is purpose-built infrastructure, and it scores 88 out of 100 on our risk model — the highest in this set.

Lead indicator · confirmed live
203.0.113.70/origin/onlinebanking/home1.php
Dedicated-IP credential capture · serving an online-banking login clone · first observed 5 Jun 2026 · source: phishdb
88
risk / 100
“This is not a hijacked website. It is a purpose-built replica of your bank, on infrastructure that exists for one reason: to take your customers’ passwords.”
PhishNet analysis · lead finding
02

Anatomy of the attack

lure → takeover

The clone is one piece of a chain. Here is how a single customer goes from an unremarkable text message to a drained account — and where the window to intervene actually is.

01LureSMS / emailto customerlow02Clonepixel-perfectlogin pagelow03Capturecredentialsenteredmed04RelayOTP phishedin real timehigh05Takeoveraccount drained/ resoldhighcustomer harm escalates left → right
How one impersonation asset converts into account takeover

The decisive interval is stages 01–02: once the lure is sent and the clone is live, intervention means removing the asset. Every hour it stays up is exposure. This is why time-to-takedown, not just detection, is the metric that matters.

03

The evidence

indicators defanged

Confirmed live assets, highest-risk first. The full IOC set — all 428 — is available to your SOC on request, in STIX 2.1 / MISP / CSV.

Malicious assetTypeSource / kitRiskObserved
203.0.113.70/origin/onlinebanking/home1.php
dedicated IP infrastructure · credential capture
IP / URLphishdb885 Jun 2026
be-retail01-login[.]example/internetbanking
fake online-banking login
URLphishdb815 Jun 2026
app-be-retail01[.]example / be-retail01-app-login[.]example
mobile app clones ×2 (shared kit)
URL ×2krogza795 Jun 2026
sms-be-retail01[.]invalid
smishing lure infrastructure
domainphishdb725 Jun 2026
+ 424 further assets impersonating the brandphishdb 312 · krogza 98 · phishdestroy 18 — full IOC set available on requestfull
04

The operator behind it

one kit, many storefronts

These are not 428 unrelated incidents. A shared kit fingerprint — the same reused code and assets — links the high-severity clones back to a single operator running infrastructure at scale. Treating each domain as a one-off misses the point: take down one storefront and the operator opens another.

OPERATOR1 kit fingerprint203.0.113.70 · dedicated IP198.51.100.0/24 · host blockbe-retail01-app-login[.]exampleapp-be-retail01[.]examplelogin-be-retail01[.]examplebe-retail01-secure[.]invalid+ 30 further clones (same kit)
One operator → dedicated hosts → 30+ brand clones

Shared kit

41%

of high-severity clones trace to one fingerprint.

Dedicated infra

2

attacker-owned host clusters, not hijacked sites.

Clone storefronts

30+

live domains from the same operator.

05

The sector reckoning

Belgian banks · same method

The same passive method, applied identically across the Belgian banking sector, puts the scale in context. Being the market leader and being the primary target turn out to be the same thing.

Sample Bank428
Bank B71
Bank C33
Bank D12
Bank E0
428 live assets — roughly six times the next Belgian bank, and more than the rest of the sector combined. At this volume, monitoring is not a project. It is a control.
Point-in-time counts · public threat feeds · 5 Jun 2026
06

Why this evidence holds

audit → court-grade

Most threat intelligence is a screenshot and a claim. Ours is a record. Every finding in this brief carries its full chain of custody — captured from an EU source, SHA-256 hashed, and (where required) sealed with a qualified RFC 3161 timestamp. That is the difference between “we saw it” and evidence an auditor, insurer or court will accept.

Capture01EU sourceHash02SHA-256Timestamp03RFC 3161Export04court-grade
Every indicator: captured, hashed, timestamped, exportable

DORA

ICT third-party & incident evidence, ready for the resilience file.

NIS2

threat context that survives reporting and supervisory review.

eIDAS

qualified timestamps give findings evidentiary weight.

07

What a snapshot can’t show you

This brief is a single point in time. It cannot show you the look-alike registered tomorrow, the credential set leaked next week, or the takedown that should already be in flight. Continuous monitoring is what turns a striking snapshot into a closed exposure window.

Real-time alerting on new kits & domains
Look-alike / typosquat registration watch
Takedown support & registrar abuse reports
Full domain estate & sub-brand coverage
Exposed / leaked credential monitoring
Reporting dashboard & IOC export to your SOC
How we know this. PhishNet passively aggregates public threat-intelligence feeds (openphish, phishdestroy, threatfox, phishdb, krogza and others), normalises and de-duplicates the signal, scores each asset for risk, and preserves the source trail. No intrusive testing is performed against your systems and no personal data is processed; collection is GDPR-aligned and EU-resident end to end. Every figure in this brief is independently verifiable from the indicators provided.

20 minutes. I’ll hand your SOC every live indicator.

This brief is a passive-OSINT snapshot. On a call I’ll walk through each indicator, show the evidence behind the risk scores, and explain how PhishNet keeps the brand monitored — EU-sovereign, self-hosted, no data leaving the EU.

Direct contact
stijn@galacticautomation.com
galacticautomation.com · phishnet.be
Stijn Van HijfteGalactic Automation BV · Zottegem, Belgium — Founder, PhishNet (EU-sovereign CTI)
CISSP · CRISC · IAAP Data Protection Fellow
Method. Passive aggregation of public threat-intelligence feeds (openphish, phishdestroy, threatfox, phishdb, krogza & others). No intrusive testing, no personal data processed, GDPR-aligned. Every asset SHA-256 hashed and timestamped on capture; indicators defanged.
SAMPLE flagship brief. “Sample Bank”, all comparison banks, indicators, IPs (RFC 5737 TEST-NET) and domains (.example / .invalid) are illustrative and do not represent a real institution or live threat. The flagship brief is normally prepared for a single named institution as an unsolicited security courtesy. Risk scores are PhishNet assessments derived from public feeds; indicators are independently verifiable.