![Kb4Threatlabs's tweet photo. Many Brands, One Kit: How Shared Infrastructure Ties Together a Sprawling Phishing Campaign
KnowBe4 ThreatLabs is tracking an evolving phishing campaign that keeps changing its brand skin but never its underlying kit. In mid-September 2026, it started as cPanel mail-quota notifications, then pivoted to spoofed Microsoft and Dell delivery-failure alerts, and most recently to fake QuickBooks payment notices with the same structure, same click-tracking layer, new branding and copy every few days.
HOW IT WORKS:
The Lure: Each wave swaps the brand and pretends a mail-quota warning, a failed delivery, an unpaid invoice but reuses the same email template underneath.
The Link: Every lure’s call-to-action routes through a compromised domain dressed up as a marketing-platform click-tracking link (the CL0/ path resembles a Constant Contact–style tracking format), which then redirects to a parked domain or a hijacked site harvesting M365 credentials.
WHY IT MATTERS:
On the surface, these domains have nothing in common. Underneath, three signals tie them to the same operator:
Shared IP: send.smnambijabajo[.]com and cp.preparationguru[.]com both resolve to 209.94.57[.]48.
Shared Certificate History : preparationguru[.]com a domain with a TLS certificate history dating to 2018, since re-registered and repurposed shares certificates with five newly surfaced domains, tying all six to the same hosting account.
Naming Pattern: the click-tracking subdomains all follow the same convention — links, click, clicks, clickxs.
WHAT DEFENDERS SHOULD DO:
Block the shared IP and hunt your logs for subdomains matching links|click|clicks|clickxs. A shared certificate or IP is often the fastest way to burn an entire multi-brand operation in one move, instead of chasing each lure individually.
#Phishing #ThreatIntel #KnowBe4ThreatLabs #CyberSecurity #InfrastructureAnalysis #M365 #CredentialHarvesting #InfoSec](https://pbs.twimg.com/media/HTd1JifboAAvGLG.jpg)
![Kb4Threatlabs's tweet photo. Many Brands, One Kit: How Shared Infrastructure Ties Together a Sprawling Phishing Campaign
KnowBe4 ThreatLabs is tracking an evolving phishing campaign that keeps changing its brand skin but never its underlying kit. In mid-September 2026, it started as cPanel mail-quota notifications, then pivoted to spoofed Microsoft and Dell delivery-failure alerts, and most recently to fake QuickBooks payment notices with the same structure, same click-tracking layer, new branding and copy every few days.
HOW IT WORKS:
The Lure: Each wave swaps the brand and pretends a mail-quota warning, a failed delivery, an unpaid invoice but reuses the same email template underneath.
The Link: Every lure’s call-to-action routes through a compromised domain dressed up as a marketing-platform click-tracking link (the CL0/ path resembles a Constant Contact–style tracking format), which then redirects to a parked domain or a hijacked site harvesting M365 credentials.
WHY IT MATTERS:
On the surface, these domains have nothing in common. Underneath, three signals tie them to the same operator:
Shared IP: send.smnambijabajo[.]com and cp.preparationguru[.]com both resolve to 209.94.57[.]48.
Shared Certificate History : preparationguru[.]com a domain with a TLS certificate history dating to 2018, since re-registered and repurposed shares certificates with five newly surfaced domains, tying all six to the same hosting account.
Naming Pattern: the click-tracking subdomains all follow the same convention — links, click, clicks, clickxs.
WHAT DEFENDERS SHOULD DO:
Block the shared IP and hunt your logs for subdomains matching links|click|clicks|clickxs. A shared certificate or IP is often the fastest way to burn an entire multi-brand operation in one move, instead of chasing each lure individually.
#Phishing #ThreatIntel #KnowBe4ThreatLabs #CyberSecurity #InfrastructureAnalysis #M365 #CredentialHarvesting #InfoSec](https://pbs.twimg.com/media/HTd1HOFbcAACK3_.jpg)
Olivia
Online
KnowBe4
@KnowBe4
AI-powered since 2016. Market-leading since day one.
Joined October 2010
315 Following
16.1K Followers
11.1K Posts
To say 2026 has been a big year for us would be an understatement — it's been a HUGE year for us! And we're shouting it from the @Nasdaq Tower. 🗣️👏 https://t.co/mATywzJXrW
"It happened before they even emailed me—it was already done." 🤖⚡
See how the @CityDaytona instantly neutralize email threats across all mailboxes and keep their Risk Score at 3.3%. https://t.co/nL8cnjm03H
Episode 1 of Attempted Intelligence is officially LIVE! 🚨
What actually makes something an AI agent? What is shadow AI? And how do you avoid generating AI slop at work? Our AI experts break it all down in plain English. https://t.co/T6EIMwV2jO
The Rise of Legitimate-Service Phishing: 1 in 10 Phishing Emails Now Comes From a Platform You Trust https://t.co/42IP2SU2Cm
Who to follow
ISC2
@ISC2
An international nonprofit membership association focused on inspiring a safe and secure cyber world. Become an ISC2 Candidate today!
Synack Red Team 
@SynackRedTeam
The power behind the @Synack platform is an elite team of the world's top cybersecurity researchers. Our best are honored at https://t.co/6bEAyp7HWJ
SANS Offensive Operations
@SANSOffensive
More Offensive Than Ever
#PenTest | #PurpleTeam | #RedTeam | #ExploitDev
Training, Certification, and Research
Deepfake training has a blind spot 👀
Spotting a fake is easy when you know it's a test. Real attacks don't announce themselves.
Watch Perry Carpenter of KnowBe4 break it down, then tell us: what's the last fake that almost got you?
#deepfakes #infosec #solvewithVIA
Fresh threats require fresh training 🚀
Check out what went live in September! Elevate your security program with new modules on zero trust, AI ethics, MFA and insider threats, and more.
Preview the releases. ⬇️
https://t.co/WCJnekouie
See how @VaFarmBureau uses PhishER Plus to organize its “junk drawer” inbox and remove email threats across the organization. Learn more. https://t.co/Ocody7Z9W0
Our Q3 wins reflect: Our commitment to securing the whole workforce, upholding an excellent customer experience and dedication to our employees. https://t.co/bIgBSQ7eNM
Not the research labs. Not the news cycle. Just real people making AI work... at work. 💼
Attempted Intelligence—a weekly podcast hosted by Harlan Parrott & Matthew Duren—drops next week! Subscribe now. https://t.co/T6EIMwV2jO
@ErichKron Thanks for spreading the good word, Erich!
Many Brands, One Kit: How Shared Infrastructure Ties Together a Sprawling Phishing Campaign
KnowBe4 ThreatLabs is tracking an evolving phishing campaign that keeps changing its brand skin but never its underlying kit. In mid-September 2026, it started as cPanel mail-quota notifications, then pivoted to spoofed Microsoft and Dell delivery-failure alerts, and most recently to fake QuickBooks payment notices with the same structure, same click-tracking layer, new branding and copy every few days.
HOW IT WORKS:
The Lure: Each wave swaps the brand and pretends a mail-quota warning, a failed delivery, an unpaid invoice but reuses the same email template underneath.
The Link: Every lure’s call-to-action routes through a compromised domain dressed up as a marketing-platform click-tracking link (the CL0/ path resembles a Constant Contact–style tracking format), which then redirects to a parked domain or a hijacked site harvesting M365 credentials.
WHY IT MATTERS:
On the surface, these domains have nothing in common. Underneath, three signals tie them to the same operator:
Shared IP: send.smnambijabajo[.]com and cp.preparationguru[.]com both resolve to 209.94.57[.]48.
Shared Certificate History : preparationguru[.]com a domain with a TLS certificate history dating to 2018, since re-registered and repurposed shares certificates with five newly surfaced domains, tying all six to the same hosting account.
Naming Pattern: the click-tracking subdomains all follow the same convention — links, click, clicks, clickxs.
WHAT DEFENDERS SHOULD DO:
Block the shared IP and hunt your logs for subdomains matching links|click|clicks|clickxs. A shared certificate or IP is often the fastest way to burn an entire multi-brand operation in one move, instead of chasing each lure individually.
#Phishing #ThreatIntel #KnowBe4ThreatLabs #CyberSecurity #InfrastructureAnalysis #M365 #CredentialHarvesting #InfoSec
![Kb4Threatlabs's tweet photo. Many Brands, One Kit: How Shared Infrastructure Ties Together a Sprawling Phishing Campaign
KnowBe4 ThreatLabs is tracking an evolving phishing campaign that keeps changing its brand skin but never its underlying kit. In mid-September 2026, it started as cPanel mail-quota notifications, then pivoted to spoofed Microsoft and Dell delivery-failure alerts, and most recently to fake QuickBooks payment notices with the same structure, same click-tracking layer, new branding and copy every few days.
HOW IT WORKS:
The Lure: Each wave swaps the brand and pretends a mail-quota warning, a failed delivery, an unpaid invoice but reuses the same email template underneath.
The Link: Every lure’s call-to-action routes through a compromised domain dressed up as a marketing-platform click-tracking link (the CL0/ path resembles a Constant Contact–style tracking format), which then redirects to a parked domain or a hijacked site harvesting M365 credentials.
WHY IT MATTERS:
On the surface, these domains have nothing in common. Underneath, three signals tie them to the same operator:
Shared IP: send.smnambijabajo[.]com and cp.preparationguru[.]com both resolve to 209.94.57[.]48.
Shared Certificate History : preparationguru[.]com a domain with a TLS certificate history dating to 2018, since re-registered and repurposed shares certificates with five newly surfaced domains, tying all six to the same hosting account.
Naming Pattern: the click-tracking subdomains all follow the same convention — links, click, clicks, clickxs.
WHAT DEFENDERS SHOULD DO:
Block the shared IP and hunt your logs for subdomains matching links|click|clicks|clickxs. A shared certificate or IP is often the fastest way to burn an entire multi-brand operation in one move, instead of chasing each lure individually.
#Phishing #ThreatIntel #KnowBe4ThreatLabs #CyberSecurity #InfrastructureAnalysis #M365 #CredentialHarvesting #InfoSec](https://pbs.twimg.com/media/HTd1L0jbgAAqFdm.jpg)
The G2 Fall 2026 Grid Reports are live — and our leader status is intact. 🏆
✅ #1 leader for Security Awareness Training (SAT)
✅ A leader for Incident Response
See more about this recognition. https://t.co/cJcjnbMAWM
Our Agent Risk Manager and Claude's Compliance API integration gives security teams visibility into Claude activity across the organization. Available to select customers now. https://t.co/3MEUMLE1uo
Managing security awareness training just got much simpler 🚀
We’ve launched KnowBe4 for Workday Learning! Now you can sync KnowBe4 training directly into Workday, automate real-time completion tracking, and eliminate manual record reconciliation.
More: https://t.co/C2Yxv7dlRj
@bur6u35 Congrats, Augusto! Excited for you to join the team. See you in November 🎉
Are Your AI Assistants the Next Attack Surface? https://t.co/7jlPqaqvmK
Shadow AI is one of the hardest risks for security teams to contain.
Our new browser extension addresses this head on, giving teams the ability to allow, warn or block unsanctioned AI access in real time. Learn more about Agent Risk Manager’s expansion. https://t.co/5PnKZU1o7n
@Infoproseries Always great insights from Dr. Martin Kraemer. Thanks for the conversation, InfoProSeries!
Use the final days of September to build your plan for Cybersecurity Awareness Month. A mission fortunately made less than impossible with our resource kit. Download it today. 🕵️ https://t.co/2HMDx3hbRl
Last Seen Users on Sotwe
Trends for you
Most Popular Users
Elon Musk
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers