It’s A Small Cluster After All

DomainTools outlines a data-driven investigation into phishing/impersonation domain infrastructure (linked to bank look-alikes and the "Disneyland Team"), using OCR to normalize homoglyphs, DBSCAN with edit distance to cluster domains, passive DNS to expand to FQDNs, and TF‑IDF on subdomains to reveal shared behaviors; after filtering wildcard noise (e.g., cprapid.com), the method surfaced clusters with traits like "cpanel," enabling researchers to map related attacker infrastructure at scale and prioritize leads.