Once an internet domain is registered, it becomes known to everyone within a few minutes. So the idea of registering a domain and immediately launching an attack doesn’t always work. To avoid being detected, criminals have several options: fake landing pages, fake blogs, fake content or simply waiting.
They register a domain, leave it inactive for days, weeks, or months, and then use it. Today I noticed this domain: conveyancinggmail[.]com
The domain was registered in March, and months later, the attack kit was deployed.
Matrix monitors this kind of behavior; however, given the high cost of this type of monitoring, I think it would be much easier if the providers themselves monitored their systems to identify this pattern. This type of provider-side monitoring would be much simpler since, instead of having to perform polling, they could simply trigger checks when logins occur on their systems (provided they have disabled the use of webshells).