What is a lure domain?
A lure domain is a name registered for one campaign, built from an organisation's name and a sign-in word, such as the name followed by sso, mfa or enroll.
Last read from the sources at the foot of this page.
What does lure domain mean?
The campaign bypasses conventional multi-factor authentication (MFA) through real-time relay and frequently rotates lure domains, limiting the effectiveness of blocklists.
In October 2026 Canada's Cyber Centre warned that callers posing as internal IT staff are sending employees of legal and financial firms to sign-in pages whose addresses may carry the firm's own name. Some names put the firm's name in front of a domain made of sign-in words; others join the two into one new name.
A lure domain is made for one campaign. The caller's group registers it shortly before the calls and frequently rotates to the next one. That is why a list of blocked names is always a step behind.
The name exists before the call. A domain carrying a firm's name and a sign-in word is registered before anyone at the firm is phoned, often with a certificate already issued. Where the firm's name is joined into the new name, it can be seen in public records ahead of the attempt. Many fake sign-in pages carry no firm name at all and cannot be seen from outside. A passkey or security key is what stops those.
Where does it show up in a reading?
In a LeakTrace reading it is read under “Names made from yours for fake sign-in pages”: the sign-in words attackers use (sso, mfa, enroll, activate, passkey and helpdesk) joined to your firm's name.
A lure-shaped name graded worth a look is named on the reading with the help-desk sentence.
Which pages use this term?
Where does this come from?
- Canadian Centre for Cyber Security, Alert AL26-028: Ongoing help desk voice phishing campaign targeting Canadian organizations (28 October 2026)cyber.gc.caRead 1 November 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.