Shared Hosting Pivot on Payment Fraud IP

Case Brief

Case ED-102 tied straylight-payments.com to 198.51.100.55 on Sundial Hosting. Treasury is ready to block, but Eli will not green-light a netblock action until you show what else lives on that disposable host: sibling lookalikes or clean tenants.

Objective

Start from the hosting IP, pivot to related domains, and document what ties them to the payment fraud cluster.

Learning Objectives

• Pivot from 198.51.100.55 to co-hosted lookalike domains
• Compare registration age and reputation across the shared set
• Decide whether the IP cluster supports a payment-fraud campaign call
• Document the linked domains and IP as IOCs

Topics