Open early warning for lookalike and phishing domains aimed at North African banks, telecoms, postal services and government portals.
No new lookalikes on 23 October 2026.
Quiet days are normal. Real campaigns show up a few times a week, and the feed below keeps the last 30 days.
Watching 45 brands in 3 countries. Updated every morning from certificate transparency, newly registered domains and public phishing feeds.
Findings, last 30 days
Medium and high confidence only. Domains are defanged: [.] stands for a dot. A finding is a lead to verify, not a verdict.
Nothing medium or high in the last 30 days. That usually means the brands covered here were not being actively impersonated with new domains, not that the watch stopped: see the source health below.
Hunt for them in your environment
Paste one of these into your SIEM to see whether anyone already resolved or visited these domains. They cover every medium and high finding of the last 30 days, subdomains included.
Cortex XDR or XSIAM (XQL)
// Maghreb Threat Watch: no medium or high findings in the last 30 days.
// Nothing to hunt for today.
Splunk (CIM Network_Resolution)
``` Maghreb Threat Watch: no medium or high findings in the last 30 days. ```
Source health
What the latest run could reach. Free sources fail now and then; the watch carries on with the rest.
| Source | Status | Items | Note |
|---|---|---|---|
| crt.sh | ok | 7 | 5/67 queries failed (crt.sh is often overloaded) |
| openphish | ok | 300 | |
| whoisds | ok | 70,000 | newly registered on 2026-10-22 |
| urlhaus | ok | 832 |
Last run checked 71,139 domains and URLs.
Coverage
Brands watched today. Missing one? Open an issue or a pull request on GitHub.
Tunisia 31
- BIAT
- STB (Societe Tunisienne de Banque)
- BNA (Banque Nationale Agricole)
- Attijari Bank Tunisie
- Amen Bank
- UIB (Union Internationale de Banques)
- BH Bank
- ATB (Arab Tunisian Bank)
- Banque de Tunisie
- UBCI
- Banque Zitouna
- QNB Tunisia
- Wifak International Bank
- Al Baraka Bank Tunisia
- BTE (Banque de Tunisie et des Emirats)
- BTK Bank
- La Poste Tunisienne
- D17 (La Poste Tunisienne wallet)
- Flouci
- Sobflous
- ClicToPay
- Tunisie Telecom
- Ooredoo (Tunisie and Algerie)
- Orange Tunisie
- CNSS Tunisie
- CNAM
- Ministere des Finances / Jibaya
- STEG
- SONEDE
- Tunisair
- SNCFT
Morocco 9
- Attijariwafa bank
- CIH Bank
- Bank of Africa (Maroc)
- Barid Al-Maghrib / Al Barid Bank
- Maroc Telecom
- inwi
- CMI (Centre Monetique Interbancaire)
- DGI Maroc
- Royal Air Maroc
Algeria 5
- Algerie Poste / BaridiMob
- Mobilis
- Djezzy
- CPA (Credit Populaire d'Algerie)
- Air Algerie
How it works
Each new domain or certificate name is compared with every brand. Exact names, look-alike Unicode letters, leetspeak and typos score points, and so do the words phishing kits add (login, colis, facture, remboursement), country hints and heavily abused TLDs. Every point is written down, so you can see exactly why a domain was flagged. Official domains are never flagged.
The watch is passive: it reads public feeds and certificate logs and never visits, scans or touches a suspected site. Report anything you confirm to the brand and to your national CERT.