Local Landmarks, Local Lures: How Scammers Weave Geography into Domains

Ahead of the Global Anti Scam Summit America, OXIL Research have been conducting LLM-scaled analysis of GSE data to identify target geographies. The team have developed a deterministic scoring system to identify the target country of domain-based signals, supported by Gemini output of language, ccTLD impersonation, and geographic entities.

A geographic entity is defined as a direct reference to a specific place or any proper name, term, or brand deeply woven into local daily life, that is immediately familiar to a resident of a certain country/ place, even if invisible to outsiders.

Scammers often embed geographic entities as part of a sniper-rifle approach to gain the trust, interest, and finances of their targets. For targets in the US and California this may look like domains and urls referring to local brands (‘Walgreens’), banking services (‘Wells Fargo’), government infrastructure (‘SFMTA’ i.e. the San Francisco Municipal Transportation Agency), place names (‘San Francisco’), sporting references (‘Golden State Warriors’), telecoms (‘Xfinity’), or everyday local markers (‘Clipper Card’).

In the initial analysis, Gemini extracted a geographic entity in 12% of signals from the first 6 months of 2026. The results of this work align closely with our previous research on rethinking scam prevention, as the results show that scammers frequently employ Thematic Lures such as

• ‘Threat and Consequence’ and ‘Appeal to Authority’:
  • cadmv.traffic-finedh.com/pay/
  • cahighwaypatrol.nk05.vip/Tollpayment
• ‘Information’ on services and activities in a particular area:
  • sewellelectric-utah.com
  • californianindiancuisine.com
• ‘Incentives’ such as rewards or tickets to events:
  • www.sfgiantsmailtx.com
  • www.freemoneyreward.com.bigsavingusa.com/
• The potential for local ‘Social and emotional connection’:
  • sanjosesinglesonline.com
  • seattlemysterylovers.com

The results will be discussed further in the workshop: “Geographies of Scams: Where Criminals, Infrastructure and Victims Collide."