This thesis applies the Regional Security Complex Theory (RSCT) to the field of cybersecurity by comparing regional phishing threat landscapes. Regions are defined according to the principles of RSCT theory. For each region, regular expression (regex) rules are developed to identify the most common sector-related domains and keywords associated with phishing activity. These patterns are then matched against a dataset of newly registered domains to identify potential phishing domains.
The resulting matches undergo manual analysis to assess whether phishing activity within a region is sufficiently similar to be considered homogeneous, and whether differences between regions demonstrate enough heterogeneity to justify treating them as distinct. The analysis also examines sectoral representation within each region, for example to determine whether sectors such as banking, government, or healthcare are more frequently targeted than others. This approach seeks to determine whether the regional dynamics described by RSCT are reflected in cyberspace threat behavior. The criteria for evaluating regional and sectoral patterns are clearly defined in advance to ensure consistency and transparency in the analysis.