Security Market Segment LS
Wednesday, 19 June 2019 05:47

Fraudulent domains increased by 11% in 2018, survey claims

By
Fraudulent domains increased by 11% in 2018, survey claims Pixabay

A survey of domains by email security firm Proofpoint has found that registrations of fraudulent domains increased by 11% in 2018 even as quarterly domain registrations grew by 44% between the first and fourth quarters of the year.

In its Domain Fraud Report for 2019, the company said that domain fraud had become easy due to the cheapness of domains. It was also easy for malicious attackers to remain anonymous due to privacy features offered by most registrars.

The report was compiled using multiple WHOIS sources, the company's visibility into email and other proprietary data sources. Proofpoint said domain creation dates were not always available in WHOIS records, and hence some domains, top-level domains or registrars may have been skipped.

Registrars were identified by use of IANA numbers which are not always available in WHOIS responses. A total of about 350 million domains were scanned for the report.

Another finding of the report was that most businesses were affected by fraudulent domains, with 76% of its customers finding similar domains as their brands. The number of customers was not specified.

number of domains

domain numbersAmong top retail brands, more than 85% had domains selling counterfeit versions of their products, with the average retail brand detecting more than 200 such imitations.

Proofpoint claimed most fraudulent domains were active, with more than 90% associated with a live server. More than 15% had mail exchanger records which meant they could be sending or receiving email. About 25% had security certificates.

Ninety-four percent of Proofpoint's customers had at least one fraudulent domain posing as their brand and sending email. Additionally, the company said it found some fraudulent domains sending low volumes of email which are commonly associated with targeted and social engineering attacks.

The report claimed the creation of new TLDs such as .app and .icu were providing new opportunities for the registration of fraudulent domains. "Our research suggests that attackers rushed to register domain names with the new TLDs. These fraudulent domains resembled '.com' domains owned by top brands. Google’s .app TLD, for example, was an especially attractive target," the company said.

More than 1500 TLDs exist now, with more than 300 being country-code TLDs and a growing list of more than 1200 generic TLDs. The .com domains were the most popular for new registrations on a monthly basis.

Among the fraudulent domains registered in 2018, 95% resolved to an IP address, 94% had a HTTP response, 16% had an MX record and 26% had a security certificate, the report said. The top TLDs for these domains are given below:

top frauds

Among registrars favoured by fraudulent domain registrants, some allowed payment in bitcoin and offered free WHOIS privacy, which made them an attractive option.

Graphics: courtesy Proofpoint


Subscribe to ITWIRE UPDATE Newsletter here

GRAND OPENING OF THE ITWIRE SHOP

The much awaited iTWire Shop is now open to our readers.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.

ENTER THE SHOP NOW!

INTRODUCING ITWIRE TV

iTWire TV offers a unique value to the Tech Sector by providing a range of video interviews, news, views and reviews, and also provides the opportunity for vendors to promote your company and your marketing messages.

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the iTWire.com site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.

SEE WHAT'S ON ITWIRE TV NOW!

BACK TO HOME PAGE
Sam Varghese

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

Share News tips for the iTWire Journalists? Your tip will be anonymous

WEBINARS ONLINE & ON-DEMAND

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News

Comments