Security Market Segment LS
Wednesday, 19 June 2019 05:47

Fraudulent domains increased by 11% in 2018, survey claims

Fraudulent domains increased by 11% in 2018, survey claims Pixabay

A survey of domains by email security firm Proofpoint has found that registrations of fraudulent domains increased by 11% in 2018 even as quarterly domain registrations grew by 44% between the first and fourth quarters of the year.

In its Domain Fraud Report for 2019, the company said that domain fraud had become easy due to the cheapness of domains. It was also easy for malicious attackers to remain anonymous due to privacy features offered by most registrars.

The report was compiled using multiple WHOIS sources, the company's visibility into email and other proprietary data sources. Proofpoint said domain creation dates were not always available in WHOIS records, and hence some domains, top-level domains or registrars may have been skipped.

Registrars were identified by use of IANA numbers which are not always available in WHOIS responses. A total of about 350 million domains were scanned for the report.

Another finding of the report was that most businesses were affected by fraudulent domains, with 76% of its customers finding similar domains as their brands. The number of customers was not specified.

number of domains

domain numbersAmong top retail brands, more than 85% had domains selling counterfeit versions of their products, with the average retail brand detecting more than 200 such imitations.

Proofpoint claimed most fraudulent domains were active, with more than 90% associated with a live server. More than 15% had mail exchanger records which meant they could be sending or receiving email. About 25% had security certificates.

Ninety-four percent of Proofpoint's customers had at least one fraudulent domain posing as their brand and sending email. Additionally, the company said it found some fraudulent domains sending low volumes of email which are commonly associated with targeted and social engineering attacks.

The report claimed the creation of new TLDs such as .app and .icu were providing new opportunities for the registration of fraudulent domains. "Our research suggests that attackers rushed to register domain names with the new TLDs. These fraudulent domains resembled '.com' domains owned by top brands. Google’s .app TLD, for example, was an especially attractive target," the company said.

More than 1500 TLDs exist now, with more than 300 being country-code TLDs and a growing list of more than 1200 generic TLDs. The .com domains were the most popular for new registrations on a monthly basis.

Among the fraudulent domains registered in 2018, 95% resolved to an IP address, 94% had a HTTP response, 16% had an MX record and 26% had a security certificate, the report said. The top TLDs for these domains are given below:

top frauds

Among registrars favoured by fraudulent domain registrants, some allowed payment in bitcoin and offered free WHOIS privacy, which made them an attractive option.

Graphics: courtesy Proofpoint


Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has high potential to be exposed to risk.

It only takes one awry email to expose an accounts payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 steps to improve your Business Cyber Security’ you will learn some simple steps you should be taking to prevent devastating malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you will learn:

· How does business security get breached?
· What can it cost to get it wrong?
· 6 actionable tips



iTWire can help you promote your company, services, and products.


Advertise on the iTWire News Site / Website

Advertise in the iTWire UPDATE / Newsletter

Promote your message via iTWire Sponsored Content/News

Guest Opinion for Home Page exposure

Contact Andrew on 0412 390 000 or email [email protected]


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments