Security Market Segment LS
Wednesday, 19 June 2019 05:47

Fraudulent domains increased by 11% in 2018, survey claims

Fraudulent domains increased by 11% in 2018, survey claims Pixabay

A survey of domains by email security firm Proofpoint has found that registrations of fraudulent domains increased by 11% in 2018 even as quarterly domain registrations grew by 44% between the first and fourth quarters of the year.

In its Domain Fraud Report for 2019, the company said that domain fraud had become easy due to the cheapness of domains. It was also easy for malicious attackers to remain anonymous due to privacy features offered by most registrars.

The report was compiled using multiple WHOIS sources, the company's visibility into email and other proprietary data sources. Proofpoint said domain creation dates were not always available in WHOIS records, and hence some domains, top-level domains or registrars may have been skipped.

Registrars were identified by use of IANA numbers which are not always available in WHOIS responses. A total of about 350 million domains were scanned for the report.

Another finding of the report was that most businesses were affected by fraudulent domains, with 76% of its customers finding similar domains as their brands. The number of customers was not specified.

number of domains

domain numbersAmong top retail brands, more than 85% had domains selling counterfeit versions of their products, with the average retail brand detecting more than 200 such imitations.

Proofpoint claimed most fraudulent domains were active, with more than 90% associated with a live server. More than 15% had mail exchanger records which meant they could be sending or receiving email. About 25% had security certificates.

Ninety-four percent of Proofpoint's customers had at least one fraudulent domain posing as their brand and sending email. Additionally, the company said it found some fraudulent domains sending low volumes of email which are commonly associated with targeted and social engineering attacks.

The report claimed the creation of new TLDs such as .app and .icu were providing new opportunities for the registration of fraudulent domains. "Our research suggests that attackers rushed to register domain names with the new TLDs. These fraudulent domains resembled '.com' domains owned by top brands. Google’s .app TLD, for example, was an especially attractive target," the company said.

More than 1500 TLDs exist now, with more than 300 being country-code TLDs and a growing list of more than 1200 generic TLDs. The .com domains were the most popular for new registrations on a monthly basis.

Among the fraudulent domains registered in 2018, 95% resolved to an IP address, 94% had a HTTP response, 16% had an MX record and 26% had a security certificate, the report said. The top TLDs for these domains are given below:

top frauds

Among registrars favoured by fraudulent domain registrants, some allowed payment in bitcoin and offered free WHOIS privacy, which made them an attractive option.

Graphics: courtesy Proofpoint


26-27 February 2020 | Hilton Brisbane

Connecting the region’s leading data analytics professionals to drive and inspire your future strategy

Leading the data analytics division has never been easy, but now the challenge is on to remain ahead of the competition and reap the massive rewards as a strategic executive.

Do you want to leverage data governance as an enabler?Are you working at driving AI/ML implementation?

Want to stay abreast of data privacy and AI ethics requirements? Are you working hard to push predictive analytics to the limits?

With so much to keep on top of in such a rapidly changing technology space, collaboration is key to success. You don't need to struggle alone, network and share your struggles as well as your tips for success at CDAO Brisbane.

Discover how your peers have tackled the very same issues you face daily. Network with over 140 of your peers and hear from the leading professionals in your industry. Leverage this community of data and analytics enthusiasts to advance your strategy to the next level.

Download the Agenda to find out more


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments