Alpha Team Research: Domain Registration and Donald Trump

Recently, ZeroFOX has observed spikes in domains registered related to current major news events. Recently, with the announcement of the formal impeachment inquiry of Donald Trump on Sept. 24, 2019, we observed trends in domains related to the impeachment of the president.

Recommendations

If you are interested in detecting domains registered that are related to your organization, which could be used to serve malicious content, consider adding these domains as entities in the platform. Reach out to [email protected] for assistance if needed

Details

Between Sept. 24 and Sept. 25, 2019, an additional 127 domains containing “trump”, 47 domains containing “impeach”, 8 containing “whistleblow”, and 1 containing “pelosi” were registered.

Figure 1. Domains registered containing “impeach” between Sept. 1 - 25, 2019.

Domains containing “impeach” spiked dramatically after the Sept. 24 announcement of the impeachment inquiry. The vast majority of these domains are either not presently hosting content, or parked. A small few of these domains are blogs that appear to be in progress. None are being used to host malicious content.

This registration correlation is not specific to political events, however. We have also observed this trend following news events such as the announcement of the Facebook fine after the Cambridge Analytica scandal, and the Capital One data breach.

Figure 2. Domains registered containing “facebook” between July 5, 2019 and July 30, 2019.

As seen above, on July 12, 2019, there was a flurry of domains registered containing “facebook.” This correlates with the date that the FTC approved the fine. Additionally, this trend can be observed with regards to the Capital One data breach, disclosed in July 2019.

Figure 3. Domains registered containing “capitalone” between July 5, 2019 and July 30, 2019.

The breach was disclosed July 30, 2019, and we observed 70 domains registered containing “capitalone” that same day. A notable spike can also be seen on July 12, 2019. This could be related to the FTC ruling released that day, as domains registered containing keywords like “equifax” and other words related to financial institutions also spiked. It could also potentially be completely unrelated.

Conclusion

Although correlation does not imply causation, it is interesting to observe the spike in domain registration immediately following world news events. This can be seen for a variety of types of events - from political to financial.