Piledriving Domain Takedowns in 2019

Piledriving Domain Takedowns in 2019

In 2019, ZeroFOX successfully took down thousands of domains hosting malicious content or otherwise impersonating our customers. This post seeks to take a closer look at these takedowns, and identify trends we observed in 2019.

Recommendations

• Consider enabling ZeroFOX domain security rules for keywords related to your brand, in order to detect imposter domains. Reach out to [email protected] for assistance if needed
• Consider purchasing domains other than the ones your organization actively uses for domains, and redirecting visitors to the legitimate site. This prevents attackers from registering and using these similar domains for malicious purposes

Details

Anatomy of a domain-based attack

Just as attackers impersonate high-profile social media accounts to take advantage of an existing following, attackers also impersonate legitimate organizations in domain names. These impersonating domains are often used to conduct phishing attacks, host malware, execute a scam or steal ad revenue from the victim organization. A user who clicks this link, likely disguised in a targeted email or social media post, may not realize that it is not associated with the legitimate organization. This means that users are much more likely to enter their personal information into scam pages or download malicious files from the site in question.

Domain takedown breakdown

Of the domain takedowns conducted by ZeroFOX for our customers in 2019, the top 5 registrars of these domains are:

1. GoDaddy
2. NameCheap
3. Public Domain Registry
4. Cloudflare
5. NameSilo

Each of these registrars makes the registration process quick and straightforward, which is just as ideal for threat actor use as it is for a non-malicious user. A buyer can search for a domain of interest, and site algorithms will suggest related domains, as well as cheaper domains. Domain names are relatively inexpensive, and often, discounts are offered for the first year’s registration. There are also minimal restrictions on new domain names. Registrars also do not prevent trademark infringement in any way. This burden is on the trademark owner, who would be required to submit a dispute to ICANN to resolve the issue. All of these factors make it painless for bad actors to register malicious domains, like the example below.

Figure 1. Sample pricing for a potential Apple phishing kit using various TLDs on GoDaddy

Analyzing WHOIS information for 2019 takedown domains illuminates a few interesting trends. The top email domains for registrant contact email are:

1. Whoisguard
2. Domainsbyproxy
3. Gmail

With increased legislation surrounding digital privacy, much WHOIS information, which can be thought of like a phone book for domain ownership, is now redacted. GPDR, which took effect in May 2018, spurred many registrars to make domain registrant information private by default. Additionally, many registrars now offer privacy protection services in addition to domain registration - for example, GoDaddy owns Domains by Proxy and NameCheap owns WhoisGuard. These services can even be bundled together with domain registration during the initial purchase of the domain name. Because WHOIS data is public and can be searched by anyone, this is highly advantageous to bad actors, as it makes redacting personal information automatic. When these privacy services are used, it replaces registrant contact information with anonymized contact information that can be used to contact the registrant.

However, Gmail is the email domain seen third-most-often - and neither Gmail nor Google offers privacy protection services. This suggests threat actors are either using personal email to register malicious domains, or that they are using Gmail in order to register throwaway emails associated with these domains. While unsophisticated actors may be sloppy enough to use a personal email to register a malicious domain, it is much more likely that these Gmail addresses are throwaway emails.

Concealing sensitive identifying information, also known as operational security, is a forefront concern for threat actors. Although improvements in digital privacy benefit the average Internet user greatly, they also allow threat actors to better cover their tracks.

Industry breakdown

The domains ZeroFOX took down in 2019 targeted customers across a variety of industries. The majority of our domain takedowns in the last year were within the Consumer Goods industry. Telecommunications, Banking and Finance, Entertainment, and Services round out the top five industries. In total, 117 organizations across 17 industries were targeted by threat actors.

Figure 2. Full breakdown of 2019 domain takedowns by industry

Most of these domains attempted to impersonate the legitimate organization in some way. Often, attackers do this by mutating the legitimate domain name of an organization, and registering this mutated domain. Some of mutation methods we observed were:

• Adhering “123-” to the beginning of the brand name
• Replacing an “L” with an “I” or a “1”
• Registering unused TLDs - for example brand.fr and brand.ca if brand.com is the legitimate domain
• Adding keywords like “support,” “help,” and “customer-service” to the targeted organization’s name

Each of these methods seeks to make a domain seem legitimate so that an unsuspecting user will not realize they have navigated to a malicious domain.

Conclusion

Domains are an attractive attack vector to attackers, who are drawn to the low-barrier of entry, affordability, and ease of scale. Malicious domains are used to impersonate legitimate brands, host phishing pages, and even host malware. Only by proactively monitoring their domains can organizations keep ahead of this threat into 2020.