Latest news of the domain name industry

Recent Posts

Only 2% of phishing attacks use cybersquatted domain names

Kevin Murphy, October 25, 2012, 15:51:21 (UTC), Domain Registries

The number of cybersquatted domain names being used for phishing is falling sharply and currently stands at just 2% of attacks, according to the Anti-Phishing Working Group.
The APWG’s first-half 2012 report (pdf) identified 64,204 phishing domains in total.
Of those, the group believes that only 7,712 (12%) were actually registered by the phishers themselves. The rest belonged to innocent third parties and had been compromised.
That’s a steep drop from 12,895 domains in the second half of 2011 and 14,650 in the first half of 2011.
Of the 7,712 phisher-owned domains, about 66% were being use to phish Chinese targets, according to the APWG.
The group’s research found only 1,350 that contained a brand name or a misspelling of a brand name.
That’s down from 2,232 domains in the second-half of 2011, representing just 2% of all phishing domains and 17% of phisher-owned domains.
The report states:

Most maliciously registered domain strings offered nothing to confuse a potential victim. Placing brand names or variations thereof in the domain name itself is not a favored tactic, since brand owners are proactively scanning Internet zone files for such names.
As we have observed in the past, the domain name itself usually does not matter to phishers, and a domain name of any meaning, or no meaning at all, in any TLD, will usually do.
Instead, phishers almost always place brand names in subdomains or subdirectories. This puts the misleading string somewhere in the URL, where potential victims may see it and be fooled. Internet users are rarely knowledgeable enough to be able to pick out the “base” or true domain name being used in a URL.

Taken as a percentage of attacks, brand-jacking is clearly a pretty low-occurrence offence, according to the APWG’s numbers.
In absolute numbers, it works out to about 7.5 domain names per day that are being use to phish and contain a variation of the brand name being targeted.
Unsurprisingly, the APWG found that Freedom Registry’s .tk — which offers free registration — is the TLD being abused most often to register domains for phishing attacks.
More than half of the phisher-owned domains were in .tk, according to the report.

Tagged: , , , , , , ,

Comments (3)

  1. PPLILI says:
    November 14, 2012 at 2:57 pm

    N&B Imports Co, Ltd, specialized cybersquatting domain names and trademarks

    Reply
  2. Tom says:
    November 28, 2012 at 9:12 am

    There is a company to exposure: TMD Investment Co, Ltd web site is:http://www.tmdinvestment.com/
    They specialize in trademark, domain name Investment, TMD Investment Co, Ltd cybersquatting domain name a lot of companies, including my company trademark.

    Reply
    • Bengt says:
      November 30, 2012 at 10:57 am

      TMD Investment CO, Ltd are a cybersquatting and a trademark pirshing compant. Watch out for them!
      As for Tom, we just recieved mail about them doing malicious domain name registrations.

      Reply

Add Your Comment