Phishing is a growing problem for brand owners. Brand names are being abused for criminal purposes and branded products are being offered for sale by unscrupulous traders who never deliver. Or deliver counterfeits instead. We investigated how many phishing sites were operating under domain names incorporating or resembling the names of the top fifty Dutch brands. And we found 675 sites! The number of phishing sites linked to brands in the financial services industry was particularly high.
Top fifty Dutch brands
Domain Name Surveillance Service now covers all TLDs Domain Name Surveillance Service pre-scan now availableOur research focused on the fifty most valuable brands in the Netherlands, as defined by Brand Finance, a leading brand valuation consultancy1. Using the SIDN BrandGuard, we scanned the .nl zone for all the domain names incorporating or resembling the brand names in question. The hits were then classified using the profiler that was recently added to SIDN BrandGuard.
Classification
Developed by SIDN Labs in collaboration with TNO, the profiler classifies suspicious domain names by analysing the domain names themselves and the technology and content of the associated websites. Each domain name is scored on a number of classifiers. The scores are then weighted and combined into a profile, which reflects the purpose for which the domain name is probably being used. The thinking behind the system is that, by combining a number of individually insignificant pieces of information about a domain name, it is possible to ascertain how the name is being used. The SIDN BrandGuard profiler assigns each domain name to one of the following categories:
Category | Details |
|---|---|
Normal site | Domain name is linked to an ordinary website belonging to the brand owner or another legitimate party. |
Phishing site | Domain name is linked to a website that is used for phishing. |
Advertisement network | Domain name is linked to a website made up of advertising links. |
Parking site | Registrant is not currently making active use of the domain name, which is linked to the hosting firm's standard parking page. |
‘Sale’ site | The domain is for sale. |
Removed | The website linked to the domain name has been taken down by the hoster. |
E-mail only | The domain name is not linked to a website, but does have a mail server. |
Unused | No information about the domain name is available from the DNS; no IP address and no mail server; the domain name has been registered, but nothing more. |
Unresponsive | A web server IP address is linked to the domain name, but the server does not respond. |
Redirect to original domain name | Users are redirected to the original domain name. |
Our scan of the .nl zone identified 30,357 domain names incorporating or resembling the top fifty brands.2 However, many of those domain names are bound to be legitimate. We therefore used the profiler to generate more useful information about the domain names in question. While there is no absolute guarantee that a domain name's classification is correct, it reflects how the domain name is very probably being used.
675 phishing sites
As the pie chart below shows, the SIDN BrandGuard profiler classified 60.2 per cent of flagged-up domain names as used for normal sites, and 2.2 per cent as used for phishing. In absolute terms, that 2.2 per cent equates to 675 .nl domain names. We found that the hosters had removed ('suspended') the content linked to 0.7 per cent of the flagged-up domain names. That is usually a sign that the domain name was being used for spam or other abusive content.
Financial service sector brands prominent
Banking brands, insurance brands and other financial service brands were prominent in our list of flagged-up domain names. We found an average of about eighteen phishing domain names for each top-fifty brand from the financial service sector. Unfortunately, the sector is often targeted by cybercriminals. However, most financial service companies are alert and act quickly to get phishing sites closed down.
What is SIDN BrandGuard?
As manager of the .nl domain, SIDN is committed to tackling cybercrime in the .nl zone. One of the tools that we've developed to help in that field is the SIDN BrandGuard. The tool flags up all registrations of .nl domain names containing or resembling a particular search term, e.g. a brand name. If, for example, you use SIDN BrandGuard to scan for the brand name 'Ohra', it might flag up '0hra.nl', where the letter 'O' has been replaced by the number '0'. Domain names that are just slightly different from trusted brand names are often used by criminals to dupe internet users. The difference may be small, but if you don't spot it, the consequences can be big. We recently added a global coverage option to SIDN BrandGuard, meaning that subscribers can now get alerts about registrations under other top-level domains as well as .nl. The survey described above looked only at .nl domain names.
Meer information
Want to know more about SIDN BrandGuard, the profiler or our analysis of the top fifty brands? Contact Pim Pastoors by mailing pim.pastoors@sidn.nl or calling +31 657 045 407.
(1) Every year, brand valuation consultancy Brand Finance analyses thousands of brands. The consultancy then publishes a list of the most valuable brands in the Netherlands, called the Brand Finance Netherlands 50.
(2) A more sensitive algorithm was used to scan for brand names that often form part of everyday words, so as to provide a more realistic picture. For example, 'ING' is a major brand in the Netherlands, but the letters 'ing' form part of countless ordinary words and therefore lots of legitimate domain names.
