Visible abuse of big brand domain names is down

However, the study brought some good news as well: monitoring and intervention does seem to be suppressing visible abuse such as phishing. Cybercrooks are apparently shifting their focus to less conspicuous malpractices, such as spamming.

Table 1. Domain names resembling the Netherlands' top 50 brands.

Classification

Websites were classified using a profiler developed by SIDN Labs in collaboration with TNO. The profiler classifies suspicious domains by analysing both the domain names themselves and the technology and content of the associated websites. Each domain is scored on a number of classifiers. The scores are then weighted and combined into a profile, which reflects the purpose for which the domain name is probably being used. The thinking behind the system is that, by combining a number of individually insignificant pieces of information about a domain name, it's possible to ascertain how the name is being used. The profiler assigns each domain name to one of the following categories:

Table 2. Description of categories in which websites are classified by the profiler.

Very little discernible phishing now

In 2016 and 2017, analysis revealed that a significant number of the detected sites remained visibly active, distributing malware, using logos without authorisation and so on. In 2020, however, we found very little activity like that. The suspect domains that we came across appeared to be in use for activities that could go 'under the radar'. Sending spam, for example. In many cases, the associated web servers redirected to external IP addresses linked to the mimicked brand's own website. That's a common tactic adopted by scammers, so that mail recipients who check out the sending domain get the impression that the sender is legitimate. The only visible difference between the scam domain name and the brand's official domain name is that the fraudulent one isn't registered to the brand owner.

Unclear registrant details make action difficult

It can be difficult to act against scam domains of the type described, partly because of false positive detections: some of the domains that our scans highlight as suspicious are in fact legitimate. For example, we recently came across a domain name that incorporated the name of a bank. The name was used for a website whose landing page featured the bank's logo. However, the domain wasn't registered to the bank and the landing page was very amateurish and insecure. Understandably, alarm bells started ringing. However, an internal investigation by the bank revealed that the site had been created by an intern, who had registered the domain name personally. In fact, it turned out that the bank was using lots of domains that weren't registered in its name, because staff didn't know what the correct registration procedure was.

Anti-abuse activities are effective against visible phishing

One of the reasons for the decline in visible abuse is that companies are defending their brands more actively. In 2016, organisations in the Netherlands were using SIDN BrandGuard to protect 47 brands; today the figure is 264. Increasingly, therefore, cybercrooks are turning to other domain name extensions, using domain names that resemble trade journals, or snapping up irrelevant names with established traffic flows to use for their fake webshops. However, targeted countermeasures are making those tactics less attractive as well: tools such as the SIDN BrandGuard are nowadays able to pick up malicious registrations outside .nl. We're also co-investing in systems that can detect fake webshops.

Figure 1. Many leading Dutch brands now use SIDN BrandGuard to protect their reputations on line. This graph shows how the number of protected brand names has increased over time.

* As defined by brand valuation agency Brand Finance.