Today, cybersquatting and related machinations with Internet domain names become a very significant problem for the Internet and its users. OpenDNS claims that cyber squatters are becoming more active during US presidential campaign, trolling almost every candidate with hijacked or altered domain names. Celebrities like Mark Zuckerberg, also fall victims of domain fraudsters.

The World Intellectual Property Organization (WIPO) reports continuous growth of domain cybersquatting, while cybercriminals are aggressively using typosquatted domains to compromise and infect inattentive users with malware turning their mobile devices and computers into zombies. Ponemon Institute has calculated that annual cost of phishing for an average organization is more than $3.7 million. Meanwhile, Microsoft’s latest Security Intelligence Report says that phishing and related malicious activities are skyrocketing.

Cybersecurity Industry Brands Under Fire

Last week our attention was attracted by the SC Magazine publication “Scammers impersonate legit cyber-security companies” speaking about fraudulent domains pretending to be legitimate cybersecurity company.

We decided to perform a quick research to understand how important the problem actually is. For this purpose, we analyzed domains of the leading cybersecurity companies from the NASDAQ’s NQCYBR index, as well as few private but well-known cybersecurity companies. We used our Domain Security Radar for this purpose, a free online service designed to detect cybersquatting, typosquatting and phishing domains for a particular brand or Internet domain.

Among numerous cybersquatted and typosquatted domains we have found, we can distinguish five main categories of domains:

Domain Squatting

Domain is registered, but is not used, or hosts an empty website.
Traffic Theft

Domain is registered and is being used to redirect visitors to third-party website(s).
Brand Theft

Domain is registered, website leverages or simulates the original brand, or a part of it, to associate with the legitimate brand, while offering its own goods and services.
Malicious Activities

Domain is registered and is being used for phishing, redirection to competitor’s website, malware delivery or any other harmful or unlawful activities.
Unknown

Purpose of the domain registration is not clear or cannot be confirmed.

The most frequent case is traffic theft, malicious domain usage takes the second place, domain squatting goes after:

Diagram 1: Domains usage statistics

From Innocent Squatting to Malware Infection

Country or altered domains of the famous cybersecurity brands, like "akamai.ru", "junipernetworks.cn", "kasperskysupport.com" or "ciscogroup.com" are being squatted by scammers who try to resell them, parasitizing on the original brand value.

Some of the domains with visual mutations, like "junlper.net" (that will look exactly like the original brand name in CAPS) was used for phishing in the past, however now seems to be operated by Kaspersky (according to IP history) that probably uses it to gather threat intelligence information.

Other domains try to create an impression of being a legitimate part of the brand. Owned by a private person with aol.com email and PO Box address "baesystemsstore.com" hosts a web shop selling some goods not related to the original brand.

Some of the domains, like "lifelock.org", which is registered via proxy, is live and even has a valid SSL certificate, however has nothing to do with the original brand. The website in question seems to resell the original LifeLock services via their affiliate program, using the following track URLs pointing to the original LifeLock's website:
'https://store.lifelock.com/enrollment?promocode=ORG30&cid=aff_fingerflip_'

Similar story is with "paloaltonetworks.cz" that redirects users to a website of one of the Fortinet resellers, a direct competitor to Palo Alto Networks. Owned by a private company in Praha, the domain has nothing to do with Palo Alto brand.

More dangerous cases are websites like "trendmicrow.com" that collects personal data of Trend Micro customers pretending to be Trend Micro support. A Symantec's domain with typo "sytmantec.com" redirects users to random websites, hosting adult content and malware.

Here is a detailed statistics for each of the cybersecurity companies:

	Total Alerts	Test Results
Akamai	62	View
Domain Squatting	1,6%
Traffic Theft	85,4%
Brand Theft	8%
Malicious Activities	5%
Unknown	0%
AVG	43	View
Domain Squatting	2,3%
Traffic Theft	83,7%
Brand Theft	0%
Malicious Activities	14%
Unknown	0%
BAE Systems	32	View
Domain Squatting	0%
Traffic Theft	75%
Brand Theft	3,1%
Malicious Activities	21,9%
Unknown	0%
Barracuda Networks	124	View
Domain Squatting	8%
Traffic Theft	88,7%
Brand Theft	0%
Malicious Activities	3,3%
Unknown	0%
Check Point	104	View
Domain Squatting	12,5%
Traffic Theft	87,5%
Brand Theft	0%
Malicious Activities	0%
Unknown	0%
Cisco	172	View
Domain Squatting	20,4%
Traffic Theft	72,7%
Brand Theft	0%
Malicious Activities	6,4%
Unknown	0,5%
Cyberark	17	View
Domain Squatting	0%
Traffic Theft	100%
Brand Theft	0%
Malicious Activities	0%
Unknown	0%
F5 Networks	32	View
Domain Squatting	0%
Traffic Theft	96,8%
Brand Theft	0%
Malicious Activities	3,2%
Unknown	0%
FireEye	29	View
Domain Squatting	6,9%
Traffic Theft	89,6%
Brand Theft	0%
Malicious Activities	3,5%
Unknown	0%
Fortinet	56	View
Domain Squatting	7,1%
Traffic Theft	89,2%
Brand Theft	0%
Malicious Activities	3,7%
Unknown	0%
Gemalto	13	View
Domain Squatting	7,6%
Traffic Theft	77,2%
Brand Theft	0%
Malicious Activities	7,6%
Unknown	7,6%
Imperva	14	View
Domain Squatting	0%
Traffic Theft	92,8%
Brand Theft	0%
Malicious Activities	7,2%
Unknown	0%
Infoblox	44	View
Domain Squatting	0%
Traffic Theft	100%
Brand Theft	0%
Malicious Activities	0%
Unknown	0%
Juniper Networks	65	View
Domain Squatting	4,6%
Traffic Theft	90,8%
Brand Theft	0%
Malicious Activities	4,6%
Unknown	0%
Kaspersky	59	View
Domain Squatting	3,3%
Traffic Theft	86,4%
Brand Theft	0%
Malicious Activities	8,7%
Unknown	1,6%
LifeLock	47	View
Domain Squatting	0%
Traffic Theft	91,4%
Brand Theft	4,2%
Malicious Activities	4,4%
Unknown	0%
NetScout Systems	26	View
Domain Squatting	0%
Traffic Theft	92,3%
Brand Theft	0%
Malicious Activities	7,7%
Unknown	0%
Palo Alto Networks	24	View
Domain Squatting	4,1%
Traffic Theft	83,3%
Brand Theft	0%
Malicious Activities	12,6%
Unknown	0%
Proofpoint	19	View
Domain Squatting	0%
Traffic Theft	84,2%
Brand Theft	0%
Malicious Activities	15,8%
Unknown	0%
Qualys	25	View
Domain Squatting	0%
Traffic Theft	88%
Brand Theft	4%
Malicious Activities	8%
Unknown	0%
Radware	42	View
Domain Squatting	0%
Traffic Theft	97,6%
Brand Theft	0%
Malicious Activities	2,4%
Unknown	0%
Rapid7	17	View
Domain Squatting	0%
Traffic Theft	88,2%
Brand Theft	0%
Malicious Activities	11,8%
Unknown	0%
Splunk	43	View
Domain Squatting	2,3%
Traffic Theft	88,3%
Brand Theft	0%
Malicious Activities	9,4%
Unknown	0%
Symantec	83	View
Domain Squatting	2,4%
Traffic Theft	75,9%
Brand Theft	0%
Malicious Activities	21,7%
Unknown	0%
Trend Micro	11	View
Domain Squatting	0%
Traffic Theft	54,5%
Brand Theft	0%
Malicious Activities	36,3%
Unknown	9,2%
Secureworks	14	View
Domain Squatting	0%
Traffic Theft	78,5%
Brand Theft	0%
Malicious Activities	14,4%
Unknown	7,1%

Ilia Kolochenko, High-Tech Bridge’s CEO, says:

“Unfortunately, lack of international cooperation and jurisprudence enable fraudsters to make easy money on various illegal or at least unethical operations with domains. Even cybersecurity companies are being targeted these days, not only financial institutions or luxury brands.

The biggest concern is that relatively harmless techniques such as typosquatting and cybersquatting are now being aggressively used in pair with phishing and drive-by-download attacks.

At High-Tech Bridge, as a part of our continuous effort to make Web safer, we have created Domain Security Radar service to enable anyone to track illicit activities against a brand or a domain name.”

High-Tech Bridge Security Research

High-Tech Bridge Security Research Team regularly writes about web and mobile application security, privacy, Machine Learning and AI.