Scammers target cybersecurity brands
Cybersquatting, typosquatting and phishing now target the largest cybersecurity brands.
Introduction
Today, cybersquatting and related machinations with Internet domain names become a very significant problem for the Internet and its users. OpenDNS claims that cyber squatters are becoming more active during US presidential campaign, trolling almost every candidate with hijacked or altered domain names. Celebrities like Mark Zuckerberg, also fall victims of domain fraudsters.
The World Intellectual Property Organization (WIPO) reports continuous growth of domain cybersquatting, while cybercriminals are aggressively using typosquatted domains to compromise and infect inattentive users with malware turning their mobile devices and computers into zombies. Ponemon Institute has calculated that annual cost of phishing for an average organization is more than $3.7 million. Meanwhile, Microsoft’s latest Security Intelligence Report says that phishing and related malicious activities are skyrocketing.
Cybersecurity Industry Brands Under Fire
Last week our attention was attracted by the SC Magazine publication “Scammers impersonate legit cyber-security companies” speaking about fraudulent domains pretending to be legitimate cybersecurity company.
We decided to perform a quick research to understand how important the problem actually is. For this purpose, we analyzed domains of the leading cybersecurity companies from the NASDAQ’s NQCYBR index, as well as few private but well-known cybersecurity companies. We used our Domain Security Radar for this purpose, a free online service designed to detect cybersquatting, typosquatting and phishing domains for a particular brand or Internet domain.
Among numerous cybersquatted and typosquatted domains we have found, we can distinguish five main categories of domains:
- Domain Squatting
Domain is registered, but is not used, or hosts an empty website.
- Traffic Theft
Domain is registered and is being used to redirect visitors to third-party website(s).
- Brand Theft
Domain is registered, website leverages or simulates the original brand, or a part of it, to associate with the legitimate brand, while offering its own goods and services.
- Malicious Activities
Domain is registered and is being used for phishing, redirection to competitor’s website, malware delivery or any other harmful or unlawful activities.
- Unknown
Purpose of the domain registration is not clear or cannot be confirmed.
The most frequent case is traffic theft, malicious domain usage takes the second place, domain squatting goes after:
Diagram 1: Domains usage statistics
From Innocent Squatting to Malware Infection
Country or altered domains of the famous cybersecurity brands, like "akamai.ru", "junipernetworks.cn", "kasperskysupport.com" or "ciscogroup.com" are being squatted by scammers who try to resell them, parasitizing on the original brand value.
Some of the domains with visual mutations, like "junlper.net" (that will look exactly like the original brand name in CAPS) was used for phishing in the past, however now seems to be operated by Kaspersky (according to IP history) that probably uses it to gather threat intelligence information.
Other domains try to create an impression of being a legitimate part of the brand. Owned by a private person with aol.com email and PO Box address "baesystemsstore.com" hosts a web shop selling some goods not related to the original brand.
Some of the domains, like "lifelock.org", which is registered via proxy, is live and even has a valid SSL certificate, however has nothing to do with the original brand. The website in question seems to resell the original LifeLock services via their affiliate program, using the following track URLs pointing to the original LifeLock's website:
'https://store.lifelock.com/enrollment?promocode=ORG30&cid=aff_fingerflip_'
Similar story is with "paloaltonetworks.cz" that redirects users to a website of one of the Fortinet resellers, a direct competitor to Palo Alto Networks. Owned by a private company in Praha, the domain has nothing to do with Palo Alto brand.
More dangerous cases are websites like "trendmicrow.com" that collects personal data of Trend Micro customers pretending to be Trend Micro support. A Symantec's domain with typo "sytmantec.com" redirects users to random websites, hosting adult content and malware.
Here is a detailed statistics for each of the cybersecurity companies:
| Total Alerts | Test Results | |
| Akamai | 62 | View |
| Domain Squatting | 1,6% | |
| Traffic Theft | 85,4% | |
| Brand Theft | 8% | |
| Malicious Activities | 5% | |
| Unknown | 0% | |
| AVG | 43 | View |
| Domain Squatting | 2,3% | |
| Traffic Theft | 83,7% | |
| Brand Theft | 0% | |
| Malicious Activities | 14% | |
| Unknown | 0% | |
| BAE Systems | 32 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 75% | |
| Brand Theft | 3,1% | |
| Malicious Activities | 21,9% | |
| Unknown | 0% | |
| Barracuda Networks | 124 | View |
| Domain Squatting | 8% | |
| Traffic Theft | 88,7% | |
| Brand Theft | 0% | |
| Malicious Activities | 3,3% | |
| Unknown | 0% | |
| Check Point | 104 | View |
| Domain Squatting | 12,5% | |
| Traffic Theft | 87,5% | |
| Brand Theft | 0% | |
| Malicious Activities | 0% | |
| Unknown | 0% | |
| Cisco | 172 | View |
| Domain Squatting | 20,4% | |
| Traffic Theft | 72,7% | |
| Brand Theft | 0% | |
| Malicious Activities | 6,4% | |
| Unknown | 0,5% | |
| Cyberark | 17 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 100% | |
| Brand Theft | 0% | |
| Malicious Activities | 0% | |
| Unknown | 0% | |
| F5 Networks | 32 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 96,8% | |
| Brand Theft | 0% | |
| Malicious Activities | 3,2% | |
| Unknown | 0% | |
| FireEye | 29 | View |
| Domain Squatting | 6,9% | |
| Traffic Theft | 89,6% | |
| Brand Theft | 0% | |
| Malicious Activities | 3,5% | |
| Unknown | 0% | |
| Fortinet | 56 | View |
| Domain Squatting | 7,1% | |
| Traffic Theft | 89,2% | |
| Brand Theft | 0% | |
| Malicious Activities | 3,7% | |
| Unknown | 0% | |
| Gemalto | 13 | View |
| Domain Squatting | 7,6% | |
| Traffic Theft | 77,2% | |
| Brand Theft | 0% | |
| Malicious Activities | 7,6% | |
| Unknown | 7,6% | |
| Imperva | 14 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 92,8% | |
| Brand Theft | 0% | |
| Malicious Activities | 7,2% | |
| Unknown | 0% | |
| Infoblox | 44 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 100% | |
| Brand Theft | 0% | |
| Malicious Activities | 0% | |
| Unknown | 0% | |
| Juniper Networks | 65 | View |
| Domain Squatting | 4,6% | |
| Traffic Theft | 90,8% | |
| Brand Theft | 0% | |
| Malicious Activities | 4,6% | |
| Unknown | 0% | |
| Kaspersky | 59 | View |
| Domain Squatting | 3,3% | |
| Traffic Theft | 86,4% | |
| Brand Theft | 0% | |
| Malicious Activities | 8,7% | |
| Unknown | 1,6% | |
| LifeLock | 47 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 91,4% | |
| Brand Theft | 4,2% | |
| Malicious Activities | 4,4% | |
| Unknown | 0% | |
| NetScout Systems | 26 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 92,3% | |
| Brand Theft | 0% | |
| Malicious Activities | 7,7% | |
| Unknown | 0% | |
| Palo Alto Networks | 24 | View |
| Domain Squatting | 4,1% | |
| Traffic Theft | 83,3% | |
| Brand Theft | 0% | |
| Malicious Activities | 12,6% | |
| Unknown | 0% | |
| Proofpoint | 19 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 84,2% | |
| Brand Theft | 0% | |
| Malicious Activities | 15,8% | |
| Unknown | 0% | |
| Qualys | 25 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 88% | |
| Brand Theft | 4% | |
| Malicious Activities | 8% | |
| Unknown | 0% | |
| Radware | 42 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 97,6% | |
| Brand Theft | 0% | |
| Malicious Activities | 2,4% | |
| Unknown | 0% | |
| Rapid7 | 17 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 88,2% | |
| Brand Theft | 0% | |
| Malicious Activities | 11,8% | |
| Unknown | 0% | |
| Splunk | 43 | View |
| Domain Squatting | 2,3% | |
| Traffic Theft | 88,3% | |
| Brand Theft | 0% | |
| Malicious Activities | 9,4% | |
| Unknown | 0% | |
| Symantec | 83 | View |
| Domain Squatting | 2,4% | |
| Traffic Theft | 75,9% | |
| Brand Theft | 0% | |
| Malicious Activities | 21,7% | |
| Unknown | 0% | |
| Trend Micro | 11 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 54,5% | |
| Brand Theft | 0% | |
| Malicious Activities | 36,3% | |
| Unknown | 9,2% | |
| Secureworks | 14 | View |
| Domain Squatting | 0% | |
| Traffic Theft | 78,5% | |
| Brand Theft | 0% | |
| Malicious Activities | 14,4% | |
| Unknown | 7,1% |
Ilia Kolochenko, High-Tech Bridge’s CEO, says:
“Unfortunately, lack of international cooperation and jurisprudence enable fraudsters to make easy money on various illegal or at least unethical operations with domains. Even cybersecurity companies are being targeted these days, not only financial institutions or luxury brands.
The biggest concern is that relatively harmless techniques such as typosquatting and cybersquatting are now being aggressively used in pair with phishing and drive-by-download attacks.
At High-Tech Bridge, as a part of our continuous effort to make Web safer, we have created Domain Security Radar service to enable anyone to track illicit activities against a brand or a domain name.”
High-Tech Bridge Security Research Team regularly writes about web and mobile application security, privacy, Machine Learning and AI. Killing XSS and CSRF on web server layer
MIT: the future of cybersecurity belongs to hybrid of human brain and machine power