Analysis of domains reported for phishing reveals a disturbing number of exact brand matches and brand deception 

Dr. Colin Strutt and Dave Piscitello, Interisle Consulting Group

In Interisle’s 2023 Phishing Landscape Study, we analyzed brands identified by the phishing feeds that we collect at the Cybercrime Information Center to show which brands were most frequently phished from May 2022 to April 2023. In cases where no brand was identified by our feeds, we searched for exact brand matches in the domain name itself.

In the Study, we noted that the number of brands being targeted by phishing attacks has increased since we began reporting in 2020. For the current period, we reported the 10 brands most frequently impersonated brands in phishing attacks. For convenience and reference, we’ve copied the Study table to this post.

In this post, we share measurements where domain names reported for phishing included exact matches of brand names. We’ll draw some conclusions and recommendations based on what we found.

Fear, Uncertainty, and… Deception!

Criminals often register legitimate-looking domain names for phishing attacks as part of the impersonation or deception that facilitates the perpetration of a fraud. Some make no effort to create deceptively similar names but include the exact brand in the composition of domain names that they register for phishing campaigns (e.g., applesupport.cf, amazonpaymentservlce.ga, apple-verification.xyz).

We recently received “account recovery” phishing email that uses an exact-match domain - facebookmail.com - to impersonate Facebook.

Domains composed using “exact matches” often victimize the most vulnerable users, for example, the elderly or least technically savvy members of society.

Criminals don’t hesitate to register such names because they know from experience that most registrars and registry operators have no policy or legal obligation to screen for well-established brand names at the time of domain name registration.

We set out to determine how often phishers used exact-match brands in domain names they were able to register. For this analysis, we examined the domain names reported for phishing from May 2022 to April 2023. The 10 brands where exact-brand strings were used in phishing attacks were:

Accepting registrations with exact matches of brands in domains allows phishers to victimize the most vulnerable users, but when we examined our data, we found that while phishers could use any registrar for their exact-match domains, they clearly favored some over others.

Next, we present a list of registrars, ranked by the number of exact-match domains that they allowed to be registered which were subsequently reported as phishing domains. In the table, we also show, for each registrar, the number of different brands for which we were able to find exact matches.

We next searched for registrars with the largest numbers of exact-match phishing domains of frequently impersonated brands (minimum 100 domains).  Here’s where phishers go to register exact-match domains for specific brands:

Effecting change

These findings suggest that preventing registration of domain names containing exact matches of brands would remove one form of deception from the phishers’ toolkit. This is a straightforward matter of searching for and preventing (or delaying) registration of trademarks. This one measure won’t prevent phishing, but it removes from the phishing supply chain the domain names that take advantage of the most vulnerable users.

Voluntary adoption of this or a similar policy and process appears to have had a positive effect. As we noted in our 2023 Phishing Landscape Study, the registrar NameCheap limits the “self-registration” of domain names with notable brand names and phrases in them. When Namecheap determines that a domain name submitted for registration matches a name in their restricted phrases list, it denies the request. The requester can contact support to argue their case or they can try a different name.

We reviewed phishing activity attributed to domain names registered at Namecheap and note that both the number of phishing domains has gone down, perhaps because of this new policy, and that the number of exact-match phishing domains and of phishing domains containing exact-match of brand has also gone down, quite significantly.

Voluntary adoption is welcomed but global and uniform adoption is better

Voluntary adoption of preventative measures is a welcomed change. It’s too early to tell how phishers will respond, but if the domain industry relies on voluntary adoption alone, phishers will shop elsewhere for exact-match domains. A uniform policy across gTLD registrars and parties that register domains for ccTLD operators would be more effective, particularly one that would ensure the uniform adoption by domain registration service providers for gTLDs and ccTLDsof a formal list such as the WIPO Global Brand Database.

Litigation is an alternative to proactive measures to prevent brand impersonation.

In 2023, Meta sued Freenom for cybersquatting violations and trademark infringement, joining Microsoft, Verizon, Yahoo! and others who filed similar suits in prior years. In 2020, Meta sued NameCheapfor claims including false designation of origin and trademark infringement, and the parties settled in April 2022. We can only speculate whether Namecheap’s adoption of a “restricted phrases” policy was coincident to or a consequence of the lawsuit, but as we observed in our 2023 Phishing Landscape Study, “In the absence of more effective mitigation measures and broader cooperation, litigation has shown to be an effective tool in stemming abuse.”

We would not be surprised to see any of the frequently impersonated brands mentioned in this post were to take legal action against registrars where trademark infringement is most egregious.