Phishers continue to like cheap domains.
Interisle published its Phishing Landscape 2024 report today, naming top level domains and registrars commonly used in phishing attacks.
The company analyzed 1.9 million phishing attacks that took place between May 2023 and April 2024.
Notably, this period began shortly after Freenom, a phisher’s favorite because of its free country code domain registrations, stopped offering registrations.
Interisle says the shutdown forced phishers to find new favorites. They overwhelmingly moved to cheap new top level domains and free subdomains such as blogspot addresses.
42% of all domains reported for phishing were registered in new TLDs, up from 25% the year prior. Subdomains use was up 51% to over 450k reported names, representing 24% of all phishing attacks.
While .com had the highest number of phishing domains reported, it was quite small relative to the size of the zone (over 150 million domains).
The report singled out .top, with over 100,000 phishing domains reported on a domain base of under 3 million. (More than 3 million .top domains are now registered, and ICANN sent a breach notice to the company last week.)
Interisle analyzed the percentage of domains in TLDs that were used for phishing. The top five were:
- .lol
- .bond
- .support
- .top
- .sbs
The organization noted that a common thread is low pricing, as shown in this chart:
All but three of the 35 gTLDs with the highest phishing rates were available for under $5, ten were available for under $1, and 27 for under $2.
Interisle’s report said that high incidents of phishing can be determinantal to top level domains:
High scores are a liability for registry operators. High yearly phishing domain scores erode the reputation of a TLD. poor reputations. Risk-averse organizations have resorted to blocklisting entire TLDs, and some blocklist providers and security companies assign increased risk scores to TLDs with poor reputations.
The report also named domain name registrars with a high rate of abuse.
An astonishing 45% of NiceNIC’s 100,000 gTLD domain names under management were reported for phishing. (NiceNIC has also been copying and republishing Domain Name Wire articles without permission.) Other top registrars based on abuse rate were URL Solutions, Aceville, WebNic, and OwnRegistrar.
The full report is available here.
Leave a Comment