When the Web becomes a trap: domain names in cyberattacks and phishing attempts

Each website is associated with a unique series of numbers, known as an IP address. These numbers are used by computers to establish a connection with the server hosting the data for the website in question. When visitors enter a domain name in the search bar, this triggers a query to a set of DNS (Domain Name System) servers. The DNS servers then respond by providing the IP address of the website's hosting server, making it accessible. Domain names were introduced to simplify access to websites, as IP addresses are too complex to remember. So, for web users to be able to access a site, it is necessary to give it a user-friendly name.

With the exponential increase in cyber attacks, domain names have become the Trojan horses of many attempts. Attackers use inventiveness to trick users into visiting a booby-trapped site.

Let's take a look at some examples and how to avoid falling into the net of cyber criminals.

Phishing attacks

Phishing attacks are one of the most common and pernicious uses of domain names. Attackers establish fraudulent domain names that mimic legitimate entities, such as financial institutions or well-known companies. These deceptive domain names are used to trick victims into committing personal information, such as login credentials or credit card numbers.

At the same time, attackers are also using domain names to hide the location of their command and control (C2) servers in malware attacks. By registering random domain names or hijacking legitimate websites to use as C2 infrastructures, attackers can evade detection and response by security defenses. This makes it difficult to track down the source of attacks and complicates the task of security experts in stopping these malicious activities.

Typosquatting

Another tactic used by attackers is "typosquatting". Here, they take advantage of common typos made by users when entering domain names. Attackers register domain names that resemble those of popular websites, but with subtle typos. For example, they might register " goggle.com "instead of " google.com" . These deceptive domain names redirect users to malicious websites that seek to steal their information.

Domain name diversion

Another means of exploiting domain names is "domain name hijacking". Attackers take control of legitimate, well-known domain names, sometimes by taking advantage of a domain name expiration or using theoretical hacking techniques. They then use these domain names to launch malicious attacks, distribute malware or send phishing e-mails. Victims are more likely to be fooled by these websites or e-mails, as they trust the reputation of the spoofed domain names.

Homograph attacks

Homograph attacks are another technique used by attackers. They exploit visually similar characters to create deceptive domain names. For example, they might use the Cyrillic character "а" in place of the Latin character "a" in a domain name. These domain names appear identical at first glance, but redirect users to malicious websites.

In addition to these techniques, there are also vulnerabilities and gaps in domain name management that are exploited by attackers. Domain name registration policies may be insufficient, allowing malicious individuals to register domain names without proper verification. In addition, there may be a lack of security measures and protocols put in place by domain name registrars.

How can you avoid being trapped?

Use web filtering solutions

Web filtering solutions (or web security gateways) check the destination website before authorizing user access to the resource. If databases of malicious sites are sufficiently comprehensive, this approach can protect the user even if he or she has inadvertently clicked on a link to a malicious domain.

Raising public awareness of cyberthreats

Raising public awareness of cyber threats is another essential step towards protection. We need to remind users to remain cautious when interacting with unknown domain names or suspicious e-mails. It's also important to encourage the use of anti-phishing software and secure browsers to reinforce our online security.

Promoting stronger domain name registration policies and enhanced security standards

To effectively combat cyber attacks, it is necessary to promote stricter domain name registration policies and establish security standards. Modern industry players must work together to strengthen defenses and adopt technologies such as DNSSEC to improve domain name security.