Agarwal, Sharad; Vasek, Marie; (2025) Examining Newly Registered Phishing Domains at Scale. In: Proceedings of the 24th Workshop on the Economics of Information Security (WEIS2025). Workshop on the Economics of Information Security (WEIS): Tokyo, Japan.

Preview

Text CDA_Domains___WEIS_25.pdf - Accepted Version Download (2MB) | Preview

Abstract

Phishing has been prevalent for over two decades, evolving recently into new forms, such as smishing or SMS phishing. Despite its long reign, it continues to be significant, deceiving victims globally. Cybercriminals compromise benign websites or register new domains to host phishing web pages. These pages impersonate brands and lure victims into providing their personal or financial details. The infrastructure criminals exploit differs for compromised benign websites and newly registered domains, requiring different mitigation approaches. In this paper, we investigate new domains that cybercriminals register with the sole intent to host phishing websites. We analyze 15 126 unique newly registered domains over a period of 11 months. These domains have an average lifetime of 8.6 days, and miscreants re-register old domains to use them for phishing. The third-party infrastructure these domains exploit differs greatly from infrastructure where hacked websites or the general population of websites concentrate. This allows us insight into where efforts can be taken to take down these maliciously registered domains quicker, from a relatively new ASN to the .COM registry to more anonymous registrars. From our findings, we derive a set of recommendations for stakeholders towards reducing the effects of this scourge.

Download activity - last month

Export as CSVXMLJSON

Download activity - last 12 months

Export as CSVXMLJSON

Downloads by country - last 12 months

Export as JSONXMLCSV

Archive Staff Only

View Item