Agarwal, Sharad;
Vasek, Marie;
(2025)
Examining Newly Registered Phishing Domains at Scale.
In:
Proceedings of the 24th Workshop on the Economics of Information Security (WEIS2025).
Workshop on the Economics of Information Security (WEIS): Tokyo, Japan.
Preview |
Text
CDA_Domains___WEIS_25.pdf - Accepted Version Download (2MB) | Preview |
Abstract
Phishing has been prevalent for over two decades, evolving recently into new forms, such as smishing or SMS phishing. Despite its long reign, it continues to be significant, deceiving victims globally. Cybercriminals compromise benign websites or register new domains to host phishing web pages. These pages impersonate brands and lure victims into providing their personal or financial details. The infrastructure criminals exploit differs for compromised benign websites and newly registered domains, requiring different mitigation approaches. In this paper, we investigate new domains that cybercriminals register with the sole intent to host phishing websites. We analyze 15 126 unique newly registered domains over a period of 11 months. These domains have an average lifetime of 8.6 days, and miscreants re-register old domains to use them for phishing. The third-party infrastructure these domains exploit differs greatly from infrastructure where hacked websites or the general population of websites concentrate. This allows us insight into where efforts can be taken to take down these maliciously registered domains quicker, from a relatively new ASN to the .COM registry to more anonymous registrars. From our findings, we derive a set of recommendations for stakeholders towards reducing the effects of this scourge.
Type: | Proceedings paper |
---|---|
Title: | Examining Newly Registered Phishing Domains at Scale |
Event: | 24th Workshop on the Economics of Information Security (WEIS2025) |
Location: | Tokyo, Japan |
Dates: | 23 Jun 2025 - 25 Jun 2025 |
Open access status: | An open access version is available from UCL Discovery |
Publisher version: | http://kmlabcw.iis.u-tokyo.ac.jp/weis/2025/ |
Language: | English |
Additional information: | This version is the author accepted manuscript. For information on re-use, please refer to the publisher’s terms and conditions. |
UCL classification: | UCL UCL > Provost and Vice Provost Offices > UCL BEAMS UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science |
URI: | https://discovery.ucl.ac.uk/id/eprint/10209951 |
Archive Staff Only
![]() |
View Item |