Home / Industry

Majority of World’s Largest Companies Susceptible to Phishing and Brand Abuse Due to Improper Domain Security

DOMAIN SECURITY REPORT 2021 (download)

Despite 60% surge in dangerous third-party domain registrations, domain security is an underutilized security component to curb phishing and related ransomware attacks.

We have recently released our annual Domain Security Report: Forbes Global 2000 Companies, which found that despite the shift to modernize business environments and operations among the Global 2000 companies, web domains remain dangerously under-protected.

Our research also shows that most Global 2000 companies continue to lag in the adoption of domain security measures. Most notably, 81% of companies are not using registry locks. Other concerning findings illustrate that domain security remains an afterthought for many brands:

  • 70% of homoglyph (fuzzy match) domains—a tactic commonly used in phishing and brand abuse—are owned by third parties
  • 57% of the Global 2000 are relying on off-the-shelf consumer-grade registrars who offer limited domain security mechanisms to protect against domain and DNS hijacking

“Basic domain security measures continue to get overlooked because they’re still not considered an essential component to a company’s broader phishing, business email compromise, or ransomware mitigation approach,” said Mark Calandra, president of CSC Digital Brand Services. “A focus on securing legitimate domains while monitoring for malicious domains in parallel needs to be a bigger priority for companies to stay protected and thwart cyber risk. Otherwise, companies are exposing themselves to significant threats to their cyber security posture, data protection, intellectual property, supply chains, consumer safety, revenue, and reputation.”

Our additional findings leave little doubt that bad actors are applying tactics to hide their tracks and accelerate their attempts to execute their attacks. The research found that among the 70% of third-party domains deemed suspicious:

  • 77% used domain privacy services or also had WHOIS details redacted
  • 43% are configured with MX email records, giving them the ability to send phishing emails
  • 56% were pointing to advertising, pay-per-click content, or being used for domain parking
  • 38% had inactive web content
  • 6% were pointing to brand impersonation and malicious content including phishing and potential malware delivery

The rise of cybercrime and digital fraud, along with a steady increase in domain registrations over the last 18 months, necessitates more industry oversight. At the same time, it’s imperative that companies get proactive with their domain security moving forward. Including security measures can help mitigate phishing—a common starting point in most ransomware attacks. Companies need to take a more aggressive cyber security approach to disrupt criminal activities taking place across their domain ecosystem.

Download the report now. >>

By CSC, We are the business behind business

We help effectively manage, promote, and secure our clients’ valuable brand assets against the threats of the online world. Leading companies around the world choose CSC as their trusted partner to gain control of their digital assets, maximize their online potential, and increase online security against brand risks.

Visit Page

Filed Under

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Related

Topics

Domain Names

Sponsored byVerisign

IPv4 Markets

Sponsored byIPXO

Threat Intelligence

Sponsored byWhoisXML API

Domain Management

Sponsored byMarkMonitor

Brand Protection

Sponsored byAppdetex

Cybersecurity

Sponsored byVerisign