Security researchers at Akamai identify an average of 13 million newly observed domains (NOD) each month this year, representing about 20% of the NODs resolved in the same timeframe.
In a recent blog post, researchers at Akamai discuss how they go about identifying malicious domains. Considering that one of the techniques used by cybercriminals to avoid detection is to continually change domains, the watching of NODs makes sense.
According to Akamai, NODs (both malicious and legitimate) are abundant; approximately 12 million new NODs appear daily, of which, just above 2 million resolve in DNS.
And we’re not talking about legible domain names; according to Akamai, the domains are more like the following:
Domain Name Examples. Source: Akamai
In short, cybercriminals are utilizing about 20% of the NODs as part of their phishing and social engineering attacks, utilizing this continually updated set of domain names in an attempt to avoid detection as being malicious.
While the good guys – like the folks at Akamai – are working to stay vigilant, remember that all the efforts are reactive in nature; that is, the good guys can’t in theory get ahead of the bad guys, as no one knows what the bad guy’s next move is. So, in the world of NODs, the intent is to create heuristics rules (190 of them, according to Akamai) to help identify a NOD that’s malicious.
But it’s still possible that some NODs will make it through scrutiny and facilitate a phishing attack. This is one of the reasons that even with really strong security technologies in place, it’s necessary to arm your users with Security Awareness Training so they become part of your defense, spotting really ridiculous domain names – like the ones above – and see the emails for what they really are: an attack.
Are you aware that one of the
