CAMBRIDGE, Mass. — The APWG, a global, independent coalition combating electronic crime, said it is making available a new advisory that examines the "abuse" of subdomain registries by criminals engaged in phishing attacks.
More than 10% of all phishing sites, representing tens of thousands of scams worldwide, originate on subdomains available for registration at subdomain registry services, APWG reported.
The APWG said subdomains are easily exploited due to their low- or no-cost pricing model, anonymity, easy setup, and lack of internal organization, dispute rules, or policing. Misappropriation of dynamic IP addressing, proxies, bots, and scam sites that disguise themselves with bank or credit card logos then play havoc from a wide variety of services and platforms which "host" these accounts unawares.
"Making Waves in the Phishers' Safest Harbors: Exposing the Dark Side of Subdomain Registries," investigated and authored by Dave Piscitello (ICANN) and Rod Rasmussen (Internet Identity), is available at no cost from the APWG at: www.antiphishing.org.
"Once a subdomain account is created, phishers are able to bilk unsuspecting and/or careless users from the scam sites they host," explained Piscitello.
Rasmussen said, "Phishing domains created as subdomains of free web hosting companies can be particularly difficult to take down. An attacker can create an account and host a site in minutes, in complete anonymity, with a hosting provider who has no formal abuse or dispute procedures. Many of these hosting companies have tens of thousands of subdomains, so it prevents responders from asking a registrar to suspend the parent domain."
The APWG, founded in 2003 as the Anti-Phishing Working Group, is a global industry, law enforcement, and government coalition focused on eliminating identity theft and fraud resulingt from phishing, e-mail spoofing, and crimeware. Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community and solutions providers. There are more than 1,800 companies, government agencies and NGOs participating in the APWG and more than 3,300 members worldwide.
