When Diversity Meets Hostility: A Study of Domain Squatting Abuse in Online Banking

In today’s digital era, a large number of users rely on banking websites to perform financial transactions. The widespread adoption of online banking and the monetary value associated with each user account make banking websites a potential target for domain squatting. Domain squatting is a common practice in which malicious actors register internet domain names which are similar to popular domains. In this work, we study the prevalence of domain squatting abuse that exploits inconsistent internet domain names used by popular banks across several countries including US, UK, Australia, Germany, China and India. An attacker exploits the inconsistencies present in the domain names to generate similar looking domains and use them for malicious purposes such as domain takeover, malware propagation, click fraud, phishing, stealing traffic, distribution of ads and malware.In this paper, we present the first context-free grammar (CFG) based algorithm that models inconsistencies in domain names of banking websites and use it to generate candidate domains. We also provide a comprehensive categorization technique to classify candidate domains into four different categories: defensive, malicious, suspicious and unrelated. Our study reveals that more than 3,000 domains that are either malicious or suspicious, targeting popular banks across different countries around the world. Further, we noticed prevalence of three forms of domain squatting, namely comboTLDsquatting, full-name squatting and brandname squatting. We found that most of the malicious and suspicious domains are instances of comboTLDsquatting. Our work shows that only few organizations are protecting their brands against domain squatting abuse by performing defensive registration. Further, our study identified different strategies used by malicious actors during domain registration in order to evade detection from security researchers and trick victims into disclosing their credentials. In particular, we discover that malicious actors use similar words, same TLDs, grammar rules and registrar for registering domains which are used in benign domains.