INFERMAL: Inferential analysis of maliciously registered domains

TL;DR

This study systematically analyzes factors influencing malicious domain registrations, revealing that lower costs and easier access significantly increase abuse, providing insights for developing targeted anti-abuse strategies.

Contribution

It introduces a comprehensive feature set and uses regression analysis to quantify how economic and operational factors impact malicious domain registration.

Findings

Lower registration fees increase malicious domains by 49%.

Availability of free services boosts phishing activities by 88%.

API access correlates with a 401% rise in malicious domains.

Abstract

Cybercriminals have long depended on domain names for phishing, spam, malware distribution, and botnet operation. To facilitate the malicious activities, they continually register new domain names for exploitation. Previous work revealed an abnormally high concentration of malicious registrations in a handful of domain name registrars and top-level domains (TLDs). Anecdotal evidence suggests that low registration prices attract cybercriminals, implying that higher costs may potentially discourage them. However, no existing study has systematically analyzed the factors driving abuse, leaving a critical gap in understanding how different variables influence malicious registrations. In this report, we carefully distill the inclinations and aversions of malicious actors during the registration of new phishing domain names. We compile a comprehensive list of 73 features encompassing three main latent factors: registration attributes, proactive verification, and reactive security practices. Through a GLM regression analysis, we find that each dollar reduction in registration fees corresponds to a 49% increase in malicious domains. The availability of free services, such as web hosting, drives an 88% surge in phishing activities. Conversely, stringent restrictions cut down abuse by 63%, while registrars providing API access for domain registration or account creation experience a staggering 401% rise in malicious domains. This exploration may assist intermediaries involved in domain registration to develop tailored anti-abuse practices, yet aligning them with their economic incentives.