Source-linked AI summary
Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abuse
Panagiotis Kintis, Najmeh Miramirkhani, Charles Lever, Yizheng Chen, Rosa Romero-Gómez, Nikolaos Pitropakis, Nick Nikiforakis, Manos Antonakakis
TL;DR
Combosquatting combines popular trademarks with additional keywords, but its prevalence and abuse have not been well measured. This paper conducts the first large-scale longitudinal study using active and passive DNS data, finding that combosquatting is widespread, persistent, growing, and used across multiple forms of abuse.
Problem
Combosquatting has been studied less extensively than other squatting techniques, leaving limited large-scale evidence about its prevalence and full spectrum of abuse.
Method
The study combines more than 468 billion active and passive DNS records collected over almost six years with domain crawling, manual analysis, and threat-report cross-referencing.
Results
Combosquatting is more prevalent than typosquatting, often remains active for long periods, grows year over year, and supports phishing, social engineering, affiliate abuse, trademark abuse, and APT activity.
Takeaways & Limitations
Combosquatting is a real and growing threat that requires better protections and increased scrutiny from the security community.
Takeaways & Limitations
Because combosquatting lacks a generative model, companies cannot rely on a single algorithm to identify all domains for defensive registration.
Abstract
from arXiv · showhide
Domain squatting is a common adversarial practice where attackers register domain names that are purposefully similar to popular domains. In this work, we study a specific type of domain squatting called "combosquatting," in which attackers register domains that combine a popular trademark with one or more phrases (e.g., betterfacebook[.]com, youtube-live[.]com). We perform the first large-scale, empirical study of combosquatting by analyzing more than 468 billion DNS records---collected from passive and active DNS data sources over almost six years. We find that almost 60% of abusive combosquatting domains live for more than 1,000 days, and even worse, we observe increased activity associated with combosquatting year over year. Moreover, we show that combosquatting is used to perform a spectrum of different types of abuse including phishing, social engineering, affiliate abuse, trademark abuse, and even advanced persistent threats. Our results suggest that combosquatting is a real problem that requires increased scrutiny by the security community.
1 INTRODUCTION
Combosquatting is an understudied form of domain squatting that combines recognizable trademarks with keywords, yet large-scale evidence shows it is prevalent, persistent, increasingly active, and used for diverse abuse.
- Motivation: Combosquatting combines recognizable brand names with keywords, such as paypal-members[.]com and facebookfriends[.]com, but has received limited large-scale empirical study.Existing research often examined related squatting techniques or combosquatting only in phishing contexts.
- Study scope: The study analyzes more than 468 billion DNS records spanning almost six years and identifies 2.7 million domains targeting 268 popular US trademarks.The records come from both active and passive DNS datasets.
- Prevalence: Combosquatting domains are 100 times more prevalent than typosquatting domains despite being less studied.This comparison quantifies the scale of the phenomenon relative to a better-known squatting technique.
- Lexical characteristics: 50% of combosquatting domains add at most eight characters to the abused trademark, while 40% add a single token.The domains also favor words related to the trademark’s business category, producing more targeted combinations than random.
- Temporal behavior: Almost 60% of abusive combosquatting domains appear in the datasets for more than 1,000 days, and query activity increases year over year.These observations suggest that abusive domains often remain unremediated and that combosquatting activity is growing.
- Real-world abuse: Observed abuse includes phishing, social engineering, affiliate abuse, trademark abuse, and 65 domains used by Advanced Persistent Threat campaigns.The findings come from crawling and manual labeling, supplemented by public threat reports.
2 BACKGROUND
Combosquatting integrates an intact recognizable brand domain with added characters or words, distinguishing it from spelling-based squatting. The paper documents its use across phishing, malware delivery and command-and-control, trademark abuse, and SEO monetization.
- 2.2 Combosquatting Abuse: Combosquatting domains support diverse abuse, including social engineering, drive-by downloads, malware communication, SEO monetization, and phishing.The paper emphasizes that abuse extends beyond trademark infringement.
- 2.1 DNS Squatting & Combosquatting: Combosquatting preserves the original trademark while adding other characters or words, unlike typosquatting and bitsquatting.A domain qualifies when it contains the trademark and cannot be produced by the paper’s five typosquatting models.
- 2.2.1 Phishing: Phishing domains can closely resemble targeted organizations and host nearly identical pages, making detection difficult for everyday users.The Bank of America example embeds the brand in a long login-themed domain and pairs it with a visually similar phishing page.
- 2.2.2 Malware and Drive-by Attacks: Combosquatting can lure users into malware delivery through fake security warnings and apparent software updates.The AirBnB example uses a fake Flash update prompt to encourage downloading malicious software.
- 2.2.3 Monetization: Combosquatting domains can serve as malware command-and-control points, potentially helping communications evade manual analysis.The study also identifies more than 60 APT command-and-control domains in public targeted-attack reports.
- 2.2.3 Monetization: Trademark abuse and SEO monetization use related brand-associated offerings, including likely counterfeit products sold through infringing domains.The Victoria’s Secret example advertises likely counterfeit products at a lower price.
3 MEASUREMENT METHODOLOGY
The study measures combosquatting across selected popular trademarks by combining multiple DNS, abuse-labeling, certificate, and benign-activity datasets. It constructs trademark-specific domain sets to analyze the problem over time while controlling for unsuitable trademarks and potential false positives.
- 3.1 Trademark Selection: The study assumes adversaries include popular trademark names in effective second-level domains to lure victims into interacting with combosquatting sites.This motivates selecting popular domains as likely abuse targets.
- 3.1 Trademark Selection: 246 domains remained after manually filtering the top 500 US Alexa domains for common-word brands and trademarks that were too short.The retained domains form the study’s seed list and span 22 business categories.
- 3.2 Datasets: The measurement combines passive DNS, active DNS, public blacklists, APT reports, spam traps, malware feeds, Alexa rankings, and Certificate Transparency logs.These datasets support longitudinal measurement, abuse labeling, and benign-domain filtering.
- 3.2 Datasets: Passive DNS supplies successful resolutions and daily lookup volumes from a recursive server at the largest US Internet Service Provider.The dataset has collected DNS traffic since 2011.
- 3.2 Datasets: The Alexa-derived whitelist marks potentially benign domains using domains ranked in the top 10,000 for more than 90 consecutive days during the last five years.This reduces false-positive classification of abusive domains.
- 3.3 Dataset Construction: Combosquatting sets are derived by projecting selected trademarks into each raw dataset and combining malicious categories into C_abuse.The resulting sets include passive and active DNS, blacklist, APT, spam-trap, malware, and Alexa-specific collections.
4 MEASURING COMBOSQUATTING DOMAINS
Combosquatting domains are widespread, carefully constructed, increasingly active, and often remain undetected or unremediated for long periods. Their scale and threat model differ substantially from typosquatting, requiring dedicated analysis.
- Temporal Analysis: Combosquatting activity steadily increases, while malicious-domain lookup volume remains nearly uniform and security detection often lags initial observation.
- Combosquatting versus Typosquatting: Combosquatting domains are almost two orders of magnitude more numerous than typosquatting domains.
- Lexical Characteristics: 60% of identified combosquatting domains use fewer than ten characters beyond the original trademark, while 80% use fewer than 22.
- Lexical Characteristics: Almost 80% of domains contain at most two dictionary words, while 90% contain at most three words.
- Lexical Characteristics: 40% of combosquatting domains add a single token, and attackers favor trademark-related words that create targeted combinations.
5 COMBOSQUATTING IN THE WILD
Combosquatting domains are used across phishing, affiliate abuse, social engineering, trademark abuse, malware delivery, and command-and-control activity. Large-scale crawling and manual analysis reveal both diverse abuse and techniques intended to evade automated detection.
- Abuse in the Wild: Combosquatting domains support phishing, affiliate abuse, social engineering, and trademark abuse across nearly every investigated business category.
- Measurement Approach: The study crawled 1.3 million active-DNS combosquatting domains using 100 scriptable browser instances.
- Measurement Approach: The crawling pipeline sequentially screened domains for affiliate abuse, phishing, and other abuse categories, augmenting the malicious-domain set with domains missed by threat feeds.
- Evasion and Malware: Attackers used user-agent-dependent HTTP and JavaScript redirections, obfuscated code, parking pages, and malware downloads to vary domain behavior.
- Affiliate Abuse and Social Engineering: Combosquatting domains redirected users through affiliate identifiers, survey scams, fake rewards, and trademark-themed social-engineering pages.
6 DISCUSSION
The discussion assigns countermeasure responsibilities across registrants, trademark owners, registrars, and third-party domain-monitoring systems. Because combosquatting lacks a generative model, protection cannot rest on registrants alone.
- Scope of the problem: Combosquatting is more prevalent than typosquatting, remains active for months, and is used by botnets and targeted APTs to remain hidden in plain sight.The study also observed live phishing domains and trademark abuse through active crawling.
- Registrants: Combosquatting lacks a single generative model for producing likely abusive domains, limiting the usefulness of defensive registrations.The paper therefore argues that registrants cannot bear the full burden of protection.
- Trademark owners: Trademark owners should avoid benign combosquatting domains because they can train users to treat trademark-containing domains as legitimate.The paper recommends filepaths, subdomains, or TLDs instead for product advertising.
- Registrars: Registrars could flag newly registered domains containing popular trademarks, request additional information, or follow up to assess malicious use.Registrars that ignore abuse may eventually have their domains labeled suspicious by domain-intelligence systems.
- Third parties: Third-party systems that analyze newly registered domains can use popular-trademark presence as an additional signal for identifying malicious registrations.
7 RELATED WORK
Prior work extensively studied several forms of domain squatting and DNS-based abuse detection, but combosquatting received little focused attention. Before this study, the only other combosquatting work was a brief 2008 industry whitepaper.
- DNS Abuse: DNS research has used passive DNS data for security analysis, domain-reputation systems, abuse detection, and identifying potential ownership changes.
- Squatting Abuse: Squatting research has addressed typosquatting detection, domain-generation models, and crawled measurements of trademark abuse.
- Combosquatting: The only earlier combosquatting study was a 2008 whitepaper that tested traffic to 500 registered domains and found most sites filled with ads.It began with 30 trademarks and up to 50 generic keywords.
8 CONCLUSION
The paper provides the first large-scale empirical study of combosquatting, examining how attackers combine trademarks with targeted tokens to support several forms of abuse. Its findings indicate that combosquatting is persistent and growing, requiring stronger security protections.
- Findings: Combosquatting combines popular trademarks with added tokens to support social engineering, phishing, affiliate abuse, trademark abuse, and targeted attacks.
- Method: 468 billion DNS records collected over almost six years support the paper’s large-scale empirical analysis.
- Lexical analysis: Most combosquatting domains add only a single token, often selected for a particular business category, narrowing the potential search space for brands.
- Persistence: Many abusive combosquatting domains remain unremediated for extended periods, reaching up to 1,000 days in many cases.
- Implications: Combosquatting is a real and growing threat, and the security community needs better protections against it.
A.1 Selected Trademarks
The selected-trademark table organizes the trademarks used to identify combosquatting domains by category and provides an example trademark for each category.
- Selected Trademarks: The table lists each trademark category, the number of trademarks in that category, and one example trademark.
A.2 Most Frequent Words per Category
Frequent words in combosquatting domains often align with the trademark category being abused. Courier and financial trademarks also contain terminology associated with spear phishing and phishing campaigns.
- Trademark-related words closely correlate with the abused trademark category.Examples include apple, game, and phones for Computers/Internet, and president, vote, and elect for Politics.
- Courier and financial categories include trademarks previously targeted by spear phishing attacks.
- Tracking, delivery, service, and account appear in both phishing domains and phishing emails.
A.3 Combosquatting APT Domains
The paper identifies combosquatting domains related to Advanced Persistent Threats. These domains were found in public APT reports and the study’s CP and CA datasets.
- Table 11 lists combosquatting domain names related to Advanced Persistent Threats.
- The listed domains were found in public APT reports.
- The domains were also identified in the CP and CA datasets.