Abstract

Attackers use various domain squatting techniques to convince users that their services are legitimate. Previous work has shown that methods liketyposquatting, where single characters are removed or duplicated, can successfully deceive users.
In this paper, we present a study that evaluates how well participants distinguish malicious from benign domains before and after they learned and applied domain squatting techniques themselves. In a multi-part survey, 288 participants create 2,880 malicious domains based on common domain squatting techniques and rate both domains created by other participants and real-world phishing domains in terms of how convincing they are. Our key results show that participants have problems to identify legitimate domains as benign if they include unusual top-level domains, additional terms, or use subdomains. Moreover, participants rated domains created by other …

Date

2020

Authors

Florian Quinkert, Martin Degeling, Jim Blythe, Thorsten Holz

Book

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

Pages

263-276