Report shows that more than 95% of websites in 10 new top-level domains are suspicious; .zip and .review ranked as worst offenders
Blue Coat Systems has revealed new research for consumers and businesses that shows the Top-Level Domains (TLDs), or “neighbourhoods,” most associated with suspicious websites. Among the key findings in the report are that more than 95 per cent of websites in 10 different TLDs are rated as suspicious, with that percentage increasing to 100 per cent for the top two highest ranking TLDs, .zip and .review.
Blue Coat analysed hundreds of millions of Web requests from more than 15,000 businesses and 75 million users to create “The Web’s Shadiest Neighbourhoods,” a new report that combines research with tips and tricks for Web users and enterprise security and IT departments looking to avoid viruses and other malicious activity. For this research, Blue Coat counted a domain as “shady” if it was rated in its database with a category such as:
Most Common Malicious Activity Less Common Malicious Activity
Spam Malware
Scam Botnet
Suspicious Phishing
Potentially Unwanted Software (PUS)
Domains in the database that were not classified in one of these ways were counted as “non-shady.”
Much has changed since the early days of the Internet when the Web had only six common top level domains (TLDs). Back then, what most consumers and businesses encountered were a small number of standard TLDs, such as .com, .net, .edu and .gov, as well as some “country code” domains like .fr (France), and .jp (Japan). However, since 2013, the number of new TLDs has skyrocketed. There has been an explosion of new neighbourhoods on the Web, many of which may be considered for web security purposes as neither safe nor friendly. By June 2015, the count of validly issued TLDs stood at over one thousand. As the number of TLDs has increased, so have the opportunities for attackers. These TLDs, with high numbers of shady sites dubbed “Shady TLDs” can provide fertile ground for malicious activity including spam, phishing, and distribution of Potentially Unwanted Software (PUS).
The Web’s Top 10 “TLDs with Shady Sites*”
Rank Top-Level Domain Name Percentage of Shady Sites
#1 .zip 100.00%
#2 .review 100.00%
#3 .country 99.97%
#4 .kim 99.74%
#5 .cricket 99.57%
#6 .science 99.35%
#7 .work 98.20%
#8 .party 98.07%
#9 .gq (Equatorial Guinea) 97.68%
#10 .link 96.98%
*As of August 15, 2015 – Percentages are based on categorisations of websites actually visited by our 75 million users. A TLD having 100 per cent shady sites correlates to sites categorised by Blue Coat.
Recent Risky Activity from the Web’s Shadiest Neighborhoods
The report also reveals examples of nefarious activity taking place on shady websites of some of the top ranked Shady TLDs, including the fourth most seemingly dangerous neighbourhood, .kim. Blue Coat researchers recently discovered websites serving up pages which mimic popular video and image sites and prompt unprotected visitors to unwittingly download malware.
“Due to the explosion of TLDs in recent years, we have seen a staggering number of almost entirely shady Web neighbourhoods crop up at an alarming rate,” said Dr. Hugh Thompson, CTO for Blue Coat Systems. “The increase in Shady TLDs as revealed by Blue Coat’s analysis is in turn providing increased opportunity for the bad guys to partake in malicious activity. In order to build a better security posture, knowledge about which sites are the most suspicious, and how to avoid them, is essential for consumers and businesses alike.”
Minimising the Risk for Businesses and Consumers As organisations and consumers look to safeguard themselves against these shady TLDs, they can draw key lessons from the report to inform and strengthen their security posture, including:
- Businesses should consider blocking traffic that leads to the riskiest TLDs. For example, Blue Coat has previously recommended that businesses consider blocking traffic to .work, .gq, .science, .kim and .country.
- Users should use caution to click on any links that contain these TLDs if they encounter them in search results, e-mail, or social network environments.
- If unsure of the source, hover the mouse over a link to help verify that it leads to the address displayed in the text of the link.
- “Press and Hold” links on a mobile device (not just click) to verify it leads where it says it does.
Full Report Available
Please click here to view a full copy of “The Web’s Shadiest Neighbourhoods.”
About Blue Coat Systems
Blue Coat is a leader in enterprise security, providing on-premise, hybrid and cloud-based solutions for protecting web connectivity, combating advanced threats and responding to security breaches. Blue Coat is the global market leader in securing connection to the web and counts nearly 80 percent of the Global Fortune 500 as its customers. Blue Coat was acquired by Bain Capital in March 2015. For additional information, please visit www.bluecoat.com.
