{"id":4101,"date":"2022-01-03T10:52:37","date_gmt":"2022-01-03T05:22:37","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=4101"},"modified":"2022-01-03T10:52:38","modified_gmt":"2022-01-03T05:22:38","slug":"silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/","title":{"rendered":"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe"},"content":{"rendered":"\n
The number of malicious dormant domains is on the rise, and as investigators alert, approximately aged domains pose some form of danger. This was an awareness that hit the investigators when it was disclosed that the threat actor relied on domains registered years before their malicious activities began.<\/p><\/p>\n\n\n\n
According to that, efforts in analyzing the critically elderly domains before they get the chance to start the attacks and support malicious activities have picked up the pace. A report from our security researchers disclosed their investigators\u2019 researches after looking at tens of thousands of domains each day in whole September 2021.<\/p><\/p>\n\n\n\n
They come to the point that around 3.8% are straight-out malicious, 19% are suspicious, and 2% are unsafe for work environments.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
Why Permit a Domain Age?<\/strong><\/h2>\n\n\n\n
The main aim behind registering a domain long before the attacker will utilize it is to design a \u201cclean record\u201d that will avoid security detection systems from undermining the success of malicious campaigns. Typically, advance registered domains (NRDs) are more likely to be malicious, so the security solutions treat them as suspicious and have more chances to flag them.<\/p><\/p>\n\n\n\n
However, Unit42 explains in its report that strategically aged domains are three times more likely to be malicious than NRDs. In some cases, these domains stayed dormant for two years before their DNS traffic suddenly increased by 165 times, indicating the launch of an attack.<\/p><\/p>\n\n\n\n
What are the Symbols of \u201csnake eggs\u201d?<\/strong><\/h2>\n\n\n\n
An obvious sign of a malicious domain is the sudden spike in its traffic. Appropriate services that registered their domains and launched services months or years later exhibit gradual traffic growth. The domains that weren\u2019t destined for legitimate use generally have incomplete, cloned, or generally questionable content. As expected, WHOIS registrant details are missing too.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
The other clear symbol of a purposefully aged domain that is meant to be utilized in malicious operations is DGA subdomain generation. Domain Generation Algorithm (DGA) is an established method of creating different domain names and IP addresses to serve as advanced C2 communication points. The goal is to avoid detections and blacklists. By looking at the DGA element alone, Palo Alto\u2019s detectors identified two suspicious domains each day, spawning hundreds of thousands of subdomains on the day of its activation.<\/p><\/p>\n\n\n\n
A Realistic Example<\/strong><\/h3>\n\n\n\n
One notable case captured by Unit42 in September was a Pegasus spying campaign that used two C2 domains registered in 2019 and awoke in July 2021. DGA domains played a vital role in that campaign, carrying 23.22% of the traffic on the activation day, which spiked 56 times higher than normal DNS traffic volumes. A few days later, DGA traffic reached 42.04% of the total.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
Other real-world examples detected by the researchers include phishing campaigns that used DGA subdomains as cloaking layers that will direct ineligible visitors and crawlers to legitimate sites while pushing victims to the phishing pages.<\/p><\/p>\n\n\n\n
This shows that these DGAs serve not only as C2 domains but also as proxy layers that can be explicitly configured to the campaign’s needs. Finally, there were also cases of wildcard DNS abuse, with multiple subdomains all pointing to the same IP address.<\/p><\/p>\n\n\n\n
\u201cThese hostnames serve randomly generated websites that fill out some website templates with random strings,\u201d details the security researcher’s report. \u201cThey could be used for black hat SEO. Specifically, these web pages link to each other to obtain a high rank from search engine crawlers without providing valuable information.\u201d<\/p><\/p>\n\n\n\n
In most cases, strategically aged territories are used by cultivated actors who perform in a more organized context and have long-term plans. They’re used for leveraging DGA to exfiltrate data through DNS traffic, serve as proxy layers, or mimic the domains of well-known brands (cybersquatting). Although noticing DGA activity is still inquiring, defenders can achieve a lot by monitoring DNS data like queries, responses, and IP addresses and focusing on recognizing patterns.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"
The number of malicious dormant domains is on the rise, and as investigators alert, approximately aged domains pose some form of danger. This was an awareness that hit the investigators when it was disclosed that the threat actor relied on domains registered years before their malicious activities began. According to that, efforts in analyzing the […]<\/p>\n","protected":false},"author":2,"featured_media":4103,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"\n
Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"The number of malicious dormant domains is on the rise, and as investigators alert, approximately aged domains pose some form of danger. This was an awareness that hit the investigators when it was disclosed that the threat actor relied on domains registered years before their malicious activities began. According to that, efforts in analyzing the […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-01-03T05:22:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-01-03T05:22:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/Silent-Danger-One-in-five-elderly-Domains-is-Malicious-Risky-or-Unsafe-feature-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe\",\"datePublished\":\"2022-01-03T05:22:37+00:00\",\"dateModified\":\"2022-01-03T05:22:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/\"},\"wordCount\":644,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/\",\"url\":\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/\",\"name\":\"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2022-01-03T05:22:37+00:00\",\"dateModified\":\"2022-01-03T05:22:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/","og_locale":"en_US","og_type":"article","og_title":"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe - Xiarch Solutions Private Limited","og_description":"The number of malicious dormant domains is on the rise, and as investigators alert, approximately aged domains pose some form of danger. This was an awareness that hit the investigators when it was disclosed that the threat actor relied on domains registered years before their malicious activities began. According to that, efforts in analyzing the […]","og_url":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2022-01-03T05:22:37+00:00","article_modified_time":"2022-01-03T05:22:38+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/Silent-Danger-One-in-five-elderly-Domains-is-Malicious-Risky-or-Unsafe-feature-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe","datePublished":"2022-01-03T05:22:37+00:00","dateModified":"2022-01-03T05:22:38+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/"},"wordCount":644,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/","url":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/","name":"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2022-01-03T05:22:37+00:00","dateModified":"2022-01-03T05:22:38+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/silent-danger-one-in-five-elderly-domains-is-malicious-risky-or-unsafe\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Silent Danger: One in five elderly Domains is Malicious Risky, or Unsafe"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4101"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=4101"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4101\/revisions"}],"predecessor-version":[{"id":4107,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4101\/revisions\/4107"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/4103"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=4101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=4101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=4101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Silent-Danger-One-in-five-elderly-Domains-is-Malicious-Risky-or-Unsafe-image1\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/Silent-Danger-One-in-five-elderly-Domains-is-Malicious-Risky-or-Unsafe-image1-1024x562.jpg\")
<\/figure><\/div>\n\n\n\n![\"Silent-Danger-One-in-five-elderly-Domains-is-Malicious-Risky-or-Unsafe-image2\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/Silent-Danger-One-in-five-elderly-Domains-is-Malicious-Risky-or-Unsafe-image2-1024x636.png\")
<\/figure><\/div>\n\n\n\n![\"Silent-Danger-One-in-five-elderly-Domains-is-Malicious-Risky-or-Unsafe-image3\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/Silent-Danger-One-in-five-elderly-Domains-is-Malicious-Risky-or-Unsafe-image3.jpg\")
<\/figure><\/div>\n\n\n\n