Analysis of ~14K newly registered cybersquatted domains in Dec. 2019 finds that 55% were malicious and used for distributing malware or potentially fraudulent
Robert Lemos / Dark Reading :
Context & Ripple Effects
Dark Reading's analysis of ~14K newly registered cybersquatted domains from December 2019 put a number on what brand-protection teams had long assumed: a majority of lookalike registrations are not parked for resale but actively weaponized, with 55% distributing malware or set up for fraud. The finding slots into a broader body of work on domain-name abuse as criminal infrastructure.
Later coverage shows the problem evolving along two tracks rather than fading: bulk registration at scale, such as [[a:845813|Infoblox's discovery of an actor registering ~75K domains since April 2022 to run link-shortening services for cybercriminals]], and hijacking of legitimately owned names, from the [[a:849797|spam campaign abusing 21K abandoned domains and subdomains belonging to brands like eBay, MSN, and VMware]] to the [[a:869634|Squarespace flaw exploited to hijack crypto businesses' domains during the Google Domains migration]].
First-order effects
- Brand owners whose trademarks were among the ~14K squatted domains face immediate exposure: customers hitting lookalike domains have a better-than-even chance of landing on a malware-distribution or fraud page rather than a dormant placeholder.
- Security teams get a prioritization signal — newly registered lookalike domains warrant takedown requests and blocklist entries immediately, since the majority are malicious from day one.
Second-order effects
- Registrars and registries come under pressure to police registration patterns, pushing abusers toward the softer targets later coverage documented: expired domains left unclaimed by brands and registrar-side flaws exposed during platform migrations.
- The economics favor attackers either way — whether registering fresh lookalikes or repurposing abandoned brand domains, the cost of acquiring credible-looking web infrastructure stays low relative to the reach it provides.
Third-order effects
- If the pattern holds, the domain lifecycle itself — registration, lapse, and transfer — becomes a recognized attack surface requiring continuous monitoring, not just the live websites brands operate.
- As [[a:883089|CrowdStrike found intrusions increasingly malware-free, rising from 40% in 2019 to 79% in 2024]], domain-based social engineering and fraud infrastructure persists as the durable layer of the threat landscape even as payload preferences shift.
The trend: Domain-name abuse is consolidating into industrialized criminal infrastructure, with attackers shifting fluidly between bulk lookalike registration and hijacking of abandoned or mismanaged legitimate domains.