In an effort to pounce on the low levels of baby formula issue, data from a global assessment of domain registrations since 2021 show 84 percent of baby formula-related domains were registered by third parties.
The rise in fake registrations coincides with the turbulent supply chain issues the industry experienced this year, and registration characteristics appear designed to end up as attack vehicles, according to a report by CSC.
Baby formula is just one case, there has been a similar surge targeting commercial organizations and within the semiconductor industry. CSC’s research shows 95 percent of domains registered in the same time period are tied to third parties. This assessment is part of CSC’s latest report, “Where Domain Security Meets the Supply Chain Crunch.”
Between January 2021 and May 2022, CSC found within third-party registered domains, 93 percent of baby-formula-related and 79 percent of semiconductor-related domains include privacy services, or have WHOIS details redacted. These are steps taken with the intent to conceal true identities and reveal potential fake domain registrations and fraudulent activity. In addition, 26 percent of baby formula-related and 44 percent of semiconductor-related domains are configured with MX email records – a key mechanism used to disseminate phishing emails.
“Companies need to understand how their choice of domain registrar impacts their organization’s overall security posture and the probability of their employees and customers falling victim to fraud,” said Mark Calandra, president of CSC Digital Brand Services. “Consumer-grade registrars have repeatedly been attacked over the last few years, and do not provide the security controls needed to protect clients’ vital domain names from domain and DNS threats. Moreover, many consumer-grade registrars offer services like name spinning and domain auctioning that promote the registration of confusingly similar names that not only infringe on established brands but are often used for phishing and other fraud-based attacks. As a result, these registrars monetize the goodwill brand owners have worked hard for, creating a revenue stream for themselves rather than serving the interests of enterprise clients who use their platforms. We believe the industry should follow best practice standards to prevent growing brand abuse and consumer safety concerns to ensure a more secure digital economy.”
Domain security hygiene remains an overlooked risk management component of an organization’s business operation and overall security posture.
CSC conducts an annual assessment of the domain security practices among the Global Forbes 2000. Through a cross assessment of the most recent report and CISA’s 16 critical infrastructure industries categories, food and agriculture and critical manufacturing are two industries with the weakest domain security hygiene and minimal year-over-year improvements.
Click here for more information on the report.