Ferris Bueller's Guide to Abuse Domain Permutations
summary
Research generates 3,457 subdomains across 16 major brands, finds Amazon controls 59% of its permutations while others hover near 10%, and uncovers live phishing, crypto-seed scams, malicious Chrome-extension installers, and hosted phishing kits. Methods include dns-twist, subdomain discovery, port scanning, screenshots, FishTank feeds, and an open-source ELQ dashboard; measurements show large-scale DNS bit-flip opportunities enabling interception. Defenses tested: RPZ sinkholing, Splunk alerts, image-replacement warnings and legal takedowns, all effective when paired with continuous monitoring.
AI-written summary · about
chapters (6)
related talks
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
32mSomething’s Phishy: See the Hook Before the Bait
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
48mDawn Of The Dead: The Tale Of The Resurrected Domains
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
59mCatching Malware En Masse: DNS and IP Style
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites