Home / Blogs

Compromised Portfolios of Legitimate Domain Names for Sale

Dancho Danchev

Is the demand for access to compromised legitimate portfolios of domain names — where the price is based on the pagerank and is shaped by the number of domains in question — the main growth factor for the increasing supply of such stolen accounting data? Or is it the result of cybercriminals data mining their botnets for accounting data that would provide them with access to such portfolios of high trafficked domains with clean reputation? Moreover, would such a data mining approach made easily possible due to the availability of botnet parsing services and stolen accounting data dumps streaming directly from a botnet? And would this in fact be a more efficient approach in injecting their malicious presence on as many hosts as possible — next to the plain simple massive SQL injection approach?

As always, it's a matter of who you're dealing with, and their understanding of the exclusiveness of a particular underground item at a given period of time. This exclusiveness is inevitably going to increase due to the fact that there are several "vendors" that are already purchasing access to such portfolios, as well as compromised Cpanel accounts as a core business. They would later resell the access at a higher price, enjoying the underground market's lack of transparency, or directly monetize and break-even immediately. As for this particular proposition for an account with 404 domains in it, it's interesting to monitor how the seller is soliciting bids from multiple sources by leaving the price an open topic, clearly indicating his low profile into the underground ecosystem. How come? An experienced seller or buyer would be offering or requesting pagerank verification respectively.

With nearly each and every aspect of cybercrime already available as a service, or literally outsourced as a process to those supposedly excelling into a particular practice, building capabilities for data mining botnets are no longer a requirement. People behind the botnets monetize all the data coming from it by soliciting deals of accounting data dumps based on a particular country.

By Dancho Danchev, Independent Security Consultant. More blog posts from Dancho Danchev can also be read here.

Related topics: Domain Names, Security

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

ICANN London Recap Webinar

Four Reasons to Move from .COM to Your .BRAND Domain

DotConnectAfrica Delegates Attend the Kenya Internet Governance Forum

Introducing the New .ORGANIC Domain: A Trusted, Credible Space for Organic Products on the Web

.WANG - 15,000 Registrations on Day One of General Availability

Dot Brand: Why Your Brand Needs Its Own Top-Level Domain

Afilias Announces Start of .BLACK Sunrise Period

Radix Launches Three New TLDs in Sunrise With Backing from 50+ Registrar Partners

.WANG General Availability Opens on June 30, 2014

3 Questions to Ask Your DNS Host about Lowering DDoS Risks

Continuing to Work in the Public Interest

.Press Domain Names - The Changing Face of Journalism

Radix Announces .Website Launch Timeline

.Host Timeline Released As Pioneer Program Kicks Off

Verisign Named to the OTA's 2014 Online Trust Honor Roll

TLD Registry Sponsored Xinnet's Partner Conference in Nanjing

Victorian Government & ARI Agree to Long-Term .melbourne Partnership

.WANG Enters Landrush This Week

Public Interest Registry Offers New Internationalized Domain Names to General Public

4 Minutes Vs. 4 Hours: A Responder Explains Emergency DDoS Mitigation

Sponsored Topics