Dumbainhunter 2.0 : hunting malicious domains
Brynjar Örn Grétarsson, Ingi Þór Sigurðsson, Steinar Sigurðsson · 2020
By being able to detect Business Email Compromises (BEC), companies and organizations can be alerted and attacks prevented. However, detecting BEC attacks is problematic since they are global phenomena and employ a myriad of techniques to deceive people. Our proposal is to build upon an existing detection tool which monitors newly registered domains and finds domains that might be used in BEC attacks. We check for similarity between the newly registered domains and a whitelist of the domains we are protecting. Domains classified as similar are checked for additional publicly available information such as DNS and SSL records.