Forest Global Training Partners

Cyber Risks · Cisco Talos

Domain dumpster diving

Summary: Cisco Talos re-registered expired domains and recorded the traffic still flowing to them, including more than 1.1 million ad requests from 236,776 unique IP addresses in under two weeks after registering a domain an ISP had been rewriting users' web traffic to inject ads from. Talos also received WordPress administrator emails, a Google account recovery email, a Facebook business page management invitation, and a live Netflix subscription email sent to made-up addresses at a keysmash domain, and found thousands of victims of a 2018 Mikrotik router zero-day still reaching out to the attacker C2 domain marchdom4.com nearly three years later.

Key Takeaway: Thousands of machines compromised in the 2018 Mikrotik attack were still querying an abandoned attacker domain years after the patch shipped, so anyone who re-registered it could claim those victims as their own and frame the original attackers. Every expired domain your organization once used remains a mailbox someone else can buy.

Read the original at Cisco Talos ↗

Topics
Malware
Related