BadDomains: Early Detection of Phishing Domains Registration

Phishing attacks often rely on impersonating a legitimate entity, such as a well-known company or a bank, with the intent to deceive individuals. A common tactic used by cybercriminals to conduct such an attack is to register a specific domain to host a phishing website on it. In this paper, we propose BadDomains, a system for the early detection of phishing domains' registration. BadDomains utilizes domain registry data about newly registered domains combined with knowledge about the current phishing situation, such as information about the most frequent impersonation targets, or suspicious domain contact information. An analysis of .pl phishing domain registry data, combined with the authors' CSIRT operational experience, helped in the design of new features. It also facilitated the extension of features already used in other solutions. The system's evaluation has been performed using information from .pl Top Level Domain (TLD) registry combined with CERT Polska's (Polish national CSIRT) public list of phishing domains, used as a ground truth. BadDomains has been compared to a similar detection system designed for .eu TLD called Premadoma, which was adapted to this work. The results showed that BadDomains achieved higher F1 scores than Premadoma. After operational deployment, the system proved to provide timely detections, uncovering unknown phishing domains.