In its Domain Fraud Report for 2019, the company said that domain fraud had become easy due to the cheapness of domains. It was also easy for malicious attackers to remain anonymous due to privacy features offered by most registrars.

The report was compiled using multiple WHOIS sources, the company's visibility into email and other proprietary data sources. Proofpoint said domain creation dates were not always available in WHOIS records, and hence some domains, top-level domains or registrars may have been skipped.

Registrars were identified by use of IANA numbers which are not always available in WHOIS responses. A total of about 350 million domains were scanned for the report.

Another finding of the report was that most businesses were affected by fraudulent domains, with 76% of its customers finding similar domains as their brands. The number of customers was not specified.

Among top retail brands, more than 85% had domains selling counterfeit versions of their products, with the average retail brand detecting more than 200 such imitations.

Proofpoint claimed most fraudulent domains were active, with more than 90% associated with a live server. More than 15% had mail exchanger records which meant they could be sending or receiving email. About 25% had security certificates.

Ninety-four percent of Proofpoint's customers had at least one fraudulent domain posing as their brand and sending email. Additionally, the company said it found some fraudulent domains sending low volumes of email which are commonly associated with targeted and social engineering attacks.

The report claimed the creation of new TLDs such as .app and .icu were providing new opportunities for the registration of fraudulent domains. "Our research suggests that attackers rushed to register domain names with the new TLDs. These fraudulent domains resembled '.com' domains owned by top brands. Google’s .app TLD, for example, was an especially attractive target," the company said.

More than 1500 TLDs exist now, with more than 300 being country-code TLDs and a growing list of more than 1200 generic TLDs. The .com domains were the most popular for new registrations on a monthly basis.

Among the fraudulent domains registered in 2018, 95% resolved to an IP address, 94% had a HTTP response, 16% had an MX record and 26% had a security certificate, the report said. The top TLDs for these domains are given below:

Among registrars favoured by fraudulent domain registrants, some allowed payment in bitcoin and offered free WHOIS privacy, which made them an attractive option.

Graphics: courtesy Proofpoint