Measurement Study on Malicious Web Servers in the .nz Domain

Client-side attacks have become an increasing problem on the Internet today. Malicious web pages launch so-called drive-by-download attacks that are capable to gain complete control of a user’s machine by merely having that user visit a malicious web page. Criminals that are behind the majority of these malicious web pages are highly sensitive to location, language and economic trends to increase their return on investment. In this paper, a comprehensive measurement study of malicious web servers on the .nz domain is presented. The risk of driveby-download attacks has been compared with other domains showing no elevated risk for the .nz domain. However, a comprehensive assessment of the .nz domain showed the existence of malicious web pages across a variety of types of web pages. Blacklisting services showed limited success to protect against such malicious web pages. This is primarily attributed to the highly dynamic nature of malicious web pages. Over a period of eight months, the ...

• Type: Conference
• Year: 2009
• Where: ACISP
• Authors: Christian Seifert, Vipul Delwadia, Peter Komisarczuk, David Stirling, Ian Welch
• Keywords: .nz Domain, ACISP 2009, Malicious Web Pages, Malicious Web Servers