Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More
Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.
Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.
- Over 67 million malicious URLs and domains observed in H2 2022, up 52% over H1.
- Malicious JavaScript samples rose 99.3%, hosted across 4.8 million URLs and 1.6 million hostnames.
- United States hosts most malicious infrastructure, followed by Brazil and China.
- Case study documents a classic web skimmer infecting a Tranco top 1 million website.
- Daily impact included over 12 million HTTP and 60 million DNS requests to malicious assets.
- Vendors
- Palo Alto NetworksUnit 42
- Countries
- United StatesBrazilChina
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | personallydeliver.com | as shown in Figure 15. Figure 15. VirusTotal screenshot of personallydeliver[.]com . The original web skimmer in motor.js is not straightfor |
| sha256 | eaadde9a724180a0318c13a9399ec30bda7a3ec6399ff43b8b7207bf0e74332b | rity Lifecycle Review . Indicators of Compromise motor[.]js eaadde9a724180a0318c13a9399ec30bda7a3ec6399ff43b8b7207bf0e74332b URL hosting the malicious javascript personallydeliver[.]co |
From the original article
10 min read at unit42.paloaltonetworks.com
From July-December 2022, Unit 42 researchers have observed and analyzed over 67 million unique malicious URLs, domains and IPs, which we use to block associated malicious network traffic. We will cover the trends we have observed during the second half of 2022 based on our detections of malicious URLs, domains and IPs.
unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.