TLD Tracker: Exploring Newly Released Top
Unit 42 tracked 19 newly released top-level domains and found large-scale phishing, unwanted program distribution, and cybersquatting tied to TLD launch dates.
Researchers analyzed 19 new generic TLDs, including .zip, .bot, .ing, and .meme, released or approaching general availability over roughly 18 months. Data from passive DNS, registry zone files, newly registered domain feeds, and the Tranco top-1M list showed phishing campaigns, potentially unwanted program distribution, and domain squatting on these TLDs. Abuse correlated with each TLD's rollout phases, indicating attackers monitor general availability dates to register and weaponize domains. The IANA root database now lists over 1,000 generic TLDs.
- 19 new gTLDs tracked, including .zip, .bot, .ing, .meme, .phd, .prof
- Abuse includes phishing campaigns, PUP distribution, and domain squatting
- TLD general availability dates correlate with registration and abuse activity
- Over 1,000 generic TLDs now exist per the IANA root database
- TLD rollout phases: sunrise, landrush, early access, general availability
- Vendors
- Palo Alto Networks
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | choto.click | hese 112 domains subsequently redirected to URL paths under choto[.]click/vx/<string> that redirected to gambling websites. Figure |
| domain | choto.xyz | all 112 domains redirected to different URL paths under the choto[.]xyz domain. Figure 3. Redirection campaign with 112 domains f |
| domain | cloudwaysapps.com | iet[.]bot redirected to the URL at phpstack-1171166-4096956.cloudwaysapps[.]com/harriet.php Figure 6 illustrates how the picture/avatar d |
| domain | harriet.bot | root name string suffixed by .php . For example, the domain harriet[.]bot redirected to the URL at phpstack-1171166-4096956.cloudwa |
| domain | testvideo.mov | 3 domains resemble file names such as attachedpdf[.]zip and testvideo[.]mov . All of them point to the same set of nameservers denote |
From the original article
13 min read at unit42.paloaltonetworks.com
We investigated 19 new top-level domains (TLDs) released in the past year, which revealed large-scale phishing campaigns, distribution of potentially unwanted programs, torrenting websites, and even pranking and meme campaigns. We saw correlation between the new TLDs' general availability dates and their popularity, showing that different groups follow the launch of new TLDs and their lifecycle.
By Reethika Ramesh, Wanjin Li, Daiping Liu, Zhanhao Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.