Alexa’s top one-million showcases malicious domains

by Steve Ragan - Jan 13 2011, 20:32

Alexa’s list of the top one-million domains on the Internet contains at least 150 sites linked to Rogue anti-Virus and other scams, researchers at Zscaler have found. While the domains are low on the list, they show just how much traffic criminals can generate to fund their activities.

Zscaler’s Mike Geide posted his initial findings to the company blog, noting that the number of malicious domains discovered, “illustrates the popularity and the potential profitability of distributing software that cleans (or claims to clean) infected systems.”

“To begin with, there are 150 domains in the top list that contain the string ‘virus’,” he explained.

By looking at the domains discovered, Geide added, it is difficult to establish if a site is malicious based on the domain name alone. In addition, many of the domains discovered appear to be a mix of authorized and unauthorized affiliate accounts.

“…it is difficult to determine if the wares being peddled on the site are legitimate or malicious. The volume and sometimes "pushy" nature of anti-virus related sites further adds to the confusion… but there are malicious sites sprinkled in the results as well...,” he wrote.

The highest ranking domain, 'antivirus-defender.ru', is a typical Rogue anti-Virus domain with JavaScript pop-ups written in Russian. This domain has a twist, however, as it prompts the user to send an SMS message to purchase a download code for the fake security software.

In 2010, Rogue anti-Virus applications were an easy source of money for criminals. Using Black Hat SEO techniques, where legitimate search terms are hijacked to allow malicious domains a higher rank, Rogue anti-Virus sites accounted for 85 percent of the domains discovered by Zscaler in December alone.

Given the popularity of targeting searches related to current events, it is no surprise to see malicious domains rank so high on Alexa. However, Alexa is doing its part by warning many users of potential risks; and Google’s initiatives, which inform users about harmful search results, are helping as well.

Geide’s post can be read here. He expects to provide more research on the Alexa findings in a separate post.