System and methods for spoofed domain identification and user training
Systems and methods are disclosed that minimize ongoing risk to an organization from user behaviors which magnify the severity of a spoofed domain. Systems and method are provided which enable an entity and users of an entity to identify potential harmful domains, combining search, discovery, reporting, the generation of risk indicators, end-user risk assessments, and training into a security awareness system.
1. A method comprising:
identifying, by one or more processors via one or more tools, a first number of a plurality of spoofed domains of a domain name of an entity;
identifying, by the one or more processes, a second number of the plurality of spoofed domains of the entity that are registered to one or more parties other than the entity;
determining, by the one or more processors, a level of spoof risk for each of a plurality of uniform resource locators (URLs) identifying one of the plurality of spoofed domains based at least on a comparison of the first number of the plurality of spoofed domains of the domain name of the entity to the second number of the plurality of spoofed domains of the entity that are registered to one or more parties other than the entity;
selecting, by the one or more processors, one or more URLs of the plurality of URLs registered to the one or more parties other than the entity based at least on the level of spoof risk, the one or more URLs of the plurality of URLs comprising one of punycodes or permutations of the URL of the domain of the entity; and
communicating, by the one or more processors, to one or more devices of one or more users an electronic training assigned a difficulty rating and configured to train the one or more users to identify between the domain of the entity and the spoofed domain of the selected one or more URLs.
2. The method of claim 1 , further comprising assigning, by the one or more processors, a difficulty rating to the electronic training campaign.
3. The method of claim 2 , further comprising generating, by the one or more processors, the electronic training campaign based at least on the difficulty rating and the selected one or more URLs of the plurality of URLs.
4. The method of claim 2 , further comprising determining, by the one or more processors, the difficulty rating based at least on a comparison between the plurality of spoofed domains to the domain of the entity.
5. The method of claim 1 , further comprising generating, by the one or more processors, the electronic training campaign based at least on one or more of the following; a difficulty rating, a profile of the one or more users, a training history of the one or more users, or a role of the one or more users.
6. The method of claim 1 , further comprising identifying, by the one or more processors, the one or more URLs of the plurality of URLs that are one of or more of the following: spoofed by typo squatting, URL hijacked, a sting site, a phishing URL or a fake URL.
7. The method of claim 1 , further comprising identifying, by the one or more processors, the one or more URLs of the plurality of URLs that are one of directed to or redirected to the domain name of the entity.
8. The method of claim 1 , further comprising identifying via mail exchange records of each of the plurality of URLs whether each of the plurality of URLs is registered to the one or more parties other than the entity.
9. A system comprising:
one or more processors, coupled to memory and configured to:
identify, via one or more tools, a first number of a plurality of spoofed domains of a domain name of an entity;
identify a second number of the plurality of spoofed domains of the entity that are registered to one or more parties other than the entity;
a level of spoof risk for each of a plurality of uniform resource locators (URLs) identifying one of the plurality of spoofed domains based at least on a comparison of the first number of the plurality of spoofed domains of the domain name of the entity to the second number of the plurality of spoofed domains of the entity that are registered to one or more parties other than the entity;
select one or more URLs of the plurality of URLs registered to the one or more parties other than the entity based at least on the level of spoof risk, wherein the one or more URLs of the plurality of URLs comprising one of punycodes or permutations of the URL of the domain of the entity; and
communicate to one or more devices of one or more users an electronic training configured to train the one or more users to identify between the domain of the entity and the spoofed domain of the selected one or more URLs.
10. The system of claim 9 , wherein the one or more processors are further configured to assign a difficulty rating to the electronic training campaign.
11. The system of claim 10 , wherein the one or more processors are further configured to generate the electronic training campaign based at least on the difficulty rating and the selected one or more URLs of the plurality of URLs.
12. The system of claim 10 , wherein the one or more processors are further configured to determine the difficulty rating based at least on a comparison between the plurality of spoofed domains to the domain of the entity.
13. The system of claim 10 , wherein the one or more processors are further configured to generate the electronic training campaign based at least on one or more of the following; a difficulty rating, a profile of the one or more users, a training history of the one or more users, or a role of the one or more users.
14. The system of claim 10 , wherein the one or more processors are further configured to identify the one or more URLs of the plurality of URLs that are one of or more of the following: spoofed by typo squatting, URL hijacked, a sting site, a phishing URL or a fake URL.
15. The system of claim 9 wherein the one or more processors are further configured to identify the one or more URLs of the plurality of URLs that are one of directed to or redirected to the domain name of the entity.
16. The system of claim 9 , wherein the one or more processors are further configured to identify via mail exchange records of each of the plurality of URLs whether each of the plurality of URLs is registered to the one or more parties other than the entity.