Systems and methods for detecting domain impersonation
The invention is a security system providing domain name authentication for intrusion and malware prevention. The system is configured to analyze domain names, specifically analyze network metadata associated with said domain names, and further identify domain names attempting to impersonate or spoof domain names associated with a trusted entity or party.
1. A system for domain name authentication, the system comprising:
at least one processor coupled to at least one memory containing instructions executable by the at least one processor to cause the system to:
maintain a database with a plurality of trusted domains;
analyze a domain, wherein analysis of the domain comprises comparing the domain with one or more of the plurality of trusted domains;
determine that the domain is similar but not identical to at least one of the trusted domains based on the comparison of the domain with one or more of the plurality of trusted domains;
determine a set of nameservers associated with the domain;
determine a set of nameservers associated with the at least one trusted domain that is similar but not identical to the domain;
determine if there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain, wherein determining if there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain comprises determining if the domain and the at least one trusted domain share a common set of nameservers; and
flag the domain as being legitimate or flag the domain as being illegitimate based on whether there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain.
2. The system of claim 1 , wherein the domain is associated with an undelivered message intended to be delivered to a recipient.
3. The system of claim 1 , wherein the domain is associated with a received email message, and wherein the system flags the domain name as being legitimate and the email message as safe or flags the domain name as being illegitimate and the email message as potentially harmful based on whether there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain.
4. The system of claim 3 , wherein the domain is associated with a sender of the email message.
5. The system of claim 1 , wherein determining that the domain is similar but not identical to at least one of the trusted domains based on the comparison of the domain with one or more of the plurality of trusted domains comprises:
determining that there is a positive level of resemblance between the domain and the one or more similar but not identical trusted domains of the plurality of trusted domains.
6. The system of claim 1 , wherein the domain is an unrecognized domain associated with a website, and wherein the system flags the domain as being legitimate and the website as safe or flags the domain as being illegitimate and the website as potentially dangerous based on whether there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain.
7. The system of claim 1 , wherein the instructions further cause the system to:
determine an identity of a registrar for the domain and an identity of a registrar for the at least one of the trusted domains that are similar but not identical to the domain from the at least one domain registration system;
compare the identity of the registrar for the domain with the identity of the registrar for the at least one of the trusted domains that are similar but not identical to the domain; and
flag the domain as being legitimate or flag the domain as being illegitimate based on whether the identity of the registrar for the domain is the same as or different than the identity of the registrar for the at least one of the trusted domains that are similar but not identical to the domain.
8. The system of claim 1 , wherein the instructions further cause the system to:
determine an identity of a host for the domain and an identity of a host for the at least one of the trusted domains that are similar but not identical to the domain from the at least one domain registration system;
compare the identity of the host for the domain with the identity of the host for the at least one of the trusted domains that are similar but not identical to the domain; and
flag the domain as being legitimate or flag the domain as being illegitimate based on whether the identity of the host for the domain is the same as or different than the identity of the host for the at least one of the trusted domains that are similar but not identical to the domain.
9. The system of claim 1 , wherein at least one nameserver is a cloud nameserver.
10. A method for domain name authentication, the method implemented by a computer security system and comprising:
maintaining a database with a plurality of trusted domains;
analyzing a domain, wherein analysis of the domain comprises comparing the domain with one or more of the plurality of trusted domains;
determining that the domain is similar but not identical to at least one of the trusted domains based on the comparison of the domain with one or more of the plurality of trusted domains;
determine a set of nameservers associated with the domain;
determine a set of nameservers associated with the at least one trusted domain that is similar but not identical to the domain;
determine if there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain, wherein determining if there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain comprises determining if the domain and the at least one trusted domain share a common set of nameservers; and
flagging the domain as being legitimate or flag the domain as being illegitimate based on whether there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain.
11. The method of claim 10 , wherein the domain is associated with an undelivered message intended to be delivered to a recipient.
12. The method of claim 10 , wherein the domain is associated with a received email message, and wherein the method flags the domain name as being legitimate and the email message as safe or flags the domain name as being illegitimate and the email message as potentially harmful based on whether there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain.
13. The method of claim 12 , wherein the domain is associated with a sender of the email message.
14. The method of claim 10 , wherein determining that the domain is similar but not identical to at least one of the trusted domains based on the comparison of the domain with one or more of the plurality of trusted domains comprises:
determining that there is a positive level of resemblance between the domain and the one or more similar but not identical trusted domains of the plurality of trusted domains.
15. The method of claim 10 , wherein the domain is an unrecognized domain associated with a website, and wherein the method flags the domain as being legitimate and the website as safe or flags the domain as being illegitimate and the website as potentially dangerous based on whether there is a match between the set of nameservers associated with the domain and the set of nameservers associated with the at least one trusted domain.
16. The method of claim 10 , further comprising:
determining an identity of a registrar for the domain and an identity of a registrar for the at least one of the trusted domains that are similar but not identical to the domain from the at least one domain registration system;
comparing the identity of the registrar for the domain with the identity of the registrar for the at least one of the trusted domains that are similar but not identical to the domain; and
flagging the domain as being legitimate or flag the domain as being illegitimate based on whether the identity of the registrar for the domain is the same as or different than the identity of the registrar for the at least one of the trusted domains that are similar but not identical to the domain.
17. The method of claim 10 , further comprising:
determining an identity of a host for the domain and an identity of a host for the at least one of the trusted domains that are similar but not identical to the domain from the at least one domain registration system;
comparing the identity of the host for the domain with the identity of the host for the at least one of the trusted domains that are similar but not identical to the domain; and
flagging the domain as being legitimate or flag the domain as being illegitimate based on whether the identity of the host for the domain is the same as or different than the identity of the host for the at least one of the trusted domains that are similar but not identical to the domain.
18. The method of claim 10 , wherein at least one nameserver is a cloud nameserver.