Lookalike domains and the Gates Foundation phish
Roughly 5.45% of newly registered domains each day are malicious, according to ICANN — covering phishing, botnets and malware — which works out to about 25,070 new malicious domains daily. Because registering a domain is simple, attackers can spin up fraudulent ones for phishing campaigns at little cost.
On July 16, 2020, an email appearing to come from the Bill & Melinda Gates Foundation was sent to many recipients asking for Bitcoin donations. The pitch: any donation made within seven days would be doubled. Its sender domain was nearly identical to the legitimate gatesfoundation.org, differing by a single letter, and was registered only minutes before the email went out using typosquatting.
SPF set up to improve delivery
To keep the spoofed mail landing in inboxes rather than spam folders, the attacker published an SPF record for the lookalike domain. Notably, the phish arrived one day after Bill Gates' Twitter account was compromised and used to post a message that closely matched the email.
Registration details and the tweet
The whois record for the domain shows how recently it was created.
Domain name: gatesfoundatlon[.]com
Registry Domain ID: 2546450570_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 0001-01-01T00:00:00.00Z
Creation Date: 2020-07-16T17:00:54.00Z
Registrar Registration Expiration Date: 2021-07-16T17:00:54.00Z
Registrar: NAMECHEAP INC
Registrar IANA ID: 1068
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.6613102107
Reseller: NAMECHEAP INC
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: addPeriod https://icann.org/epp#addPeriod
Registry Registrant ID:
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.
Registrant Street: P.O. Box 0823-03411
Registrant City: Panama
Registrant State/Province: Panama
Registrant Postal Code:
Registrant Country: PA
Registrant Phone: +507.8365503
Registrant Phone Ext:
Registrant Fax: +51.17057182
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID:
Admin Name: WhoisGuard Protected
Admin Organization: WhoisGuard, Inc.
Admin Street: P.O. Box 0823-03411
Admin City: Panama
Admin State/Province: Panama
Admin Postal Code:
Admin Country: PA
Admin Phone: +507.8365503
Admin Phone Ext:
Admin Fax: +51.17057182
Admin Fax Ext:
Admin Email: [email protected]
Registry Tech ID:
Tech Name: WhoisGuard Protected
Tech Organization: WhoisGuard, Inc.
Tech Street: P.O. Box 0823-03411
Tech City: Panama
Tech State/Province: Panama
Tech Postal Code:
Tech Country: PA
Tech Phone: +507.8365503
Tech Phone Ext:
Tech Fax: +51.17057182
Tech Fax Ext:
Tech Email: [email protected]
Name Server: dns1.registrar-servers.com
Name Server: dns2.registrar-servers.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2020-07-15T23:22:34.80Z <<<The Twitter message posted on July 15, 2020 demonstrates the same wording and offer.
Detecting campaigns like this requires more than comparing sender addresses to a blocklist. Area 1 combines analysis techniques built on insight from proactive web crawling and early identification of attacker campaign infrastructure to catch email from spoofed domains and accounts. Through preemptive threat hunting and a range of proprietary analysis methods, Area 1 surfaces phishing campaigns — including those riding on newly registered malicious domains — that other defenses miss.
