* [Blog](https://www2.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www2.paloaltonetworks.com/blog/corporate/) * [未分类](https://www2.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant) * 知名品牌域名最易被模仿抢注，用于欺骗消费者... # 知名品牌域名最易被模仿抢注，用于欺骗消费者 [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2020%2F09%2Fcybersquatting%2F%3Flang%3Dzh-hans) [](https://twitter.com/share?text=%E7%9F%A5%E5%90%8D%E5%93%81%E7%89%8C%E5%9F%9F%E5%90%8D%E6%9C%80%E6%98%93%E8%A2%AB%E6%A8%A1%E4%BB%BF%E6%8A%A2%E6%B3%A8%EF%BC%8C%E7%94%A8%E4%BA%8E%E6%AC%BA%E9%AA%97%E6%B6%88%E8%B4%B9%E8%80%85&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2020%2F09%2Fcybersquatting%2F%3Flang%3Dzh-hans) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2020%2F09%2Fcybersquatting%2F%3Flang%3Dzh-hans&title=%E7%9F%A5%E5%90%8D%E5%93%81%E7%89%8C%E5%9F%9F%E5%90%8D%E6%9C%80%E6%98%93%E8%A2%AB%E6%A8%A1%E4%BB%BF%E6%8A%A2%E6%B3%A8%EF%BC%8C%E7%94%A8%E4%BA%8E%E6%AC%BA%E9%AA%97%E6%B6%88%E8%B4%B9%E8%80%85&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/2020/09/cybersquatting/?lang=zh-hans&ts=markdown) [](mailto:?subject=知名品牌域名最易被模仿抢注，用于欺骗消费者) Link copied By [Unit 42](https://www.paloaltonetworks.com/blog/author/unit-42/?lang=zh-hans&ts=markdown "Posts by Unit 42") Sep 02, 2020 1 minutes [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [威脅情報](https://www.paloaltonetworks.com/blog/tag/%e5%a8%81%e8%84%85%e6%83%85%e5%a0%b1/?lang=zh-hans&ts=markdown) This post is also available in: [繁體中文 (繁体中文)](https://www2.paloaltonetworks.com/blog/2020/09/cybersquatting/?lang=zh-hant "切换到 繁体中文(繁體中文)") 网络犯罪分子利用域名在互联网上的重要作用，注册与现有域名或品牌相关的名称，意图从用户犯错中谋利。这种行为称为"域名抢注"，虽然域名抢注不一定对用户有害，但遭抢注的域名经常被利用或变更以用于网络攻击。 Palo Alto Networks（派拓网络）威胁情报团队Unit 42旗下的域名抢注检测系统发现，2019年12月间共有13,857个域名遭抢注，平均每天450个。情报团队发现，其中有2,595个 （18.59%）遭抢注的域名为恶意，经常发布恶意软件或进行网络钓鱼攻击，另有5,104个 （36.57%）遭抢注的域名对访客构成高风险，意味着这些域名与恶意网址有关，或使用防弹主机（bulletproof hosting）。 根据调整后的恶意比率，Palo Alto Networks（派拓网络）列出在2019年12月最常被滥用的20个域名。这些域名是许多抢注域名的目标，或模仿的大部分抢注域名被确认为恶意。研究发现，域名抢注分子倾向于那些有利可图的目标，例如主流搜索引擎及社交媒体、金融、购物和银行网站，并通过网络钓鱼和诈骗，窃取敏感凭证或金钱。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/09/chart-18.png) *图一：* *2019* *年* *12* *月最常被滥用的* *20* *大域名排行榜* 由2019年12月至今，Palo Alto Networks（派拓网络）观察到不同恶意域名的不同目的： * **网络钓鱼：** 一个模仿富国银行的域名（secure-**wellsfargo** \[.\]org）以窃取客户的敏感信息为目的，包括邮件凭证和ATM PIN码。此外，一个模仿亚马逊的域名 （**amazon**-india\[.\]online）会窃取用户凭证，特别针对印度的手机用户。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/09/Screen-Shot-2020-08-28-at-7.25.45-PM.png) *图二：伪造的* *Amazon* *网站：* ***amazon*** *-india\[.\]online* * **传播恶意软件：** 一个模仿三星的域名（**samsung** eblya**iphone**\[.\]com）带有恶意软件Azorult，能窃取信用卡资料。 * **命令和控制** **(C2)** \*\*：\*\*模仿微软的域名（microsoft-store-drm-server\[.\]com和 microsoft-sback-server\[.\]com）试图进行C2攻击，危害整个网络。 * **再付费欺诈：** 数个模仿Netflix的钓鱼网站（例如**netflix**brazilcovid\[.\]com）首先以小金额的首次付款优惠诱使用户订购减肥药等产品。但是，如果用户在促销期后没有取消订购，其信用卡会被收取更高的费用，通常为50至100美元。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/09/word-image-65.png) *图三* *a* *：* ***netflix*** *brazilcovid\[.\]com* *上伪造的* *Netflix* *主页* ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/09/word-image-67.png) *图三* *b* *：以社交工程诈骗用户的奖励邮件* * **潜在有害程序（** **Potentially unwanted program** **，** **PUP** \*\*）：\*\*模仿沃尔玛及三星的域名（walrmart44\[.\]com和samsungpr0mo\[.\]online）传播潜在有害程序，例如间谍软件、广告软件或浏览器扩展功能。这些域名通常会执行有害变更，例如更改浏览器的默认页面或劫持浏览器以插入广告。值得一提的是，这个三星域名看起来像是一个合法的澳大利亚教育新闻网站。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/09/word-image-62.png) *图四：点击来自* ***samsung*** *pr0mo\[.\]online* *的警告信息后，出现伪造的病毒扫描页面* * \*\*技术支持欺诈：\*\*一些模仿微软的域名（例如microsoft-alert\[.\]club）试图威吓用户为伪造的客户支持服务付费。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/09/word-image-63.png) *图五：* *microsoft-alert\[.\]club* *上伪造的技术支持页面* * \*\*奖励欺诈：\*\*一个模仿Facebook的域名（facebookwinners2020 \[.\] com）以免费产品或金钱等奖励欺骗用户。用户需要在表格填写出生日期、电话号码、职业和收入等个人信息，才能领奖。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/09/word-image-70.png) *图六：* ***facebook*** *winners2020\[.\]com* *上索取个人资料的表格* * **域名停放：** 一个模仿加拿大皇家银行的域名（rby**royalbank**\[.\]com）利用流行的域名停放服务ParkingCrew，根据浏览该网站的用户数量及广告点击率来赚取利润。 Unit 42研究人员调查了各种域名抢注伎俩，包括误植抢注（typosquatting）、组合抢注 （combosquatting）、级别抢注（level-squatting），比特抢注（bitsquatting）及同形异义字抢注（homograph-squatting）。恶意分子可以利用这些伎俩传播恶意软件或进行欺诈和网络钓鱼活动。 Palo Alto Networks（派拓网络）特别开发了自动化系统检测域名抢注，能够从新注册的域名以及被动DNS（pDNS）数据中捕捉新出现的活动。Palo Alto Networks（派拓网络）持续检测目前活跃的网络域名抢注------识别恶意及可疑的域名抢注，并将其指定为适当的类别，例如网络钓鱼、恶意软件、C2或灰色软件。Palo Alto Networks（派拓网络）的多个安全订阅服务已提供针对这些域名类别的保护措施，包括[URL过滤](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/url-filtering.html)和[DNS安全](https://www.paloaltonetworks.com/products/threat-detection-and-prevention/dns-security)。 Palo Alto Networks（派拓网络）建议企业屏蔽并密切监测来自这些域名的网络流量，而消费者则应确保正确输入域名，并在进入任何网站前再次确认域名所有者是否可信。有关如何防范网络攻击的更多技巧，请点击[此处](https://www.paloaltonetworks.com/blog/2020/04/network-working-from-home/)。 如欲了解此次研究的更多详情，请浏览[Unit 42 博客文章](https://unit42.paloaltonetworks.com/cybersquatting/)。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/04/QR-Code-WechatIMG1252.jpeg) 敬请关注Palo Alto Networks（派拓网络）官方微信账号 *** ** * ** *** ## Related Blogs ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### AI代理已經來臨，威脅也隨之而來](https://www2.paloaltonetworks.com/blog/2025/05/ai-agents-threats/?lang=zh-hant) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Strata Copilot - 加速迈向自主网络安全的未来](https://www2.paloaltonetworks.com/blog/network-security/strata-copilot/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 防火墙已死？至少本世纪不会！](https://www2.paloaltonetworks.com/blog/2023/08/ngfw-is-not-dead-yet/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 面对性命攸关的时刻，如何实现可靠的医疗物联网安全](https://www2.paloaltonetworks.com/blog/2022/12/medical-iot-security-to-depend-on/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 利用业界首创的 AIOps for NGFW 革新防火墙运行](https://www2.paloaltonetworks.com/blog/2022/03/industry-first-aiops-for-ngfw/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Prisma Access 是保护远程用户安全的领先云服务](https://www2.paloaltonetworks.com/blog/2021/08/prisma-access-leading-cloud-service-secure-remote-users/?lang=zh-hans) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language