Detecting Fake Network Device Sites in the DNS | WhoisXML API

Threat Reports

From Counterfeiting to Phishing: Cybersquatting Properties Target Network Device Makers

Fake network devices are being sold online, some of which can bypass security functions.1 Recently, a CEO was arrested for allegedly selling about a billion dollars’ worth of counterfeit Cisco devices.2

WhoisXML API researchers monitored the DNS for possible counterfeiting vehicles in the form of domains and subdomains. Below are some of our key findings.

  • We found 2,700+ cybersquatting properties added from 1 June to 8 August 2022 targeting five network device providers.
  • About 86% of the cyber resources actively resolved to IP addresses, including some that have already been flagged as malicious.
  • We found a possible network of suspicious domains tied to a malicious domain’s IP address and its artifact’s unredacted email address.
  • Despite being relatively new, more than a dozen properties have already been reported as malicious.

Download a sample of the threat research materials now, or contact us to access the complete set of research materials.

  • [1] 
  • [2]
Try our WhoisXML API for free
Get started