{"id":9270,"date":"2020-10-13T11:18:30","date_gmt":"2020-10-13T15:18:30","guid":{"rendered":"https:\/\/www.cscdbs.com\/blog\/?p=9270"},"modified":"2026-01-19T06:50:38","modified_gmt":"2026-01-19T11:50:38","slug":"csc-election-research-and-fbi-warning","status":"publish","type":"post","link":"https:\/\/www.cscdbs.com\/blog\/csc-election-research-and-fbi-warning\/","title":{"rendered":"CSC\u2019s Research on Election-Related Domains Aligns with Recent FBI and CISA Warning"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

Following a public announcement from the FBI and CISA<\/a> warning the public to avoid spoofed election-related internet domains, CSC announced research findings that show the overwhelming majority of registered typo domains related to the election are vulnerable.\u00a0 Cybercriminals can use domain spoofing to make a fraudulent domain name (e.g. by using a typo of an original legitimate domain) that mimics the domain of the real website.<\/p>\n\n\n\n

As noted in our recent blog post \u201cU.S. Election-Related Web Properties Prone to Fraud and Misinformation Due to Lack of Domain Security<\/a>,\u201d nearly 70%<\/strong> of typo domains linked to third parties are configured to send and receive emails (have MX records configured), were registered in January of 2020 or after and are using privacy protection. As a point of reference, CSC\u2019s managed corporations only use privacy or proxy services for about 2% of their domain portfolio. This tells us that the true owners of these misspelled domains may have some nefarious intentions.<\/p>\n\n\n\n

CISA<\/a> has initiated the #PROTECT2020<\/a> call to action to secure \u201cto enhance the integrity and resilience of the Nation\u2019s election infrastructure, and ensure the confidentiality, truthfulness, and accuracy of the free and fair elections necessary for our American way of life.\u201d\u00a0 The FBI and CISA urge citizens to be aware of these crimes, and evaluate the websites they visit, and to seek out reliable and verified websites on election information.<\/p>\n\n\n\n

As an organization with the most visibility into the domain landscape, CSC advocates for both presidential candidates and other election-related websites to prioritize domain security to ensure security and build confidence.  Organizations such as Spamhaus have been advocating for more security to protect against domain name hijacking<\/a>, and the security posture of the domain name registrars that manage internet domains. <\/p>\n\n\n\n

Furthermore, CSC reported that over 90% of the election domain ecosystem lacks basic domain security protocols such as registry locks, and over 75% of these election-related domains are registered with retail-grade domain registrars (vs enterprise-level registrars) that generally do not provide advanced security protocol or a defense in depth approach. Therefore, these internet domains are vulnerable to domain name and DNS hijacking, phishing, malware payload delivery, typosquatting and many other attacks. <\/p>\n\n\n\n

Here are some domain security best practices we recommend:<\/strong><\/p>\n\n\n\n