Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Covid 19 Domain Classifier Covid 19 Domain Classifier


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Covid19 Domain Classifier

Starting in February, domain name registrations using keywords related to the "Covid19/Coronoavirus" crisis have exploded. Earlier this week, Domaintools made a file with related domain names available. The vast majority of these domains are not actively used or currently display benign "Parked Domain" content. Some are used for legitimate purposes. But there are a few that are used for scams and other illegal activity. We are trying to enlist as many volunteers as possible to help us classify the domains collected by Domaintools.

IMPORTANT: As part of this task, you will need to visit possibly malicious websites. Currently, I have not seen any outright malicious content (malware), but there are a few thousand domains here, and it is likely that a couple of them will carry malware. I recommend you use a separate system for it. A virtual machine (up to date and with anti-malware protection) or a mobile device (tablet that can be reset and has no personal information) may work well.

To help us out:

  1. Optional: Log in to the site (set up an account if you don't have one yet)
  2. Return to this page and click the "Next Domains" button.
  3. Visit the sites from a SAFE computer
  4. Select the classification
  5. Repeat

Quick Video with some early results.

Introduction / Training Video: How to Classify Covid 19 Related Domains

Please let us know if we should add more categories. Searchable domain lists will be made available shortly.

DomainRegisteredScreenshot (if available)
hover to magnify
Category
studentcovid19.xyz2020-03-18
coronavirussymptoms.biz2020-03-20
coronavirusgermany.xyz2020-03-22
coronavirushn.com2020-03-17
coronaviruspredictor.com2020-03-24
coronavirusactiongroup.com2020-03-22
deadcoronavirus.com2020-03-23
lcvcorona.com2020-03-18
coronavirus-foerdermittel.com2020-03-17
coronaholidayclaim.org2020-03-17

Categories

  • Blank: An empty page, but no error.
  • Blocked or Error: Error message (Safebrowsing error, or page not reachable).
  • For Sale: A domain that is for sale (not that the domain offers items for sale).
  • Not Reachable: Browser was not able to reach the site (for example, domain did not resolve).
  • Parked: Die site displays a generic message indicating that the domain is "parked" or the site will be coming soon.
  • Possible Fake Products: Items like masks that may be fake.
  • Price Gouging: The item seems legit, but is offered at an inflated price.
  • Redirect to Other Site: The site redirects to another (valid) site.
  • Scam: Scam like fake donation site or a site offering test kits, vaccinations or similar products
  • Unrelated: Totally unrelated to Covid19 (for example, Corona Beer or similar items that happen to share the same keyword).
  • Valid/Good: A valid web site offering legitimate information or services (for example, government or news sites).