Culture

Business websites

.com

Brand protection

Online stores

Hosting

Data privacy

Policy-making

Registrars

Investing & reporting

Internet Basics Series

How to

People

Cybersecurity

Web trends

Tech news

Security

COVID-19

Technology detection

domains

Software

WordPress

TLDs

GDPR

Loura Kruger-Zwart

Despite feeling like the behind-the-scenes web is inaccessible to most, you’ll be pleased to know that the internet is not magic: there’s a reason and explanation for everything, and while technical, it’s not always as complicated as it might seem. One thing that brings the hypercomplex aura of the internet back down to earth is the quirky, low-tech side of what makes it work—there really are some things computers and algorithms just cannot do. 

Let’s consider randomness: as human beings, with complex thought patterns and a penchant for unpredictability, we can be random. We could pick a number between 1 and 1,000 for no reason besides it feeling ‘random,’ and follow that up with another entirely random number, so that even we ourselves don’t know which choice we’ll make next. That said, humans are not flawless randomizers, as we can quickly descend into creating patterns or memorable combinations. Computers, on the other hand, cannot be random—it is genuinely impossible. They can simulate randomness, of course, like an online dice roller or random number generator does, and it can seem more or less random to us as the receiver of information. 

This randomness-aversion also appears in other ways. When was the last time you felt your Spotify playlist was well and truly ‘shuffled’?  While it’s true that the platform’s ‘automix’ features give preference to similar sounding songs and your recent listening history, some songs will never come up because there is often no ‘true shuffle’ on algorithm-based platforms like Spotify. This is called psuedorandomness, and yes, for the most part, it is ‘random enough’ for the purposes we need on the user-end. But the computer will always know what comes next: the sequence of results is always calculated, always predetermined. 

Why is randomness important for security?

For low-stakes things like song play orders or random number generators, the lack of true randomness is not a big deal. As long as it seems random to us as humans, the mission has been accomplished.

The real issue arises when considering (online) security and computer to computer (and other M2M) communication. Much of our online experience is encrypted: consider the padlock in your browser bar, indicating SSL status, or how much time you spend ‘logged in’ on social media, email, or e-commerce sites. And much of our online experience must be encrypted to keep us safe as we share personal data like contact information, photographs, payment details, and other confidential kinds of records. Online security is based on keys, which rely on randomness and undecipherability to ensure unpredictability—if a computer and malicious actor can predict or decipher the key, it cannot be secure. Strong, unique numbers are crucial for this, as they become the secure encryption keys for wifi passwords, SSH and SSL certificates, and more.

Let’s take a look at the data: the Secure Hash Algorithm (SHA) in SSL certificates refers to cryptographic hash functions used in the digital signatures (keys) of these certificates. The functions are essential for ensuring data integrity and authenticity in SSL/TLS communications. In essence, generating an SHA hash involves processing the input data—like a prime or truly random number—through a series of mathematical operations—like multiplying by another prime or random number—to produce an output that uniquely, securely represents the original input. Figure 1 shows the four more-used SHA types for .com domains in our database.


So, if humans are not effective randomizers, and computers cannot be random, how does online security work? This is where the low-tech internet shines: it utilizes the true randomness of the outside world and the physical things around us to ‘seed’ randomness. An excellent example of this is IT management services company Cloudflare and their lava lamps. Referring to their lamp wall, cryptographer Nick Sullivan explains that it's the photographing of the lava bubbles, the room’s light ambience, (white) noise levels, and a number of other—completely offline—factors that form the basis for solid internet encryption capabilities. Their branch in London uses a ‘chaotic pendulum,’ and the Singapore office tracks the decay of radioactive isotopes to derive randomness for encryption keys. Digital security companies use multiple sources and layers to introduce randomness in their security.  

The mentioned examples are physical sources of entropy, which means they produce randomness in a physically observable manner. Other sources of entropy are just as useful. Thermal noise can be tracked to harness randomness from the hums and jitters in electronic circuits, and Quantum Random Number Generators (QRNGs) are devices that leverage quantum phenomena, such as the behavior of photons, to produce truly random numbers. When operating systems collect entropy from various sources (like mouse movements, keyboard timings, or system events) this is called Software-Based Randomness, which relates to the randomness that can be generated by human-device interaction. User-generated entropy is also a popular contribution to encryption, as Tom Scott explains: personal computers can use the milliseconds between clicks, or smartphones can use movement and tilt data to generate randomness. 

These methods highlight the importance of both physical and digital randomness in maintaining security protocols across the internet. Each method has both strengths and weaknesses, and it’s often a combination of these techniques that get employed to ensure high-quality randomness. These low-tech solutions solve incredibly high-tech problems, and help us understand how the internet works just a little better. ‘Low-tech’ should not imply that the solutions are simple or effortless, but rather that they are graspable for those outside the industry, too.


Low-tech solutions for high-tech problems

Barcelona, ES: this solar internet project is a solar-powered website and magazine, created by Belgian author Kris de Decker. It focuses on and explores the sustainability of technology, reduction of (power) consumption, and prioritization of low-tech solutions to socially constructed high-tech problems. Its solar base is in Spain, where the good weather helps to keep it online, but the site gives its visitors the heads-up that it may be down when the weather has been bad. Take a look at the website to learn about dithered images, technological sustainability, using history to inform our futures. 

This article is part of the Modern Internet series, where we dive into today's digital culture and the online landscape. Check out Internet Nostalgia, for a head start on finding great spaces to hang out online, or GenAI Transparency to learn about maintaining the Living Internet. Keep an eye out for our upcoming piece on the rise of mini-games where they're least expected, and later, the consequences of digital hoarding.

Tech

Everything to do with the internet is entirely technical, complex, and shrouded in esoteric jargon—right? Sometimes it seems like you have to be an expert to understand what’s happening out there. While there are plenty of ultramodern things about the web, the low-tech internet is what helps keep us safe on our digital escapades. Read on and dive into the high-tech (security) problems solved with 'low-tech' solutions.

How the low-tech internet tackles high-tech threats

Veronika Vilgis

These strategies include securing DNS communication with DNSSEC, email communications through SPF, DMARC and DKIM protocols, enhancing domain security by specifying HTTP headers, and incorporating a security.txt file. As we explore the technical aspects, our goal is to provide you with a comprehensive understanding of the multi-layered approach that is needed to safeguard websites. 

Domain Name System Security Extensions (DNSSEC) help protect the system that translates domain names into IP addresses, a crucial step in cybersecurity. DNSSEC adds cryptographic signatures to existing DNS records. These signatures are used to verify that the source of the DNS data is authentic, i.e., the data is coming from where it claims to be coming from and that the data has not been tampered with during transmission.

The objective of DNSSEC is to safeguard against certain types of attacks, such as man-in-the-middle attacks, wherein a user’s attempt to access a legitimate website is hijacked and redirected to a fraudulent website.

We identified just two countries where a mere half of business websites had DNSSEC enabled, namely the Czech Republic (55%) and Norway (52%). France, Estonia, and Brazil, with respective percentages of 19%, 18%, and 13%, are ranked as the third, fourth, and fifth most secure countries, with between 10% and 29% of their business websites being protected by DNSSEC. The vast majority of websites in the remaining nations are not protected. 

Enabling DNSSEC typically requires coordination between domain registrars and DNS hosting providers, indicating that many could do more to protect clients. The .no country code top-level domain (ccTLD) is known to be one of the TLDs with the highest protection through DNSSEC, and our results support this. Several countries have issued directives regarding the implementation of DNSSEC to enhance their national cybersecurity infrastructure. In Brazil, for example, the implementation of DNSSEC has been pushed to improve internet security within the country. Various initiatives within the EU, including ENISA (European Union Agency for Cybersecurity), have advocated for the implementation of DNSSEC. However, due to the absence of an EU-wide directive, there are significant disparities among EU nations when it comes to the implementation of DNSSEC.

Prevent phishing and spam with three key DNS records

Phishing and email spam are the most common ways for hackers to enter a network. It takes just one employee clicking on a malicious link or email attachment to compromise an entire enterprise with ransomware. To prevent a domain from being abused for phishing, just three key DNS records need to be set properly. Those records are SPF, DKIM, and DMARC. The three can help ensure the legitimacy of emails, making it more challenging for attackers to impersonate trusted senders. 

The Sender Policy Framework (SPF) enables domain owners to specify which mail servers are authorized to send emails on behalf of their domain. 

Domain Keys Identified Mail (DKIM) provides a way for an email to be signed with a digital signature, which is then verified by the recipient using the sender's public key published in the DNS. This ensures the email's content has not been tampered with during transit and that the email genuinely originates from the specified domain, making it harder for phishers to forge emails. 

Domain-based Message Authentication, Reporting, and Conformance (DMARC) allows domain owners to specify how receiving mail servers should handle emails that fail SPF or DKIM checks. It also specifies an address to send reports on pass/fail statistics, providing visibility into attempts to spoof or forge emails. DMARC helps prevent phishing by ensuring that only authenticated emails are delivered to users and by informing domain owners of potential abuse.

Most business websites in the countries we researched specify SPF, ranging from 64% in Norway to 86% in South Africa. The Czech Republic is the online nation with less than 50% of business websites protected with SPF.  DMARC coverage ranges from 8% in Mexico to 24% in Norway, indicating that a lot more could be done to improve the coverage of the DMARC framework. DKIM is not shown in Figure 6 due to its very limited coverage. In no country did the coverage exceed 0.5%. Although it appears that the majority of business websites have taken at least one measure to prevent phishing attacks, a significant proportion of domains have yet to utilize all available security measures to prevent the misuse of email fraud.

How HTTP headers play a vital role in website security 

Hypertext Transfer Protocol (HTTP) headers play an important role in the secure and efficient operation of web communications by enabling browsers and servers to exchange information beyond the content of the web page itself. They are used for various purposes, one of which is to specify security policies. For this research, we examined five security-related HTTP headers (X-XXS-protection, X-Frame-Options, Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options). The technical details of these headers are beyond the scope of this article, but each of these headers can add another layer of security to a website. Figure 7 shows the percentage of business websites per country that specify between one and five headers. 

In general, the data indicates that well over two-thirds of business websites could significantly enhance their security by defining one or more security-related HTTP headers. In many countries, between 10% and 20% of business websites include at least one or two security-related HTTP headers, but, less than 5% specify four or five of these. Overall, Norway, Indonesia, and the Philippines possess the highest coverage, whereas South Africa, Spain, and Turkey are the lowest ranked. The large share of business websites in all countries that do not utilize these extra layers of protection suggests more could be done to educate domain owners about the utility of specifying HTTP headers. This would provide them with the necessary ‘how to’ to implement them.

Security.txt offers direct contact methods for reporting

Before concluding this two-part series on business website security and naming a winner, let’s take a look at a lesser known text file called security.txt. This file is a standardized method for websites to define security policies. It's typically placed in the website's root directory, providing contact information for reporting security vulnerabilities. The objective of security.txt is to facilitate the responsible disclosure of potential security issues. 

Last year, the Dutch government mandated the implementation of the file on any websites maintained by public institutions. This is not a requirement in most countries, but it’s still a good idea. Who wouldn’t want to be informed if someone discovers a security gap on a website or in your digital product?

Surprisingly, only one country out of the thirteen under investigation had a mentionable percentage of sites with a security.txt available. 6.5% of Czech business websites have such a file. This percentage is relatively high, in comparison we detected coverage of 5% on Dutch business websites where all government websites are required to implement one. For all other countries, the share was less than 0.6%. Having a security.txt is certainly not a strong tool against major cyber threats, but being alerted to vulnerabilities can’t hurt and may in the best cases mitigate actual breaches before any actual damage is done.

No country boasts a high level of secure websites

Having examined fundamental and less well-known security measures to reduce website vulnerabilities, it's possible to draw a couple of conclusions. First, no country is exceptionally well-secured. Although business websites have some security measures set in place, they are often limited to just a single factor. For instance, instead of specifying SPF, DKIM, and DMARC, just one of them is covered. 

Furthermore, not a single nation performs well on all security indicators. Norway may have performed well in several areas, but is among the worst when it comes to fraudulent online stores. Equally, the Czech Republic seems quite secure in most measures, but SSL coverage is lower than in other countries, as is phishing protection. All researched countries would benefit from significant security improvements. 

Our overall winner is Norway, followed by Estonia and the Czech Republic (see Figure 8). But It would be incorrect to assume that this is representative of other European countries. Spain, ranking second-lowest, is a sure indicator of that. Following the European winners, the three Latin American countries included in this research rank 4th, 5th and 6th. Countries from Asia come in at lower overall ranks.

With SSL certificates being a notable exception, there is still a lot of room for corporate websites across the globe to enhance their security measures. An approach that takes multiple measures into account, from improving DNS records to HTML headers and SSL, can create a safer internet for all.

Website security is a responsibility for website owners and governments

The responsibility of securing a website, however, should not solely rest with business owners. Governments and organizations have a responsibility to fulfill, as do registrars and hosting providers. The state of business website security is a glaring issue that demands immediate and collective action. Web data is a potent ally in this battle, but it requires the support and active participation of governments and organizations to translate insights into tangible action. The issue of cybersecurity is a concern that affects all individuals and has the potential to impact beyond the digital realm. Therefore, it is imperative that we collectively strive to enhance the security of the web. 

In our previous post, we examined fundamental measures for website security and their implementation on business websites in diverse countries. In this second part, we build on these basics discussed in our first post, examining more sophisticated strategies that can be implemented to defend websites against evolving cyber threats.

Beyond the basics: more data on the state of business website security

Mathijs Baas

Asset management is the practice of identifying, classifying and protecting a company's physical and digital assets. This includes buildings, computers and sensitive data, among other things. By implementing effective asset management policies and procedures, you can minimize risks of loss or damage to your assets, so you can ensure that they’re being used securely.

One important aspect of asset management is asset discovery. This is the process of identifying and cataloging your company's assets so that you have an accurate inventory of what you have and where it is. This information can then be used to inform decision-making and identify potential security risks.

It’s also important to make sure that external parties aren’t using your assets. If someone gets access to an unprotected asset, they could use it for nefarious purposes. A forgotten asset can result in a breach of a network. Assets that are vulnerable to hacking and security breaches can be anything that’s hooked up to the internet. For example, these can be websites, forgotten subdomains or machines within a domain.

To mitigate these risks, it’s important to know what you have. Especially within larger organizations, it can be hard to keep track of what is connected to the internet. 

An example of a potentially dangerous asset is a website about a company event that runs on outdated software: you’ve forgotten that it exists but it’s still up and running. It could also be a team website whose domain wasn’t registered through the right channels and years later it still exists without the network administrator’s knowledge. 

Luckily, at Dataprovider.com we’re able to identify these assets and keep track of what’s connected to the internet within a domain. 

Let’s take a look at an example: the domain kosherwine.com. We identify 20 domains and 26 subdomains that are connected to kosherwine.com. The owners of kosherwine.com also own, for example, kosh.com and challahconnection.com. The domains are linked to 21 separate servers and 17 unique IP addresses. The majority receive little to no traffic, which could indicate that these subdomains/domains are not being maintained very well, were simply registered at some point but have remained dormant or a combination of the two.

With this data, it’s possible to create a complete overview of all connected domains and subdomains and the security risks they may carry. As a system administrator, you can create a dashboard with multiple data points that can help you assess the security of the domain by monitoring:

Ownership: You can see any related domains. 

Subdomains: This indicates the total number of subdomains associated with the main domain. 

IP addresses: You can see the IP addresses that are associated with the domain.

Traffic index: This shows the amount of traffic to the domain.

Using the example of kosherwein.com, we show how you can use web data to get an overview of the assets associated with your domain. Such information is crucial to protect your business from security threats because you can only create a secure business if you know what you have to protect.

Are you keeping track of your company's assets? If not, you could be putting your business at risk.

How to use web data for asset discovery and management

Hylke van der Veen

You might have noticed that a web address often shows the HTTPS protocol, rather than HTTP and that your browser displays a padlock in front of the URL to indicate that your connection is secure. Although this gives a sense of security, it also raises the question of what exactly this means and how your connection is protected. 

When a website uses the HTTPS protocol, your access to the website is protected by a Secure Sockets Layer (SSL). SSL is an Internet Security Protocol that ensures the connection between a website and a user is secure. SSL protects your connection in three ways. 

First, SSL is a proof of the authenticity of a website: it shows that the website you’re visiting really is what it claims to be and isn’t a fake website set up by attackers who try to obtain private data from visitors.

Secondly, SSL ensures that communication between the two parties is encrypted. With the standard HTTP protocol, data is transmitted in plain text. This means that anyone who can intercept this connection can see the data that is sent in plain text. With HTTPS, however, the data is encrypted before being transmitted, so even if it's intercepted, it looks like a random jumble of characters without the right key to decrypt it. 

Finally, SSL ensures that the transmitted data cannot be tampered with through the use of Message Authentication Codes (MAC). Although, technically, messages sent through SSL can still be intercepted or altered, the MAC ensures that the user will always know if this has happened.

Traditionally, SSL was only used on web pages which process personal information, such as online payments or login screens. These days, however, many websites have an SSL certificate to guarantee the security and authenticity of the website itself. With modern browsers and devices, the time it takes to set up an SSL connection is mostly negligible and, therefore, provides no disadvantages anymore.

If you’re already familiar with SSL, you might have also heard of Transport Layer Security (TLS). In fact, whenever SSL is discussed, most of the time it’s actually about TLS, which is the successor to SSL. In 1999, the development of SSL was taken over from its original creator, Netscape, by the Internet Engineering Task Force. With this takeover the name was changed to TLS and the last version of SSL (version 3) was deprecated. However, the name SSL has stuck around and the two are now used interchangeably. 

What types of SSL certificates are there?

There isn’t just one type of SSL certificate. SSL certificates vary in coverage of hostnames and in the degree of verification. According to our data, where we looked at approximately 59 million certificates, the most used coverage of SSL certificates is Single-Domain. That means only one hostname is covered by the certificate, usually the www hostname of a domain (for example, www.google.com). An expansion of this certificate is the Wildcard certificate, which covers all subdomains of a domain. Finally, the Multi-Domain certificate covers multiple unrelated domains.

An SSL certificate can also have a varying degree of verification. These degrees correspond with different levels of background checks required before a certificate is issued. The least demanding level of verification is the Domain Validation, where the owner only has to show proof of ownership of the domain. For the Organization Validation, the owner of the domain is directly contacted by the Certificate Authority. The most extensive vetting occurs for the Extended Validation, where a full background check of an organization is conducted before the certificate is issued. Our data shows that the vast majority of domains with SSL certificates (93%) only validate the domain. Organization Validation comprises 7% and Extended Validation certificates are less than <0.1%.

The SSL certificate a website acquires, has to be issued by a Certificate Authority (CA), the most popular one being Let’s Encrypt. Let’s Encrypt is a free-to-use nonprofit CA, created for the public benefit and sponsored by a diverse range of tech companies. It covers 65% of domains with an SSL certificate and only provides certificates of Domain Validation. It’s therefore a popular choice among smaller organizations and individuals looking to protect their website visitors’ data. Apart from Let’s Encrypt, Sectigo and DigiCert are also widely used CAs. Other popular options are Cloudflare, cPanel and GoDaddy who offer SSL certificates as part of their product packages.

Does this mean that every website that needs an SSL certificate already has one? As a matter of fact, no. Of the 88 million domains we checked, only about two-thirds (65%) had a valid SSL certificate. Although many websites don’t strictly need HTTPS because no user data is transmitted, we still see many that store privacy sensitive information such as login credentials, contact information or payment details from their visitors without an SSL certificate. According to our data, globally, about 3.1 million Business and eCommerce websites store privacy sensitive information but have no SSL certificate.

Website owners who care about their integrity and visitors’ privacy should strongly consider protecting their website with SSL. Now that you have learned about what SSL is and does, you may also be more wary of websites that don’t have an SSL certificate. 

When a website uses the HTTPS protocol, your access to the website is protected by a Secure Sockets Layer (SSL). SSL is an Internet Security Protocol that ensures the connection between a website and a user is secure.

Internet Basics #2: SSL certificates explained

Gijs Barends

Ports were invented to reroute different processes. For example, surfing the web always uses port 80 and port 443, port 25 is used for sending emails. Currently, there are 65,535 ports. They make network connections efficient because they let your computer know what to do with the data. 

Cyber criminals can exploit open ports to gain access by sending malicious traffic through them with the intention to take control or steal sensitive information. This is sometimes compared to a thief that checks every door of a house to see if one hasn’t been locked. Out of the more than 60,000 ports, only a few that are actively used should be kept open. 

We do port scans for our clients with the intention to improve security. We check ports that are commonly used in popular applications like MySQL, PostgreSQL or Remote Desktop. From that data we can see that the majority of sites (61%) have fewer than six open ports. However, the data also suggests that there are around 2.4 million domains worldwide that have more than 80 open ports. Among these, 23% are business or eCommerce sites. 

What can you do to protect open ports? One way to address them, is by implementing firewalls. These can be either software, like a program you install on your computer, or hardware. Next, you should determine how many ports you have opened and whether all of these need to be open. Closing ports is like shutting the door on cyber criminals, so it’s important to regularly monitor and evaluate your website’s open ports.  

Domain registrars and registries could also use this kind of data to prevent security breaks and hacks into their users' websites. By checking and warning their clients if a firewall isn't configured right and informing them of the number of open ports, you can help them tackle this issue.

Ports are virtual openings where network connections start and end. All communication that happens over the internet is exchanged via ports. Most processes, like e-mail, always use the same port number (#25 in this case). To be connected to the internet, you need at least several ports to be open. But open too many ports, and you can open up security risks. Keep reading to discover how the number of ports tells you something about the security and trustworthiness of a website.

What you need to know about open ports to protect your business

Attackers use what is called an Inline Frame (iFrame) that loads another HTML page within the original website. That iFrame generally imitates the original website, making the user think they are still operating on the original website. The root of this problem is a function that allows a website to load content and scripts from another website. 

Configuring X-Frame-options prevents abuse

A website owner can prevent this by configuring the X-Frame-Options in the HTTP header of their website. The X-Frame-Options HTTP header can be used to indicate whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>. This solution can prevent clickjacking attacks by ensuring that foreign content isn’t embedded into the website.

This doesn't mean websites can’t embed content from other websites, you just need to specify who can load content on your website in the header: for example, you can allow specific content from Instagram.

Implementing X-Frame-Options isn’t hard. Yet, when we look at our data, we see that only a tiny proportion of websites globally have implemented an X-Frame-Option in their HTTP header. Out of the more than 120 million websites scanned for this research, only 8% (9.5 million) are protected against clickjacking.

This is staggeringly low. Given the ever-increasing threat of cyberattacks, preventing clickjacking from happening by implementing an X-Frame-Option is a simple way to make the web just a bit safer for everyone.

Clickjacking tricks a user into performing an action they don’t intend to carry out such as clicking on a disguised webpage element. As a result, the user may enter a fake but similar looking website, have his personal information stolen through fake text boxes on top of the real ones or unintentionally spread malware, worms or scams.

What is clickjacking and how can you prevent it?

Christian Branbergen

“I'm Chris, and I’m one of the co-founders of Dataprovider.com. 

Dataprovider.com is a structured search engine that indexes all websites on the internet every month. With our search engine, you can see what happens on the internet.

Every day we receive the zone files from many TLDs. These zone files contain all the domains that are registered for those TLDs. Because we’ve been indexing all these domains for multiple years, we can exactly see how these TLDs are developing.

Monthly crawl of over 750 million websites

For a registry, it is important that domains are being used because these domains keep on renewing every year. Dataprovider.com captures over 200 variables every month and keeps track of changes.

One of these variables is the DNS MX record. Every month, when we index a website, we also capture all the DNS records for that domain. The MX record, which stands for Mail eXchange, indicates how email messages should be delivered.

You could reach out to domains that haven't configured their email yet and help them to set up an email account or email forwarding service.

Additionally, you can improve the security and email delivery of domains that use their domain for email already. This can be done by adding a so-called SPF record to the DNS. SPF stands for Sender Policy Framework and stops spammers from spoofing a domain. In addition, an SPF record will reduce the number of legitimate email messages that are flagged as spam or bounce.”

Do you want to know more about how you can use Dataprovider to improve the activity and security of the domains in your zone file? Let us know and we can schedule a demo to show you how.

Domains

 Improve the security and email delivery of domains

Domains that use email and SPF

Phishing and spam are so common that most people have been affected. Many often do manual checks to verify the trustworthiness of these messages. They will try to identify the sender and if it was sent from a domain they expected the message to come from. For example, if you receive a message about upgrading your Excel software, you would expect it to come from a domain that ends with @microsoft.com. Unfortunately, if the owner of the domain doesn't take the right precautions, messages from that domain can be sent by spammers and hackers. Such spam is much harder to identify as fraudulent. This is the exact problem we are looking into in this post.

There are two protocols a domain owner can use to prevent this from happening: SFP and DMARC. 

SPF stands for Sender Policy Framework, it is in essence an email authentication protocol, in which you can specify what servers you use to send out email. The recipient email server will check this and, if it doesn't match, it won't deliver the email or send it with a warning message. 

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It works on top of SPF, and you can use it to instruct receiving mail systems what to do with messages that fail SPF checks. In a nutshell, SPF works without DMARC (although with limitations), but DMARC doesn't work on its own, it needs SPF.

In our data, we can see that these protocols are popular. Of the approximately 276 million websites surveyed for this research, 69% have implemented SPF. However, we also identify around 85 million domains that don't leverage this basic protection, leaving ample room for improving security.

What can be done to close this security gap?

Registrars could automatically check if all domains in their portfolio use an SPF and notify the domain owners that don't use one to implement an SPF. Furthermore, we believe governments should play an important role by making the use of an SPF mandatory.


Phishing attacks and email spam are among the most common methods cyber criminals use to get inside a network. If a single employee clicks on a malicious email attachment, ransomware and viruses can get installed and harvest your sensitive information. 

How SPF and DMARC can help against Spam and Phishing attacks

"I'm Chris and I’m one of the co-founders of Dataprovider.com. Dataprovider.com is a structured search engine that indexes all websites on the internet every month. With our search engine you can see what happens on the internet.

In this 'Fact Checking With Chris' we’re going to check if the following statement is true: most companies mention their social media profiles on their website.

Social media platforms can help companies to connect with their customers, increase brand awareness and boost leads and sales. So, you would say that all companies that have a website also would use social media.

In Dataprovider.com we can select websites that are from companies, using the 'Website type' field. In January 2022, there were around 32 million domains with websites from companies. 40% of the company websites had one or more social media profiles on their website.

An interesting additional fact that we discovered in the trend graph is that the number of companies mentioning their Twitter profile is declining and Instagram profiles are growing.

So, the conclusion of this 'Fact Checking With Chris' is: no, most companies don't mention their social media profiles on their website but 40% is still a large number."

Social media platforms help companies connect with their customers. But they also increase brand awareness, and can boost leads and sales. But can you assume that all companies with a website would also use social media to profit from that?

Do most companies mention their social media profiles on their website?

In this 'Fact Checking With Chris' we’re going to check if the following statement is true: the majority of companies is protected against phishing and spam.

If you have a domain name, you will probably also use it to send emails. As a domain name owner, you can prevent criminals from misusing your domain for sending phishing or spam by using a simple framework called SPF.

SPF stands for Sender Policy Framework and is an email-authentication technique which is used to prevent criminals from sending messages on behalf of your domain. You can easily set up a SPF record by adding a TXT record to your DNS containing a list with domains and IP addresses that are permitted to send emails on behalf of your domain. 

In Dataprovider.com we can select websites that are from companies using the 'Website type' field.

In January 2022, there were around 32 million domains with websites from companies. 15 million of these domains didn’t have a SPF record set up, meaning that 46% of the company websites can be misused by criminals to send phishing and spam.

So, the conclusion of this 'Fact Checking with Chris' is: no, the majority of companies are not protected against phishing and spam."

Is the majority of companies protected against phishing and spam?

Andriana Boyrikova

Often these websites refer to each other as sources, thus forming networks. Combating misinformation has become a crucial part of dealing with the pandemic, and this is where technology can step in to uncover online networks that spread false and potentially harmful information.

Identifying websites that spread misinformation

We tend to refer to misinformation that is being spread online (and offline) as fake news. Yet, this encompasses not only fabrications and legitimate news that have been deliberately twisted, but also unresearched information and stories that contain some truth but aren't completely accurate. Inevitably, this impedes the identification of fake news and makes it ever more important to be able to read and analyze news critically.

Naturally, the most significant rule is to use common sense to evaluate if a message is plausible and collect information from multiple sources before drawing any conclusions. People tend to believe information that confirms their beliefs and discount information that contradicts what they support. However, keeping emotional responses in check and searching for what well-known and trusted sources have published on that subject is a crucial first step.

Next to that, checking the rest of the information on the website in question doesn’t take a lot of time and effort but plays a critical role in indicating how trustworthy it is: what other stories have been posted, is there any information on the mission, staff members or physical location of that organization or company?

When reading a piece of online content, it's also important to pay attention to the sources that have been used. For example, quotes, an interview, a report, survey data or official statistics and to check if these sources actually exist (as sometimes references to non-existent studies are made).

Uncovering networks of fake COVID-19 news

A significant number of these fake news websites are spin-offs of notorious websites publishing false health-related content and conspiracy theories. What’s more, they tend to link to each other as sources. So we can argue that if we find one website spreading misinformation about COVID-19, we can find more by, for example, following links on these websites. 

We will check if that holds true by doing an online investigation using our database of incoming links (links pointing to a particular website from other websites).

Our starting point is the infamous US website www.vaxxter.com. The homepage of vaxxter.com claims that the website publishes “scientific articles exposing vaccine myths and pharma foibles,” and states that it “promotes alternative health news.” However, it has published stories with misleading information and unsubstantiated claims about COVID-19. For example, an article from April 2020 headlined “Is 5G a Deadly Trigger for the Coronavirus?” suggests that 5G cell phone technology is related to the outbreaks of the new strain of coronavirus in Wuhan, Milan, and Iran. So far, there is no research that establishes a link between the COVID-19 pandemic and 5G. Additionally, the website doesn’t provide any ‘About’ information, physical location or contact details. 

Starting our search from Vaxxter.com, we collected 10 000 websites that link to it directly or through other websites. A cluster of 865 websites that are most likely related to fake news catches our attention as worth investigating. By applying a genetic clustering algorithm, we can determine that these 865 websites form a cluster, as they have a relatively large number of links among them but fewer links to other websites.

We pick one out of the 865 websites at random, Disinfo.news, and take a look at it. The website claims to publish “independent news on natural cures, food lab tests, cannabis medicine, science, robotics, drones, and more.” At the same time, the story in its header is headlined “Why Trump will win — compelling analysis no one else will report.” What’s more, an article from January 2020 headlined “Is coronavirus a manufactured bioweapon that Chinese spies stole from Canada?” claims that “these Chinese agents [...] may have infiltrated North America for the sole purpose of hijacking this deadly virus to unleash it at a later date.” So far, there is no evidence to support this claim. To top it all, the website doesn’t provide any information on its mission, staff members, contact details or physical location.

We can go one step further and dig deeper into that cluster of 865 websites by looking into keywords. After running an analysis, we came up with a keyword frequency plot based on the 33 most frequent keywords found on the websites. Among some of them are “vaccine,” “coronavirus,” “5g,” “children,” “truth,” “COVID-19,” “medic,”“science,” “billionaires,” and “freedom.” We can deduce that legitimate news or scientific articles can be writing about 5G, coronavirus or billionaires, but when they are used all together, this can be a red flag signaling fake news.

It’s interesting to note that some of these keywords - for example, “corona” and “5g” - also appear on websites that are outside the cluster but are somewhat connected to it; yet the further away we get from the cluster, the less frequently they show up.

The graph below identifies the high-risk websites in the cluster: the brighter colors signal a higher risk of COVID-19 misinformation based on the keyword frequency plot.

We select one of the websites from the highest risk group, www.unmaskohio.org, and take a look at it. (The website has been taken offline since)The homepage welcomes its visitors with the following statement “Unmask the truth: end compelled masks in Ohio,” and some of its featured headlines read “Masks ineffective” or “Most already immune.” When clicking on the section titled “The Science,” we find stories that claim that “Covid tests are not fit for purpose” and “Former Pfizer VP: 'No need for vaccines,’ ‘the pandemic is effectively over.’” What’s more, we can’t find any contact or ‘About’ information anywhere on the website.

If we compare the cluster that we are investigating to all 10,000 websites connected to Vaxxter.com, we can clearly see that the highest risk of fake news is still most prominent in the cluster where the websites link to Vaxxter.com directly or through other websites. The further away we get from the cluster, the lower the risk gets.

In an attempt to investigate the spread of online misinformation and fake news about the COVID-19 pandemic, we conducted research centered around Vaxxter.com: a US website notorious for failing to comply with basic standards of transparency and credibility. 

By using our database of incoming links, we could find a cluster of websites tightly connected to Vaxxter.com that publish inaccurate information or unsubstantiated claims about the COVID-19 pandemic. Our analysis indicates that websites that spread inaccurate information or conspiracy theories tend to link to each other, and technology can play an important role in discovering them.

Public Sector

As the COVID-19 pandemic has taken over the world, so has misinformation. The pandemic has led to an overabundance of inaccurate information and conspiracy theories: from sources claiming they offer treatments and miracle cures to outlets deliberately spreading false information to sway public opinion.

Follow us

Questions?

Security

Is the majority of companies protected against phishing and spam?

Uncovering networks of websites spreading misinformation about COVID-19

Start today