A sharp growth in the number of COVID-19 cases and the corresponding tightening of measures to hold down the spread of the coronavirus infection have resulted in a growing number of coronavirus-related domain registrations compared with May. Moreover, cybercriminals have their fingers on the pulse of the situation: the number of domains related to vaccination is growing, including some with the names of vaccines in Cyrillic and Latin scripts or with QR codes and vaccination certificates. Today, internet users should be as careful as possible when visiting websites with references to these COVID-19 topics.
The Coordination Center for TLD .RU/.РФ continues to monitor the registrations of such domains in the .RU and .РФ ccTLDs. The goal of the monitoring is to identify potentially dangerous domains and minimize possible damage.
The number of coronavirus related domains registered in June increased by almost 50 percent compared with May: there were 118 such registrations in May (112 in .RU and six and .РФ) and 190 coronavirus-related domains in June (161 in .RU and 29 and .РФ), which is so far the highest number since the beginning of 2021.
Like in May, most new domains registered in June include the name of the virus, but their number has grown significantly: 124 in .RU and 19 in .РФ (against 80 and 2 in May, respectively). As mentioned above, there has been a sharp increase in the number of registrations of domains related to vaccination or including the names of vaccines in Cyrillic or Latin: 43 domain names in .RU and 12 in .РФ (33 and 3 in May, respectively). Another 20 domains (14 in .RU and 6 in .РФ) are associated with various COVID-19 tests (for example, for the presence of the virus or antibodies to it).
Over the entire monitoring period (January 2020 - June 2021), 6,717 domains have been added to the list of domains with the words “corona,” “covid,” “pandemia,” “ковид,” “пандемия,” “вакцина,” “vaccine” and others: 5,621 in .RU and 1,096 in .РФ.
If you have been affected by visiting websites or reading emails using phishing domain names, including coronavirus-related names, please contact a competent internet security organization hotline. Hotlines can be found on the website of the Coordination Center’s other cybersecurity project, Domain Patrol, where industry news, useful instructions on what to do when faced with a cyber threat and rules of safe behavior on the internet are published, too.
