Security Insights

Fake AV Moving From To

Fake AV Moving From To

I've mentioned before that most of the fake AV sites were hosted on the sub-domain of which offers free DNS services.

It is certainly true that the domain is still hosting most of the fake AV sites, however, they are also doing a lot of cleanup. All the malicious sites we have reported to them have been removed within 24 hours. Many sites I've checked recently have been taken down.

Fake AV domain was taken down

While we're still seing new fake AV sites, we've seen an increase of such sites hosted on They offer free sub-domains, and free hosting as well.



Attackers take advantage of free hosting services

Attackers will keep changing providers to find a more hospitable home, a place where they are not shut down quickly. It took several months for registrars to first take actions against attackers abusing their service, certainly enough time to infect plenty of unaware users and we expect the same for

-- Julien



Get the latest Zscaler blog updates in your inbox

Subscription confirmed. More of the latest from Zscaler, coming your way soon!

By submitting the form, you are agreeing to our privacy policy.