Latest news of the domain name industry

Recent Posts

Will new gTLDs really increase phishing?

Kevin Murphy, December 17, 2011, 11:15:33 (UTC), Domain Policy

The US Federal Trade Commission has come out swinging against ICANN’s new generic top-level domains program, saying it will increase online fraud and should be scaled back.
In an open letter to ICANN’s top brass yesterday, the FTC’s four commissioners claimed that “the dramatic introduction of new gTLDs poses significant risks to consumers”.
Saying that more gTLDs will make it easier for scammers to acquire domain names confusingly similar to existing brands, the commissioners said the program should be rolled out as a limited pilot.
The FTC commissioners wrote (pdf):

A rapid, exponential expansion of gTLDs has the potential to magnify both the abuse of the domain name system and the corresponding challenges we encounter in tracking down Internet fraudsters. In particular, the proliferation of existing scams, such as phishing, is likely to become a serious challenge given the infinite opportunities that scam artists will now have at their fingertips. Fraudsters will be able to register misspellings of businesses, including financial institutions, in each of the new gTLDs, create copycat websites, and obtain sensitive consumer data with relative ease before shutting down the site and launching a new one.

The letter demands better Whois accuracy enforcement, better ICANN compliance programs, and a cap on approved new gTLDs in the first round perhaps as low as a couple dozen.
The FTC’s claims that new gTLDs will increase phishing may not be supported by reality, however.
The latest data (pdf) from the Anti-Phishing Working Group shows that in the first half of the year only 18% of domain names used in phishing attacks were registered by the attacker.
That was down from 28% in the second half of 2010. Phishers are much more likely to compromise a domain belonging to somebody else – by hacking a web server, for example.
Of the 14,650 maliciously registered domains 10,444 (70%) were used to phish Chinese targets, “overwhelmingly” the e-commerce site Taobao.com, the APWG found.
Furthermore, only 2% of these domains – just 1,816 over six months – were judged to have been registered due to their confusing similarity with the brands they target.
The APWG said (emphasis in the original):

These are the lowest numbers we have observed in the last past four years, and show that using domain names containing brand strings has fallen further out of favor among phishers.
…
the domain name itself usually does not matter to phishers, and a domain name of any meaning, or no meaning at all, in any TLD, will usually do. Instead, phishers almost always place brand names in subdomains or subdirectories

The APWG found only one gTLD that ICANN has introduced – .info, with 4.5% – in its top ten phishing TLDs. The .com space accounts for 48.9% of all phishing domains.
Will the increase in the number of gTLDs reverse these trends? The FTC seems to think so, but the claims in its letter appear to be based largely on guesswork and fear rather than data.
I suspect that the FTC’s letter is more concerned with ICANN’s ongoing bilateral talks with registrars over law enforcement-demanded amendments to the Registrar Accreditation Agreement.
These talks are completely separate and distinct from the new gTLDs program policies, but in the last few weeks we’ve seen them being repeatedly conflated by US lawmakers, and now the FTC.
This may be ignorance, but it could just as well be an attempt to apply political pressure on ICANN to make sure the RAA talks produce the results law enforcement agencies want to see.
ICANN does not want to be forced into an embarrassing retreat on its hard-fought gTLD expansion. By producing a strong RAA, it could deflect some of the concerns about the program.

Tagged: , , , , , , , , ,

Comments (10)

  1. gpmgroup says:
    December 17, 2011 at 7:45 pm

    My guess is a lot depends on the intentions of the Registry. Afilias has been very pro active in .info and because the issues seem to get cleaned up much faster in .info than other TLDs I guess this leads to a lower number of domains being registered for nefarious purposes.
    New gTLDs, in particular .brands, will introduce an additional new problem. Certainly for several years at least there will be no standard way of expressing what comes to the left of the dot.
    shop.brand, offers.brand, store.brand etc. and the myriad of combinations will be a huge opportunity for phishers.
    Even for brands which choose not to use new gTLDs if other’s do and .brands become common place it will be very difficult for consumers to know what is and isn’t a legitimate url.

    Reply
    • Kevin Murphy says:
      December 17, 2011 at 8:01 pm

      Are you kidding?
      I thought you understood the new gTLD program, dude.
      You know that .brands will have total control over the left of the dot, right? There is no chance — none, whatsoever — that shop.brand goes to a phisher.
      Maybe I’m misunderstanding you.

      Reply
  2. gpmgroup says:
    December 17, 2011 at 8:34 pm

    Phishing doesn’t need an exact url
    sure shop.brand and store.brand etc are protected
    but the combinations in other new gTLDs are likely to be endless
    shop.brand.web
    shopbrand.store
    store.brand.shop
    storebrand.shop
    …
    brandstore.xyz
    even
    brand.xyz for more generic brands and even brands which are slower to enforce their marks.
    You telling me an average consumer is going to know which are legitimate?
    Even people like Jennie-Marie Larsen sometimes get caught out in the existing system never mind with complexity ICANN is proposing with new gTLDs.
    http://www.circleid.com/posts/20111017_why_brands_need_their_own_tld_mulberry_sale_site_that_scammed_me/

    Reply
    • Kevin Murphy says:
      December 17, 2011 at 8:57 pm

      The point the APWG made was “the domain name itself usually does not matter to phishers, and a domain name of any meaning, or no meaning at all, in any TLD, will usually do. Instead, phishers almost always place brand names in subdomains or subdirectories”
      Phishers are not generally using brands in their domains today. What makes you think they will do in future?

      Reply
  3. gpmgroup says:
    December 17, 2011 at 10:01 pm

    The current system is very ordered – effectively brand + TLD – in most cases for the largest brands it is effectively even more ordered – brand +.com. The phishers need to represent this structure in their url and the most effective way to do this is with sub domains.
    Ultimately phishers will use what ever gives the best conversions i.e. the url consumers are most likely to believe to be genuine.
    The increased .brand url complexity (store.ebay running.adidas sales.nike etc.) occurring at the same time as a vastly expanded range of new gTLDs is going to offer an incredible amount of realistic domain and sub domain combinations which are ideal for phishing.
    It’s not only what is available it is also what isn’t…
    Say there is a store.dell and store.ibm since there can never be a store.hp a storehp.com or a storehp.shop may seem genuine to a significant percentage of consumers. The point is it is going to be very difficult for consumers to know until they actually visit the url because ICANN will have effectively dismantled many of the sign posts and safe guards of the existing system.

    Reply
    • Kevin Murphy says:
      December 18, 2011 at 12:34 am

      Did you read the APWG report?
      I don’t think you did.

      Reply
      • gpmgroup says:
        December 19, 2011 at 4:49 pm

        I just checked to see if you were referring to a different report. – Nope it’s the same report, and yes I had already read it. I have also read and re-read the previous reports over the last few years as well as your thinking here on the use of sub domains, and I also have already read what the FTC commissioners wrote.
        I still stand by my comments that new gTLDs will likely increase phishing issues and for the reasons I took the time to outline to you above.
        —–
        An aside on the APWG reports:
        Phishing is just a very small subset of spam and passing off sites and thus provides a much smaller dataset for analysis. Which means you have to be very careful how you interpret the data. Because of the way APWG have chosen to report their data any TLD can can appear to the casual reader much better or worse than the TLDs they are being compared with, especially in any single report.

        Reply
  4. Stuart says:
    December 18, 2011 at 3:31 pm

    In answer to the question posed by the headline…ABSOTIVELY POSOLUTELY !!!!

    Reply
  5. Jothan Frakes says:
    December 19, 2011 at 7:14 pm

    The Commission is certainly not one I’d seek to second guess, as they’re looking out for consumers which is a good thing.
    Their objectives are to decrease the illegal activities of perpetrators. Success in this has the added benefit of increasing institutional trust in the naming system.
    That said, the FTC letter, respectfully, is filled with identical material to the rhetoric, emulating the messaging that has been put forth by the ‘New TLD hater camp’ (or the artful consultants that are guiding them).
    It would be quite regrettable if it were the case that CRIDO or other ‘TLD Haters’ were abusing the situation where momentum in addressing issues in the FTC’s position on cybercrime has slight overlap and has been leveraged as a tool here to halt or slow the introduction of new TLDs.
    It seems quite interesting to note the timing of this being close to the two hearings, as if to create a cascading momentum. If the FTC wanted to reduce the problems with the existing system, mandating COM/NET be thick whois would be a far more constructive area to focus.
    It certainly appears to be the case that the FTC has made true statements and has many of their data points correct, but there is a blurring of the distinction between legacy TLDs such as COM/NET/ORG and the new TLDs.
    The majority of the legacy issues are in .COM, as the APWG report indicates, which makes sense, as we have all been conditioned to type .COM over >25 years of use.
    Thin whois and wide international adoption contribute to the majority of the issues that are raised in the letter.
    If you look at the APWG report, the largest gTLD is .COM with nearly half of the reported activity present.
    .COM is obviously popular at nearly 100M domains, and is run by a reputable and competent operator.
    .COM is different in that it has “thin” whois which is a constant bane to law enforcement and rights enforcement because the actual registrant detail is held at one of hundreds of registrars in nearly any country.
    This could be theoretically changed by the FTC by pressuring that thick whois be mandated into the renewal of the .COM agreement next year.
    It is obviously a challenge to retrofit policy and enforcement change into it, else we’d have seen it happen.
    That IMHO would be far more effective focus for the Commission, as it would serve to focus on addressing the majority of the issue. The 7% wholesale increases (10% in .NET) during a recession in the presence of diminishing bandwidth, processing, and storage costs might also be a helpful focus.
    New TLDs have built in rights protections, stricter code of conduct, and will likely have higher costs.
    Anyone who has purchased a new or recently built home in the US is familiar with covenants that make the neighborhood a clean, well manicured place to live, with clear rules. Some things that these covenants define are that there is upkeep on the home and yard, and what time to turn the stereo down.
    This is possible to do because people will accept these terms in order to move into these new cleaner neighborhoods. By contrast, .COM being a free for all, is encumbered only by policy that was retrofitted once it was out in the wild. People are already moved in.
    If .COM were a neighborhood, it is a neighborhood where there can be valuable commerce palaces of strong reputation, mixed with cars up on cinder blocks, any kind of crop in the front yard, a 100 foot billboard erected on the remains of homes, and neighbors blasting music at all hours. And it is quite challenging for the law enforcement to find the tennant to deal with the loud music or stop illegal drug sales.
    The new TLDs are a blank canvas, where ‘neighborhood’ policy like this can be set at the start, before names are added.
    It would be regrettable if we lost the opportunity to witness the benefits of these new neighborhoods.
    ============
    @gpmgroup I don’t get your argument in either comment.
    Brands do certainly experience pain in enforcing their legitimate rights in domain name abuse. They have costs, they spend time, it is not perfect now, and it is a result of the immense difference between domain names and trademark law. I do not mean to trivialize the issues with TM/Domains and brands, but we have to keep it real in discussing those issues.
    In your first comment you example shop.brand, offers.brand or store.brand – these are closed in .brand TLDs and only available to brand holder and there is little chance that they’d allow an infringing registration.
    In your second comment, there is URS as a reactive measure and the clearinghouse as a proactive measure. Neither of these exist in the current system. I am not saying that these are perfect.
    What I am saying is that there have been reports, backed by facts and support data that illustrate minimal infringement in the TLDs from the last two rounds. These reports found <.1% UDRP issues, and
    "new TLD Haters" get annoyed by the use of actual infringement data, instead using exaggerated and made up numbers that are projected by multiplying the highest rates of incident by the highest cost, and then multiplying by 1000 and using other cognitive distortion tools (make sure to bake in a $600/night hotel room for counsel to stay at, list paralegals at full attorney rates) to paint a dire picture that does not look anything like the current state of things.

    Reply
  6. aeiou says:
    December 24, 2011 at 5:09 pm

    …and the above illustrates, quite nicely actually, why the introduction of new GTLDs is a huge mistake.
    Even if ICANN is foolhardy enough to open this Pandora’s Box, citizens will continue to insist on .com anyways so what’s the big fuss all about? Either way the new GTLDs will be a total .FAIL

    Reply

Add Your Comment