Latest news of the domain name industry

Recent Posts

The first .xxx phishing site?

Kevin Murphy, January 3, 2012, Domain Registries

Those readers following @domainincite on Twitter may have noticed I spent a lot of time on Friday Googling for .xxx web sites, to get an idea how the new namespace is being used.

All in the name of research, of course.

As well as the expected video, dating and forum sites, I found one or two inexplicably safe-for-work oddities.

I also found what I believe may be the first .xxx site set up for phishing.

The domain name signin.xxx, registered to an individual in Ohio, looks extremely suspicious, especially when you consider the subdomains the registrant has created.

Here’s a screenshot of the URL www.hotmail.com.signin.xxx:

Signin.xxx

I have no evidence that the site has been used in a phishing attack, or that the registrant intends to use it in one. However, it seems pretty clear that he’s noticed the potential for abuse.

The page’s footer offers to sell the domain for a seven-figure sum.

Will new gTLDs really increase phishing?

Kevin Murphy, December 17, 2011, Domain Policy

The US Federal Trade Commission has come out swinging against ICANN’s new generic top-level domains program, saying it will increase online fraud and should be scaled back.

In an open letter to ICANN’s top brass yesterday, the FTC’s four commissioners claimed that “the dramatic introduction of new gTLDs poses significant risks to consumers”.

Saying that more gTLDs will make it easier for scammers to acquire domain names confusingly similar to existing brands, the commissioners said the program should be rolled out as a limited pilot.

The FTC commissioners wrote (pdf):

A rapid, exponential expansion of gTLDs has the potential to magnify both the abuse of the domain name system and the corresponding challenges we encounter in tracking down Internet fraudsters. In particular, the proliferation of existing scams, such as phishing, is likely to become a serious challenge given the infinite opportunities that scam artists will now have at their fingertips. Fraudsters will be able to register misspellings of businesses, including financial institutions, in each of the new gTLDs, create copycat websites, and obtain sensitive consumer data with relative ease before shutting down the site and launching a new one.

The letter demands better Whois accuracy enforcement, better ICANN compliance programs, and a cap on approved new gTLDs in the first round perhaps as low as a couple dozen.

The FTC’s claims that new gTLDs will increase phishing may not be supported by reality, however.

The latest data (pdf) from the Anti-Phishing Working Group shows that in the first half of the year only 18% of domain names used in phishing attacks were registered by the attacker.

That was down from 28% in the second half of 2010. Phishers are much more likely to compromise a domain belonging to somebody else – by hacking a web server, for example.

Of the 14,650 maliciously registered domains 10,444 (70%) were used to phish Chinese targets, “overwhelmingly” the e-commerce site Taobao.com, the APWG found.

Furthermore, only 2% of these domains – just 1,816 over six months – were judged to have been registered due to their confusing similarity with the brands they target.

The APWG said (emphasis in the original):

These are the lowest numbers we have observed in the last past four years, and show that using domain names containing brand strings has fallen further out of favor among phishers.

the domain name itself usually does not matter to phishers, and a domain name of any meaning, or no meaning at all, in any TLD, will usually do. Instead, phishers almost always place brand names in subdomains or subdirectories

The APWG found only one gTLD that ICANN has introduced – .info, with 4.5% – in its top ten phishing TLDs. The .com space accounts for 48.9% of all phishing domains.

Will the increase in the number of gTLDs reverse these trends? The FTC seems to think so, but the claims in its letter appear to be based largely on guesswork and fear rather than data.

I suspect that the FTC’s letter is more concerned with ICANN’s ongoing bilateral talks with registrars over law enforcement-demanded amendments to the Registrar Accreditation Agreement.

These talks are completely separate and distinct from the new gTLDs program policies, but in the last few weeks we’ve seen them being repeatedly conflated by US lawmakers, and now the FTC.

This may be ignorance, but it could just as well be an attempt to apply political pressure on ICANN to make sure the RAA talks produce the results law enforcement agencies want to see.

ICANN does not want to be forced into an embarrassing retreat on its hard-fought gTLD expansion. By producing a strong RAA, it could deflect some of the concerns about the program.

BITS may apply for six financial gTLDs

Kevin Murphy, October 5, 2011, Domain Registries

BITS, the technology policy wing of the Financial Services Roundtable, may apply to ICANN for as many as six financially-focused new top-level domains.

The organization is pondering bids for .bank, .banking, .insure, .insurance, .invest and .investment, according to Craig Schwartz, who’s heading the project as general manager for registry programs.

(UPDATE: To clarify, these are the six strings BITS is considering. It does not expect to apply for all six. Three is a more likely number.)

Schwartz, until recently ICANN’s chief gTLD registry liaison, told DI that the application(s) will be filed by a yet-to-be-formed LLC, which will have the FSR and the American Bankers Association as its founding members.

It will be a community-designated bid, which means the company may be able to avoid an ICANN auction in the event that its chosen gTLD strings are contested by other applicants.

“We’ve looked at the scoring, and while it may not come into play at all we do believe we can meet the requisite score [for a successful Community Priority Evaluation],” Schwartz said. “But we’re certainly mindful of what’s happening in the space, there’s always the possibility of contention.”

There’s no relationship between BITS and CORE, the Council of European Registrars, which is apparently looking into applying for its own set of financially-oriented gTLDs, Schwartz said.

It’s not a big-money commercial play, but the new venture would be structured as a for-profit entity, he said.

“It’s relatively analogous to what’s happened in the .coop space, where after 10 years they have only about 7,000 registrations,” Schwartz said.

It sounds like pricing might be in the $100+ range. Smaller financial institutions lacking the resources to apply for their own .brand gTLDs would be a likely target customer base.

Interestingly, .bank may begin life as a business-to-business play, used primarily for secure inter-bank transactions, before it becomes a consumer-facing proposition, Schwartz said.

He added that it would likely partner with a small number of ICANN-accredited registrars – those that are able to meet its security requirements – to get the domains into the hands of banks.

VeriSign has already signed up to provide the secure back-end registry services for the bid.

UDRP reform effort begins

Kevin Murphy, February 5, 2011, Domain Policy

ICANN has kicked off a review of its Uniform Dispute Resolution Policy, the occasionally controversial process used to adjudicate cybersquatting complaints.

The GNSO Council on Thursday voted to ask ICANN staff for a so-called “Issues Report” on UDRP, indicating that reform of the process is likely.

This is the relevant portion of the resolution, passed unanimously:

RESOLVED #2, the GNSO Council requests an Issues Report on the current state of the UDRP. This effort should consider:

* How the UDRP has addressed the problem of cybersquatting to date, and any insufficiencies/inequalities associated with the process.

* Whether the definition of cybersquatting inherent within the existing UDRP language needs to be reviewed or updated. The Issue Report should include suggestions for how a possible PDP on this issue might be managed.

Issues Reports commissioned by the Council are expected within 15 days, and 15 days after that the Council is expected to vote on whether to kick off a Policy Development Process.

A PDP could lead to changes to the UDRP that would be binding on all ICANN-accredited registrars and their customers.

While the UDRP has proven very effective at dealing with clear-cut cases of cybersquatting over the last 12 years, critics claim that it is often interpreted too broadly in favor of trademark interests.

If you read this blog regularly, you’ll know I frequently report on unfathomable UDRP decisions, but these are generally the exception rather than the rule.

Unrelated to UDRP, the GNSO Council has also voted against asking ICANN for an Issues Report on registry/registrar best practices for mitigating domain abuse.

Business interests wanted registrars to take more measures (voluntarily) to curb activities such as phishing, but registrars think this kind of rule-making is beyond the scope of the GNSO.

After a lot of heated debate and arcane procedural wrangling, the Council decided instead to ask for a “discussion paper”, a term that has no meaning under ICANN’s rules, meaning a PDP is less likely.

Russian domain crackdown halves phishing attacks

Kevin Murphy, August 20, 2010, Domain Tech

Phishing attacks from .ru domains dropped by almost half in the second quarter, after tighter registration rules were brought in, according to new research.

Attacks from the Russian ccTLD namespace fell to 528, compared to 1,020 during the first quarter, according to Internet Identity’s latest report.

IID attributed the decline to the newly instituted requirement for all registrants to provide identifying documents or have their domains cancelled, which came into effect on April 1.

The report goes on to say:

Following a similar move by the China Internet Network Information Center in December 2009, spam researchers suggested that this tactic only moves the criminals to a new neighborhood on the Internet, but has no real impact on solving the problem.

I wonder whose ccTLD is going to be next.

The IID report also highlights a DNS redirection attack that took place in June in Israel, which I completely missed at the time.

Apparently, major brands including Microsoft and Coca-Cola started displaying pro-Palestine material on their .co.il web sites, for about nine hours, after hackers broke into their registrar accounts at Communigal.