3 ms·
I actually like this idea, and I wonder how low the cost could be while still deterring the spammers. From what I've read, the cost of domains is a factor that
by dane-pgp 7y ago
I actually like this idea, and I wonder how low the cost could be while still deterring the spammers. From what I've read, the cost of domains is a factor that spammers are sensitive to, especially if they are abandoning them after 24 hours, so increasing the cost by just an order of magnitude could be enough to make many campaigns unprofitable.
This article somewhat supports my assertion:
https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/ https://krebsonsecurity.com/2018/06/bad-men-at-work-please-d...
saying "domains in the remaining five [out of ten] Top Bad TLDs can be had for between 48 cents and a dollar each." so I would suggest a one-off $100 fee rather than $500 or $1000 a year.
A more interesting approach would be to make the fee act as a bond, which is returned to the registrant after a year of good behaviour. Unfortunately, determining "good behaviour" is almost as hard as determining "bad behaviour", but perhaps a domain could opt in to having anonymous metrics recorded of how many users visit their site or send emails to that domain. That would put a substantial amount of trust into the hands of whichever organisations were responsible for recording these metrics, but the only harm they could do to a registrant is forcing them to pay their $100 bond to charity.
- FDSGSG 7y agoPhishing is so lucrative that a $100 fee on domain registrations would do literally nothing to combat it. 20-30 victims can easily earn the phisher $1000
- dane-pgp 7y agoThat's an important number to note, thank you. Do you have an estimate for how many victims a single domain is likely to trick (before it gets blacklisted by Google Safe Browsing or similar)?
- FDSGSG 7y agoDepends on who's being spammed and what kind of techniques the phishing site employs to resist safebrowsing. Single-use links and various browser fingerprinting techniques are common and fairly effective. Beyond that it comes down to who's being spammed, with the right demographics your link could last very long without being reported by anyone. I hack phishing sites for fun, anything between 0-500 hits seems common for the type of phishing seen in the OP (mostly depending on the quality of the leads).