5 ms·

GoDaddy is making a ton of money by allowing spammers and scammers to abuse .US domains. They have a massive incentive to turn a blind eye to it because cutting

GoDaddy is making a ton of money by allowing spammers and scammers to abuse .US domains. They have a massive incentive to turn a blind eye to it because cutting these bad actors off would mean they lose out on all that money. It doesn't matter to them if the money they're getting is likely stolen to begin with or that the domains will be used to rip off countless others. Amoral monsters who will do anything for money can't be trusted to do anything other than make money. It's bad enough they're able to register domains with other TLDs, but we should probably not allow them to manage .US at all given their track record.

paxys 3y ago
So you are saying GoDaddy should first audit and approve every business before selling them a domain? They are a domain registrar, and their only job is to sell a domain to whoever wants it in a few clicks, nothing more. There is nothing special about ".us" over anything else. Content problems are the business of the FBI and other law enforcement agencies.
- londons_explore 3y ago
  > Content problems are the business of the FBI and other law enforcement agencies. I've often wondered why the FBI don't have a website where I, a random citizen, can get hold of SSN's, credit cards, bank accounts etc. to give to any scammer who asks me. The FBI would then trace all uses of those numbers and use them like a honeypot.
  - Wowfunhappy 3y ago
    It seems like a clever idea to me! The first problem that comes to mind (not necessarily insurmountable) is that some number of people will use the honeypot data in legitimate forms, either due to cluelessness or intentional fraud on their end. It's not immediately obvious to me what happens in that case.
  - autoexec 3y ago
    My first thought was that the numbers would end up being collected and screened for by bad actors and if the numbers were generated on demand, we'd eventually just run out of valid SSNs or credit card numbers. It might work on a small scale though. They could give a few of those numbers out to security researchers and internet abuse desks.
  - deleted 3y ago
    [deleted]
- miah_ 3y ago
  It used to be that to get a SSL certificate you had to provide a Dun & Bradstreet ID, and go through a minor audit. Was the Internet safer then? Well I certainly wasn't being phished in the 90's because it wasn't really a thing yet. I enjoy what Letsencrypt brings us so I don't want to go back to that, but I do believe the registrars are certainly partially to blame here, look at Google and .zip, how many valid domains are registered with that TLD, and how many are malicious? We can make better decisions, it just requires not being so damned greedy.
  - burnte 3y ago
    Only some vendors did that, most didn't. And that was back in the days when we though SSL would be useful for ID verification, which it never was meant to be used for.
  - kube-system 3y ago
    Those barriers to entry meant basically nobody hosted malicious sites with an SSL cert back then. "Look for the lock" was a valid security recommendation in those days.
    - indymike 3y ago
      Actually, we'd just see the web part of an attack on a hacked webserver, often with an wildcard EV cert. something.majorcorp.com/some/backwater/director/index.htm. The funny part is the phish would look like something at UPS and be hosted on some airline site, so the advice to check the link was the best defense.
      - fullspectrumdev 3y ago
        I still see this pretty much daily. Usually you find the mailer script (for spamming), a web shell, and a few different phish kits all under some directory. Also usually the captured credentials, etc. Sloppy work from the crooks, but it works.
  - nulbyte 3y ago
    > It used to be that to get a SSL certificate you had to provide a Dun & Bradstreet ID, and go through a minor audit. What kind of audit? And was it conducted by DNB? If so, some audit it must have been. I can't speak to the time before, but these days, DNB is a scam in and of itself. Just last year, the FTC finalized its order against them for deceptively selling a junk business credit monitoring service and failing to correct errors on business credit reports--even today, they'll tell you they don't know who provided the data that they themselves collected in the first place.
- deathanatos 3y ago
  > There is nothing special about ".us" over anything else. No, .us is special; the OP sums it up well enough: > Under NTIA regulations, the administrator of the .US registry must take certain steps to verify that their customers actually reside in the United States, or own organizations based in the U.S. Such restrictions aren't unique to .us, and I've worked with other ccTLDs that have similar restrictions. Generally, AIUI, they're supposed to be for the people of that nation, who can then do as they see fit. Maybe that's free access to whoever pays for it, maybe that's "only our people", such as is closer to the case here. > Content problems are the business of the FBI and other law enforcement agencies. If GoDaddy actually did the job they were supposed to be doing here, it might actually be possible for that to happen, since there'd be a door on US soil to bust down, but if the bad actor is just in some far-away nation that was never supposed to have been permitted to register that domain in the first place, the bar goes up a bit.
ToucanLoucan 3y ago
I know the enforcement of this would be problematic and require some tinkering and the establishment of probably a whole department of the .gov and a lot of tinkering by well informed people, but it is just wild to me that all entities, not even just registrars, but every entity in every step of the process, from registrars, to ISPs, to cloud service providers, to email providers, to hosting providers, everyone involved in a scammers' operation profits from the scamming, and none of them* are even slightly culpable. Like how are you selling amaz0n.us and NOT figuring out that someone is up to shady shit? How are you approving thousands of emails with Amazon in the subject line and not realizing you are not Amazon's provider? How are you hosting pages clearly duplicated off legitimate websites that this one IS ABSOLUTELY NOT and just shrugging your shoulders? I'm not even saying we need continuous monitoring on all these fronts but like, if you get an inordinate number of spam reports on a client, maybe take a freaking look? Maybe take a look at what your hosting servers are publicly serving? Maybe give the mildest of a shit about promoting a healthier Internet, considering you're selling the tools people use to build it?
- whatshisface 3y ago
  One problem is that if they start policing spam, they might have to answer to Congress' opinions about content that is "as bad as spam" or worse like so-called misinformation. That is one reason (constitutional protection of freedom of speech) that the USPS ships so much junk mail around even when they could from an operational perspective (but again, not a constitutional perspective) decline it. I am not saying that the constitution protects phishing emails, but I am saying that claims of the technology not being developed yet for policing online content are one major reason the recent age verification push in Australia did not go into effect. It is not an unmitigated good for control at that level of granularity to be possible.
  - manfre 3y ago
    The USPS is paid to deliver the bulk rate mail spam. That is one of their strongest reasons to not block it.
  - ToucanLoucan 3y ago
toss1 3y ago
YUP. >>NTIA currently contracts out the management of the .US domain to GoDaddy, by far the world’s largest domain registrar. >> Under NTIA regulations, the administrator of the .US registry must take certain steps to verify that their customers actually reside in the United States, or own organizations based in the U.S. But Interisle found that whatever GoDaddy was doing to manage that vetting process wasn’t working. On reading that, my first thought was "why would anyone who has a clue expect GoDaddy to do anything resembling the right thing, especially if doing the wrong thing and/or doing it wrong will net them more money? Evidently (in this case, well-earned negative-) reputation counts for nothing.
- smitty1110 3y ago
  Wow, this is a blast from the past. Long story short, the original performer (Neustar) won the renewed contract, but everything went to hell and they got taken private by a PE firm. They sold off the entire registry unit to make some cash. GoDaddy had bid against Neustar for that contract in 2018, and lost (water cooler talk at the time was becasue the feds hated them), but won the war by purchasing a distressed asset.
reaperducer 3y ago
They have a massive incentive to turn a blind eye to it because cutting these bad actors off would mean they lose out on all that money. GoDaddy could make even more money by cutting those people off. Then they can re-sell the domain again. Like when a restaurant shortens the amount of time diners are allowed to linger so it can turn the tables more often.
- freedomben 3y ago
  This is a good point. I have loathing for GoDaddy based on abject misery they've subjected me to in the past, coupled with their unethical behavior (like registering and re-selling (for much more money) domains that customers are searching for through their interface but don't buy right a way). But it's important not to be overly reductive about the incentives here.
  - deleted 3y ago
    [deleted]
- autoexec 3y ago
  Ideally, they'd be doing their job and screening these people before they paid for a domain and started hosting phishing sites or malware, but you know, assuming they were catching these issues proactively and basically as soon as the payment was processed I'd be okay with them taking the money before shutting the domain down. Sure, it'd still be a company profiting from stolen money, but if it can't be returned it might as well be wasted. I think the issue is that as soon as scammers realized they were throwing their money away they'd stop buying up .US domains and find some other means to trick people. Probably just using other TLDs and/or registrars which means GoDaddy loses their income stream either way.
  - stOneskull 3y ago
    godaddy needs a spanking
    - isk517 3y ago
deleted 3y ago
[deleted]
username135 3y ago
Such are the typically nefarious means to the end that is capitalism. When you strip away all the PR and bull sh*t, a company's only purpose is to make money for their owners. Most won't care how that happens.

paxys 3y ago

So you are saying GoDaddy should first audit and approve every business before selling them a domain? They are a domain registrar, and their only job is to sell a domain to whoever wants it in a few clicks, nothing more. There is nothing special about ".us" over anything else. Content problems are the business of the FBI and other law enforcement agencies.

londons_explore 3y ago
> Content problems are the business of the FBI and other law enforcement agencies. I've often wondered why the FBI don't have a website where I, a random citizen, can get hold of SSN's, credit cards, bank accounts etc. to give to any scammer who asks me. The FBI would then trace all uses of those numbers and use them like a honeypot.
- Wowfunhappy 3y ago
  It seems like a clever idea to me! The first problem that comes to mind (not necessarily insurmountable) is that some number of people will use the honeypot data in legitimate forms, either due to cluelessness or intentional fraud on their end. It's not immediately obvious to me what happens in that case.
- autoexec 3y ago
  My first thought was that the numbers would end up being collected and screened for by bad actors and if the numbers were generated on demand, we'd eventually just run out of valid SSNs or credit card numbers. It might work on a small scale though. They could give a few of those numbers out to security researchers and internet abuse desks.
- deleted 3y ago
  [deleted]
miah_ 3y ago
It used to be that to get a SSL certificate you had to provide a Dun & Bradstreet ID, and go through a minor audit. Was the Internet safer then? Well I certainly wasn't being phished in the 90's because it wasn't really a thing yet. I enjoy what Letsencrypt brings us so I don't want to go back to that, but I do believe the registrars are certainly partially to blame here, look at Google and .zip, how many valid domains are registered with that TLD, and how many are malicious? We can make better decisions, it just requires not being so damned greedy.
- burnte 3y ago
  Only some vendors did that, most didn't. And that was back in the days when we though SSL would be useful for ID verification, which it never was meant to be used for.
- kube-system 3y ago
  Those barriers to entry meant basically nobody hosted malicious sites with an SSL cert back then. "Look for the lock" was a valid security recommendation in those days.
  - indymike 3y ago
    Actually, we'd just see the web part of an attack on a hacked webserver, often with an wildcard EV cert. something.majorcorp.com/some/backwater/director/index.htm. The funny part is the phish would look like something at UPS and be hosted on some airline site, so the advice to check the link was the best defense.
    - fullspectrumdev 3y ago
      I still see this pretty much daily. Usually you find the mailer script (for spamming), a web shell, and a few different phish kits all under some directory. Also usually the captured credentials, etc. Sloppy work from the crooks, but it works.
- nulbyte 3y ago
  > It used to be that to get a SSL certificate you had to provide a Dun & Bradstreet ID, and go through a minor audit. What kind of audit? And was it conducted by DNB? If so, some audit it must have been. I can't speak to the time before, but these days, DNB is a scam in and of itself. Just last year, the FTC finalized its order against them for deceptively selling a junk business credit monitoring service and failing to correct errors on business credit reports--even today, they'll tell you they don't know who provided the data that they themselves collected in the first place.
deathanatos 3y ago
> There is nothing special about ".us" over anything else. No, .us is special; the OP sums it up well enough: > Under NTIA regulations, the administrator of the .US registry must take certain steps to verify that their customers actually reside in the United States, or own organizations based in the U.S. Such restrictions aren't unique to .us, and I've worked with other ccTLDs that have similar restrictions. Generally, AIUI, they're supposed to be for the people of that nation, who can then do as they see fit. Maybe that's free access to whoever pays for it, maybe that's "only our people", such as is closer to the case here. > Content problems are the business of the FBI and other law enforcement agencies. If GoDaddy actually did the job they were supposed to be doing here, it might actually be possible for that to happen, since there'd be a door on US soil to bust down, but if the bad actor is just in some far-away nation that was never supposed to have been permitted to register that domain in the first place, the bar goes up a bit.

ToucanLoucan 3y ago

I know the enforcement of this would be problematic and require some tinkering and the establishment of probably a whole department of the .gov and a lot of tinkering by well informed people, but it is just wild to me that all entities, not even just registrars, but every entity in every step of the process, from registrars, to ISPs, to cloud service providers, to email providers, to hosting providers, everyone involved in a scammers' operation profits from the scamming, and none of them* are even slightly culpable. Like how are you selling amaz0n.us and NOT figuring out that someone is up to shady shit? How are you approving thousands of emails with Amazon in the subject line and not realizing you are not Amazon's provider? How are you hosting pages clearly duplicated off legitimate websites that this one IS ABSOLUTELY NOT and just shrugging your shoulders? I'm not even saying we need continuous monitoring on all these fronts but like, if you get an inordinate number of spam reports on a client, maybe take a freaking look? Maybe take a look at what your hosting servers are publicly serving? Maybe give the mildest of a shit about promoting a healthier Internet, considering you're selling the tools people use to build it?

whatshisface 3y ago
One problem is that if they start policing spam, they might have to answer to Congress' opinions about content that is "as bad as spam" or worse like so-called misinformation. That is one reason (constitutional protection of freedom of speech) that the USPS ships so much junk mail around even when they could from an operational perspective (but again, not a constitutional perspective) decline it. I am not saying that the constitution protects phishing emails, but I am saying that claims of the technology not being developed yet for policing online content are one major reason the recent age verification push in Australia did not go into effect. It is not an unmitigated good for control at that level of granularity to be possible.
- manfre 3y ago
  The USPS is paid to deliver the bulk rate mail spam. That is one of their strongest reasons to not block it.
- ToucanLoucan 3y ago

toss1 3y ago

YUP. >>NTIA currently contracts out the management of the .US domain to GoDaddy, by far the world’s largest domain registrar. >> Under NTIA regulations, the administrator of the .US registry must take certain steps to verify that their customers actually reside in the United States, or own organizations based in the U.S. But Interisle found that whatever GoDaddy was doing to manage that vetting process wasn’t working. On reading that, my first thought was "why would anyone who has a clue expect GoDaddy to do anything resembling the right thing, especially if doing the wrong thing and/or doing it wrong will net them more money? Evidently (in this case, well-earned negative-) reputation counts for nothing.

smitty1110 3y ago
Wow, this is a blast from the past. Long story short, the original performer (Neustar) won the renewed contract, but everything went to hell and they got taken private by a PE firm. They sold off the entire registry unit to make some cash. GoDaddy had bid against Neustar for that contract in 2018, and lost (water cooler talk at the time was becasue the feds hated them), but won the war by purchasing a distressed asset.

reaperducer 3y ago

They have a massive incentive to turn a blind eye to it because cutting these bad actors off would mean they lose out on all that money. GoDaddy could make even more money by cutting those people off. Then they can re-sell the domain again. Like when a restaurant shortens the amount of time diners are allowed to linger so it can turn the tables more often.

freedomben 3y ago
This is a good point. I have loathing for GoDaddy based on abject misery they've subjected me to in the past, coupled with their unethical behavior (like registering and re-selling (for much more money) domains that customers are searching for through their interface but don't buy right a way). But it's important not to be overly reductive about the incentives here.
- deleted 3y ago
  [deleted]
autoexec 3y ago
Ideally, they'd be doing their job and screening these people before they paid for a domain and started hosting phishing sites or malware, but you know, assuming they were catching these issues proactively and basically as soon as the payment was processed I'd be okay with them taking the money before shutting the domain down. Sure, it'd still be a company profiting from stolen money, but if it can't be returned it might as well be wasted. I think the issue is that as soon as scammers realized they were throwing their money away they'd stop buying up .US domains and find some other means to trick people. Probably just using other TLDs and/or registrars which means GoDaddy loses their income stream either way.
- stOneskull 3y ago
  godaddy needs a spanking
  - isk517 3y ago

deleted 3y ago

[deleted]

username135 3y ago

Such are the typically nefarious means to the end that is capitalism. When you strip away all the PR and bull sh*t, a company's only purpose is to make money for their owners. Most won't care how that happens.