12 ms·
Phish-friendly domain registry ".top" put on notice
- bell-cot 2y agoDaydream: Browsers and email programs are shipped with "Default Allow" lists, which include only the older & higher-quality TLD's. While users can add whatever TLD's they want to the lists, that default behavior destroys 99% of the value of new & crap-infested TLD's.
- lainga 2y agoAte some cheese before dreaming: Google and MSFT (as maintainers of the dominant mail clients) start charging TLDs under the table to go on GMail/Outlook's "Default Allow" list, except, of course, the ones that Google administers
- bell-cot 2y agoSadly, yes. And no "dream" disclaimer is needed.
- sureIy 2y agoIf you want to do that you can already knock yourself out with a custom DNS. Browsers must be neutral. From the article: > .top was the most common suffix in phishing websites over the past year, second only to domains ending in “.com.” Does that mean you want to block .com domains?
- dylan604 2y ago# .top phishing websites / # .top websites total vs # .com phishing websites / # .com websites total make educated decisions
- throwaway4pp24 2y agoWhy does that matter at all? If I go and create a bunch of legitimate .top domains, is it suddenly better somehow? No, it's still the first of the list, and .com is still second.
- dylan604 2y agoyes, precisely. if you and a bazillion other people do it so that the percentage goes down. it's the fact that scammers are glomming onto a trendy TLD ruins the reputation of that TLD. If the percentage of scam is higher in one TLD over another, people will consider it a TLD used for scams. Not sure where the logic breaks down here > No, it's still the first of the list, and .com is still second. also, what do you mean .com is second? it states that .top was second to .com
- nucleardog 2y ago> Why does that matter at all? Because any action will have a negative impact on the legitimate sites and we want to maximize the effect while minimizing collateral damage. It seems you’re saying if there’s a terrorist training camp with 10 terrorists and no bystanders in it, it would be unreasonable to drop a bomb on it unless we’re first willing to level the nearby city of a million people with 11 terrorists in it because it has more terrorists. Which… no.
- TJSomething 2y agoThis made me sad when got a domain that used the TLD for a domain hack, then realized that I couldn't use it for emails.
- ErikAugust 2y ago“ top was the most common suffix in phishing websites over the past year, second only to domains ending in “.com.” So should we default not allow .com?
- BobbyJo 2y agoQuality is relative. A far larger percentage of .com domains are legitimate.
- Volundr 2y agoPer the article 0.2% of .com domains are phishing vs 4.2% of .top. Or put another way, if you have a .top domain it's about 17 times as likely to be phishing than a .com domain. .com has the most phishing domains by virtue of by far being the biggest, not because they have looser controls or are less reliable.
- deleted 2y ago[deleted]
- arp242 2y agoOnly if you select a random domain from a list of all .com or .top domains. No one does that of course. The chance a random .top (or .com) you encounter is a phishing domain isn't so easily calculated, depends on where you see it, etc.
- ricardobayes 2y agoGot to love the mindset of the "old-school" cybersecurity folks.
- bell-cot 2y agoMS-DOS - 42 years without a remote hole in the default install!
- tristor 2y agoI already do this with NextDNS, I block all the "new" TLDs except for .io, .tv, and .ai because they're used for tech sites that are legitimate. I know that many organizations do the same, in fact it's mentioned in another comment.
- sunshowers 2y agoAll three of them are ccTLDs, so they aren't part of the "new" gTLD bucket (where .zip, .top, .xyz etc live).
- glitcher 2y agoStrange coincidence, moments ago I just received a phishing SMS about some bogus package that couldn't be delivered attempting to get me to visit a link on a ".top" address!
- bluejekyll 2y agoThis really makes me wonder about the value of TLDs in general. Let’s say that “gmail” is a well known enough name that “gmail.com”, “gmail.org”, …, “gmail.top” should be reserved by default. If that’s the case, then the value of separate TLDs becomes interesting because two companies “abc.com” and “abc.top” would now have competing concerns. It seems like only small companies would then be open to phishing, and large ones would possibly be able to use trademark law across all TLDs. In fact large companies tend to try and reserve their name in all major TLDs. I’m not really arguing for or against greater or fewer TLDs, but it does seem like an awkward situation.
- Cthulhu_ 2y agoIn theory, Google could pay for the TLD ".google" so that... anything .google is reserved by default for google domains. But this isn't going to work in practice; people don't read URLs so it doesn't matter. Second, for years there was this idea that all porn sites should be forced to go to a .xxx TLD so that it's easy to block, but that's impossible to legislate and / or enforce.
- anamexis 2y agoNot sure if this is your point, but Google does have the .google TLD which it reserves for google domains.
- numbsafari 2y agoI think mean the .goog TLD: https://icannwiki.org/.goog https://icannwiki.org/.goog
- anamexis 2y agoI did mean .google, but .goog fits as well. https://icannwiki.org/.google https://icannwiki.org/.google See also .apple, .microsoft, .amazon, .aws, and many more.
- Zambyte 2y ago
- donatj 2y agoSince when has it been the responsibility of the registry to police the content of its domains? This feels like a slippery slope from phishing to piracy to censoring unpopular political beliefs.
- fckgw 2y agoFor like several decades? If registrars don't respond to complaints of abuse then they don't get to be registrars anymore.
- TheCleric 2y agoBased on the title I thought this was about the band and was very confused.
- fortran77 2y agoI just read this article about Phish and the Dead at the Sphere and had the same confusion: https://www.newyorker.com/magazine/2024/07/29/reckoning-with-the-dead-at-the-sphere https://www.newyorker.com/magazine/2024/07/29/reckoning-with...
- chupon 2y agoThey should reserve rocky.top https://phish.net/song/rocky-top https://phish.net/song/rocky-top
- rconti 2y agoSame. I figured "welp, 'top' is yet another weird phenomenon in the world of Phishdom".
- block_dagger 2y agoI'll just leave this here for those interested: https://phish.in https://phish.in
- wyclif 2y agoPersonally, I prefer Grateful Dead-friendly domain registries.
- avs733 2y agothis was validating. I actually did it twice...once last night, forgot, and then did it again this morning.
- w-m 2y agoI have a story on using weird/fishy/phishy TLDs: Recently my colleagues and I started collecting information on all the available compression methods for 3D Gaussian Splatting (3DGS, a popular method for 3d scene representation). There were quite a few works in the area with naming conflicts already, so I thought to give it a unique short name to refer to - and came up with “3dgs.zip”. A few days later we started putting together a web page, and I noticed that .zip actually is available as a TLD. Impulsively I bought the domain, https://3dgs.zip/ https://3dgs.zip/, launched it and printed it on a few shirts before heading off to a conference. Felt a bit weird that there is a .zip TLD, but I was in a rush and I didn’t ponder its existence any further. But strange things started happening: setting up the domain for a GitHub page worked, but in the process downloaded a 0 Byte file called “3dgs.zip”, when submitting content one of the GitHub.com forms. And a few days later colleagues told me they had trouble accessing the site. After some DNS sleuthing and then some back-and-forth with our IT dept, it turned out that our organization has blocked the whole TLD - for every Windows user, out of phishing concerns of people being confused. I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? But in any case I wasn’t able to find any .zip URL with a purpose, but lots of Reddit posts of angry sysadmins who bemoaned the influx of terrible TLDs with mostly phishing use and vowed to block them all. So they probably have a point in downright blocking the whole TLD. Now I’m sitting here with my .zip url. Had to revert the page to use github.io, so people in my organization (and similarly thinking ones) would be able to access it. Guess I’m cured for a while, won’t be using any novelty TLDs anytime soon…
- walls 2y agoI grabbed two .zip domain names that I knew were used frequently as filenames and set them up to return a zip with an html inside. The html tries to load a specific resource from the server to let it know the html was opened. There are dozens of unique opens per week. I'm very curious how an executable would do, but I'm not trying to cause any problems.
- codetrotter 2y agohttp://iloveu.exe http://iloveu.exe would be a neat website tho
- nulld3v 2y agoA big reason why .top is used so much is because it is so cheap. Phishers can rotate through many more domains using .top compared to other domains. IMO this isn't a particularly big problem, it's cool to let people buy cheap domains. It also doesn't really save the phishers that much money. You aren't going to solve the problem by making domains more expensive, it might impact phishers' margins but they will continue phishing.
- Retr0id 2y agoImpacting phishers' margins is all we can do, really.
- inetknght 2y agoStronger investigative and enforcement actions is something we can do. But it's something that we don't stomach. I wonder why. I suppose it's because the modern business-centric Internet is centered on the ability to scam people out of money. Investigations and enforcements would open the floodgates to every "normal" business too.
- mschuster91 2y agoThe problem is it's cross-border. Domestic law enforcement will almost always run into dead ends, maybe they'll catch some money mule that got conned into the job, but that's it. The real dent would be to get India (for US scammers) and Turkey (for German scammers) to cooperate, the way to do it would be to threaten devastating sanctions ("clean up your scammer scenes, or else"), but that cannot be done as it is important for geopolitical reasons to appease India (a significant portion of the world's pharmaceutical base compounds originate from there, not to mention the Ukraine conflict) and Turkey (same reason, Ukraine conflict + about 2 million Syrian refugees that Erdogan already abused as a political weapon once).
- inetknght 2y ago> The problem is it's cross-border That's a feature. And the great thing of this feature is that it's opt-out. You can block connections from outside of jurisdictions you care about.
- nevi-me 2y agoThis is encouraging. We have a big tender (procurement) scam in our country, and I receive at least 10 different emails daily about fake procurement requests (the central gov database was either leaked, or the criminals are working in tandem with its administrators). At times I have reported the impersonating domains, and I'd say that registrars have acted on under 5% of my complaints (within reasonable time). If they use a local domain name, it's easier to complain directly with our country's registry administrator. My problem is often with registrars that are in random countries. It's encouraging that some action is being taken, and I think in future I should also lay complaints with ICANN.
- pnw 2y agoThis has been an issue for decades in my experience. ICANN has rules but they do very little to resolve complaints against bad registrars.
- duskwuff 2y ago> This is encouraging. We have a big tender (procurement) scam in our country, and I receive at least 10 different emails daily about fake procurement requests (the central gov database was either leaked, or the criminals are working in tandem with its administrators). It's not just you, and I don't think it's targeted - I'm getting these messages as well on my personal email. This appears to be a major ongoing spam wave.
- Jerry2 2y agoThey need to do exact same thing with .xyz TLD. It's gotten so bad that I had to block .xyz on our router.
- tristan957 2y agoWhat are you doing to get spammed/phished that often? I am not sure I've ever seen an illegitimate use of .xyz.
- autoexec 2y agoNow do the same for .io .site and .cc I've see tons of phishing from those domains. Even the ones who eventually take down sites that I report, they don't look for other sites/domains from the same scammers or that have the same content, and they don't do anything to stop the same person from getting another domain and then putting the exact same content on it. I shouldn't be hard for a company to identify most of these scammers. They are not subtle. Very basic automated checks to see what content is being served from new domains based on previously discovered phishing sites could catch a lot of it. Company's just aren't required by law to care so they don't. Even big companies are terrible when it comes to phishing. I found out recently that for some google sites you can't even report the phishing site to Google without first signing into a google account. Why someone should have to hand over their personal info to Google in order to report a phishing site is beyond me. It's bad enough that Google refuses to respect RFC 2142 and accept reports at an abuse@ address. Internet standards exist to prevent exactly this kind of bullshit.
- ffhhj 2y agoStrange that .co doesn't even show up in the list. I have a 3 letter .co similar to another .com domain and constantly receive customer id's and internal communications.
- iancmceachern 2y agoBummer, I was hoping this had something to do with the band
- npc12345 2y ago[dead]
- reaperducer 2y agoWhile I don't disagree with warning .top, I notice in the report that .lol and .bond have higher "Phishing Domain Scores" than .top. Hopefully they got a nastygram, too.
- diego_sandoval 2y agoAn organization like ICANN should not be concerned with the specific uses people are giving to their domain names. Their mission should be to create a system that makes it convenient for actors to identify each other across the Internet, so that they can communicate arbitrary data. ICANN should be agnostic to the contents of the communications.
- sunshowers 2y agoI generally don't disagree! But large-scale phishing is a threat to the integrity of the domain name system, so it is in ICANN's interest to crack down on it.
- denysvitali 2y agoTo be fair, it might be beneficial if they don't block them - I have never seen a legitimate use of the .top domain, so if that helps us get rid of the spam (by blocking the whole TLD on our systems) it's probably a win-win situation (?)
- Habgdnv 2y agoIt's incredibly frustrating to hear such blanket statements about .top domains! I have a .top domain specifically to teach my son about DNS, certificates, Active Directory, and more. Just because some misuse the TLD doesn't mean all of us do. Is it really so shady and illegitimate to educate kids for free? Should we all just fork out $500 for a "legitimate" .new domain instead? Ridiculous! Why not go further and disallow all self-hosters, putting them in jail alongside pirates like Kim Dotcom or Assange?
- yjftsjthsd-h 2y ago> Should we all just fork out $500 for a "legitimate" .new domain instead? A .com costs ~$15. I do sympathize, but this is not that high a barrier.
- tomjen3 2y agoSure, but at this point, the only ones left are long unreadable ones. Whereas my homelab has a simple, easily readable 6 letter .top domain.
- waffleiron 2y agoThere are whole countries where that is a high barrier, where that could be a many hours or days of work. It might not be a high barrier to you, but there are many millions to whom it is.
- denysvitali 2y agoHonestly, if I receive a link ending on .top I would simply not click it. 90% of the time (from experience) it's either phishing or malware. You're still free to host whatever you want, wherever you want - but it's clear that .tk / .top domains are not for serious stuff
- kurthr 2y agoMother-in-Law just got a smishing text yesterday for a USPS scam. Luckily, she couldn't remember her username/password (she doesn't have one there) so she didn't enter anything, but I got a call. The link was on .top
- 9cb14c1ec0 2y agoYup, I got several of those .top USPS scams. I did a whois history search, found that the domain (and about a dozen similar ones) were transferring to new registrars every several days. I guess that makes it more difficult for abuse reports to catch up to them. Clicked the link on purpose, and of course it wanted a credit card number. I gave a virtual card number with a spending limit of 0. Sure enough, several days later someone tried to use it to buy ads on Facebook.
- kgbcia 2y agoI registered a top domain for ten years , total cost $28.
- tomjen3 2y agoI am using a .top domain for my homelab (because it was cheap). How will existing domains be handled, assuming ICAN shuts down the registrar?
- jusepal 2y agoThey won't just outright terminate the whole tld just like that. They'll first try to find another registry willing to take over the zone. But that poses another problem, assuming you haven't reg it for something like 10 years, suddenly it won't be as cheap anymore if the new registry taking it over decided to hike the fee. Afaik .top is just really cheap for the 1st year. For subsequent renewal its around $4-5. More stable, less spammy, no looming problem of registry getting revoked .de .be .uk is around $4-5 too.
- deleted 2y ago[deleted]
- bmo-at 2y agoLiterally just received some .top spam last night, nothing new there but curiously it was addressed to the mailing list for all students in my department. Very sparse content too: Just a t.co link shortener address, which resolved to a .top domain (interestingly with an invalid https cert instead of going just with http). It was sent from an obviously compromised gmail address. Fellow students in other mailing lists got other shorteners with other domains, all resolving to the same russian ip address. Thats as far as I investigated.
- jusepal 2y agoHow these shady registry handle abuse is why i never use their dirt cheap tld for email. Most corporate firewall either outright reject them or blackhole into oblivion. Best case scenario is auto route to spam folder. Might be useable as cheap domain used for hobby site, as personal dynamic dns domain but for email, nope. I'd cough up $10 for .com .net .org and recent popular one the .me .io for best email deliverability instead of saving $5 and wondering whether my outgoing mail would arrive or not.
- singpolyma3 2y ago> The warning comes amid the release of new findings that .top was the most common suffix in phishing websites over the past year, second only to domains ending in “.com.” And this is why this is bullshit. Imagine them threatening to end .com over this. No? Then why bully others.
- Seattle3503 2y agoIs there more info on the phishing websites hosted on IPFS? I'm curious how content is forwarded to unaugmented browsers.
- whlh 2y ago[dead]