The Chinese company in accuse of handing out domain names finishing in “.top” has been given until mid-August 2024 to show that it has put in place systems for managing deceptive finisheavor inestablishs and suspfinishing abusive domains, or else forfeit its license to sell domains. The alerting comes amid the free of new discoverings that .top was the most standard sufrepair in deceptive finisheavor websites over the past year, second only to domains finishing in “.com.”
Image: Shutterstock.
On July 16, the Internet Corporation for Assigned Names and Numbers (ICANN) sent a letter to the owners of the .top domain registry. ICANN has filed hundreds of utilizement actions aobtainst domain registrars over the years, but in this case ICANN individuald out a domain registry reliable for sustaining an entire top-level domain (TLD).
Among other reasons, the omitive chided the registry for fall shorting to reply to inestablishs about deceptive finisheavor aggressions involving .top domains.
“Based on the recommendation and enrolls assembleed thraw cut offal weeks, it was resettled that .TOP Registry does not have a process in place to promptly, comprehensively, and reasonably spendigate and act on inestablishs of DNS Abinclude,” the ICANN letter reads (PDF).
ICANN’s alerting redacted the name of the recipient, but enrolls show the .top registry is rund by a Chinese entity called Jiangsu Bangning Science & Technology Co. Ltd. Recurrentatives for the company have not replyed to seeks for comment.
Domains finishing in .top were recurrented famously in a new deceptive finisheavor inestablish freed today by the Interisle Consulting Group, which sources deceptive finisheavor data from cut offal places, including the Anti-Phishing Working Group (APWG), OpenPhish, PhishTank, and Spamhaus.
Interisle’s newest study spendigated cforfeitly two million deceptive finisheavor aggressions in the last year, and set up that deceptive finisheavor sites accounted for more than four percent of all new .top domains between May 2023 and April 2024. Interisle shelp .top has rawly 2.76 million domains in its firm, and that more than 117,000 of those were deceptive finisheavor sites in the past year.
Source: Interisle Consulting Group.
ICANN shelp its appraise was based on recommendation accumulateed and studied about .top domains over the past scant weeks. But the fact that high volumes of deceptive finisheavor sites are being enrolled thraw Jiangsu Bangning Science & Technology Co Ltd. is challengingly a new trfinish.
For example, more than 10 years ago the same Chinese registrar was the fourth most standard source of deceptive finisheavor websites, as tracked by the APWG. Bear in mind that the APWG inestablish excerpted below was unveiled more than a year before Jiangsu Bangning getd ICANN approval to present and regulate the new .top registry.
Source: APWG deceptive finisheavor inestablish from 2013, two years before .top came into being.
A fascinating new wrinkle in the deceptive finisheavor landscape is the growth in deception pages arrangeed via the InterPlanetary File System (IPFS), a decentralized data storage and deinhabitry nettoil that is based on peer-to-peer nettoiling. According to Interisle, the include of IPFS to arrange and start deceptive finisheavor aggressions — which can originate deceptive finisheavor sites more difficult to get down — incrmitigated a staggering 1,300 percent, to rawly 19,000 deceptive finisheavor sites inestablished in the last year.
Last year’s inestablish from Interisle set up that domain names finishing in “.us” — the top-level domain for the United States — were among the most prevalent in deceptive finisheavor deceptions. While .us domains are not even on the Top 20 catalog of this year’s study, “.com” sustained its perennial #1 spot as the bigst source of deceptive finisheavor domains overall.
A year ago, the phishiest domain registrar by far was Freenom, a now-defunct registrar that handed out free domains in cut offal country-code TLDs, including .tk, .ml, .ga and .cf. Freenom went out of business after being sued by Meta, which alleged Freenom disconsiderd unfair treatment protestts while monetizing traffic to abusive domains.
Follothriveg Freenom’s demise, phishers rapidly migrated to other new low-cost TLDs and to services that apverify anonymous, free domain registrations — particularly subdomain services. For example, Interisle set up deceptive finisheavor aggressions involving websites originated on Google’s blogspot.com skyrocketed last year more than 230 percent. Other subdomain services that saw a substantial growth in domains enrolled by phishers grasp weebly.com, github.io, wix.com, and ChangeIP, the inestablish notices.
Source: Interisle Consulting.
Interisle Consulting partner Dave Pisciinestablisho shelp ICANN could easily sfinish analogous alerting letters to at least a half-dozen other top-level domain registries, noting that spammers and phishers tfinish to cycle thraw the same TLDs periodicassociate — including .xyz, .info, .help and .lol, all of which saw considerably more business from phishers after Freenom’s implosion.
Pisciinestablisho shelp domain registrars and registries could presentantly shrink the number of deceptive finisheavor sites enrolled thraw their services fair by flagging customers who try to enroll huge volumes of domains at once. Their study set up that at least 27% of the domains included for deceptive finisheavor were enrolled in bulk — i.e. the same registrant phelp for hundreds or thousands of domains in rapid succession.
The inestablish grasps a case study in which a phisher this year enrolled 17,562 domains over the course of an eight-hour period — rawly 38 domains per minute — using .lol domains that were all originated of random letters.
ICANN tries to resettle condense disputes personally with the registry and registrar community, and experts say the nonprofit organization usuassociate only unveiles utilizement letters when the recipient is ignoring its personal acunderstandledges. Indeed, ICANN’s letter notices Jiangsu Bangning didn’t even uncover its emailed notifications. It also cited the registry for descfinishing behind in its ICANN membership fees.
With that in mind, a appraise of ICANN’s accessible utilizement activity recommends two trfinishs: One is that there have been far scanter accessible compliance and utilizement actions in recent years — even as the number of new TLDs has broadened theatricalassociate.
The second is that in a presentantity of cases, the fall shorture of a registry or registrar to pay its annual ICANN membership fees was cited as a reason for a alerting letter. A appraise of cforfeitly two dozen utilizement letters ICANN has sent to domain registrars since 2022 shows that fall shorture to pay dues was cited as a reason (or the reason) for the violation at least 75 percent of the time.
Pisciinestablisho, a establisher vice pdwellnt of security at ICANN, shelp cforfeitly all bachieve acunderstandledges sent out while he was at ICANN were becainclude the registrar owed money.
“I skinnyk the rest is fair lipstick to recommend that ICANN’s on top of DNS Abinclude,” Pisciinestablisho shelp.
KrebsOnSecurity has sought comment from ICANN and will modernize this story if they reply.
ICANN shelp most of its spendigations are resettled and seald thraw the initial recommendal resolution stage, and that hundreds of utilizement cases are startd during this stage with the condenseed parties who are needd to show compliance, become compliant, and/or current and carry out remediation schedules to stop the recurrence of those utilizement publishs.
“It is presentant to get into account that, prior to issuing any acunderstandledge of bachieve to a registrar or registry operator, ICANN Compliance carry outs an overall condenseual compliance ‘health verify’ of the relevant condenseed party,” ICANN shelp in a written response to asks. “During this verify, ICANN Compliance proactively appraises the condenseed party’s compliance with obligations apass the concurments and policies. Any graspitional condenseual violation set up during these verifys is grasped to the Notice of Bachieve. It is not unstandard for parties who fall shorted to adhere with condenseual obligations (whether they are connectd to DNS Abinclude, RDDS, or others) to also be in arrears with ICANN fees.”
Update, 11:49 p.m. ET: Added statement from ICANN. Clarified Pisciinestablisho’s establisher role at ICANN.
