Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Riskiest Web Domains To Visit

CmdrTaco posted more than 3 years ago | from the shocking-that-the-biggest-is-the-worst dept.

Security 106

wiredmikey writes "According to a report released today, .COM is the riskiest top-level domain, the riskiest country domain is Vietnam (.VN). Japan's .JP ranks as the safest country domain for the second year in a row and TRAVEL as the safest overall domain. It's interesting to note that .JP (currently $89.99 at GoDaddy) and .TRAVEL ($89.99 at Moniker) domains are also some of the most expensive domains. Are cybercriminals getting cheap with other people's credit cards? Or do the higher price make it more risky?"

Sorry! There are no comments related to the filter you selected.

The higher prices... (3, Insightful)

The MAZZTer (911996) | more than 3 years ago | (#34025452)

...obviously means scammers, hackers, etc can't buy as many of them, so they're going to go for the cheapies.

Re:The higher prices... (0)

Anonymous Coward | more than 3 years ago | (#34025588)

Or possibly it means that the higher cost can allow them to spend more on verification to ensure the registration is legit.

Re:The higher prices... (1)

countertrolling (1585477) | more than 3 years ago | (#34025654)

They're supposed to ensure the registration is legit by default. This is just a way of extracting higher prices for doing their job.

Re:The higher prices... (2, Insightful)

Amouth (879122) | more than 3 years ago | (#34027092)

sorry but go-daddy's 99cent registration is ensured to not be verified.. and anyone who believes they are or could do it has issues.

yes they should be doing it by default - and they did when the net started - i remember paying 35$ a year and was voice verified and a letter. now days they don't give a shit because if they don't verify then there is nothing anyone can do.

Re:The higher prices... (1)

nog_lorp (896553) | more than 3 years ago | (#34027936)

Yep. GoDaddy disregards the law in most of their ways of doing business, so to think they would verify registrant info is a joke!

Re:The higher prices... (0)

Anonymous Coward | more than 3 years ago | (#34028096)

Yep. GoDaddy disregards the law in most of their ways of doing business, so to think they would verify registrant info is a joke!

[Citation need]

Re:The higher prices... (1)

mabhatter654 (561290) | more than 3 years ago | (#34033452)

Domain Tasting

Cheap domains let them drop a few thousand dollars on a one-time credit card and keep recycling them. That's where they get things like "vniht698.com" and just keep recycling them without paying. Supposedly ICANN finally made the 20 cent fee non-refundable so that in lots of 1000+ it starts costing non-trivial money.

I'll just avoid all .com domains! (3, Insightful)

jez9999 (618189) | more than 3 years ago | (#34025466)

This is quite possibly the most pointless report ever compiled.

Re:I'll just avoid all .com domains! (2, Funny)

WrongSizeGlass (838941) | more than 3 years ago | (#34025662)

This is quite possibly the most pointless report ever compiled.

Not according to travel.jp ;-)

Re:I'll just avoid all .com domains! (1)

sempir (1916194) | more than 3 years ago | (#34025800)

Vietnam is riskier than NIGERIA!!!!!!Hah.

Re:I'll just avoid all .com domains! (0, Troll)

Ipeunipig (934414) | more than 3 years ago | (#34025998)

Easy! Ya just don't lead them as much.

Re:I'll just avoid all .com domains! (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#34025806)

I use Ubuntu and enjoy gay sex.

Re:I'll just avoid all .com domains! (0)

Anonymous Coward | more than 3 years ago | (#34026148)

That should have been modded "redundant".

Re:I'll just avoid all .com domains! (0)

Anonymous Coward | more than 3 years ago | (#34026350)

Nah, should have been modded "obvious".

Re:I'll just avoid all .com domains! (-1, Troll)

Anonymous Coward | more than 3 years ago | (#34027038)

Nope. That would be, for idevices.

Re:I'll just avoid all .com domains! (1)

commodore64_love (1445365) | more than 3 years ago | (#34026460)

*.jp is safer because that country uses almost nothing but DSL.
That's my story and sticking with it. ;-)

Re:I'll just avoid all .com domains! (4, Funny)

RDW (41497) | more than 3 years ago | (#34026846)

'This is quite possibly the most pointless report ever compiled.'

It doesn't even warn about the most dangerous TLD of all, ".pl", which is really just a trick to get the victim to execute a Perl script! URLs with this suffix usually map to a site with unintelligible placeholder text (looks like rot13 or something, e.g.: http://www.linux.pl/ [linux.pl] ) but by the time you see this the script has already been run and the damage done!

How does Perl usually look? (1)

tamtaradei (569241) | more than 3 years ago | (#34029464)

Please, do tell, how do you determine if Perl has been encrypted with rot13?

It still works, and usually it even does the same thing, only with better syntax. I'm pretty sure that rot-13 encryption is a stage of Perl debugging.

As for dangerous domains - you forgot ".sh". Sites from this domain could do rm -rf before you click "back".

We need a new domain like .xxx (5, Funny)

Anonymous Coward | more than 3 years ago | (#34025486)

We could call it .MALWARE or .INFECTED or .BADSTUFFINSTALLEDONYOURCOMPUTER. All the bad stuff would be relegated to this new domain.

Please note that my idea is no less insightful than the referenced article which is very insightful.

Re:We need a new domain like .xxx (2, Funny)

PitaBred (632671) | more than 3 years ago | (#34025668)

All we have to do is check for the Evil Bit! [wikipedia.org] Brilliant!

Re:We need a new domain like .xxx (1)

WrongSizeGlass (838941) | more than 3 years ago | (#34025836)

That's just what happened to Evil Krusty [wikipedia.org] .

Re:We need a new domain like .xxx (1)

rock_climbing_guy (630276) | more than 3 years ago | (#34026548)

Dear Mr. Smith

Your Paypal account details are out of date. You need to update your profile within 30 days to avoid having your account closed. Please complete this process as soon as possible by clicking the link below. Thank you for your time

Paypal Updates [www.paypal.infected]

Sincerely

The Paypal Team

Re:We need a new domain like .xxx (1)

Wowsers (1151731) | more than 3 years ago | (#34026890)

A new TLD, sure, you could call it .CON !!!

Re:We need a new domain like .xxx (1)

Nethead (1563) | more than 3 years ago | (#34027256)

How about .face for Facebook and .twit for Twitter. Talk about nasty domains.

Re:We need a new domain like .xxx (1)

sorak (246725) | more than 3 years ago | (#34028212)

Yes, but microsoft.BADSTUFFINSTALLEDONYOURCOMPUTER is too long a domain name.

Re:We need a new domain like .xxx (0)

Anonymous Coward | more than 3 years ago | (#34029278)

We could call it .MALWARE or .INFECTED or .BADSTUFFINSTALLEDONYOURCOMPUTER. All the bad stuff would be relegated to this new domain.

Please note that my idea is no less insightful than the referenced article which is very insightful.

Or .WINDOWS

Nice editing, again (0)

Anonymous Coward | more than 3 years ago | (#34025516)

"Or do the higher price make it more risky?"

No the higher price don' make risky, but the risky do the higher price... Are there any editors around here?

Re:Nice editing, again (1, Funny)

gstoddart (321705) | more than 3 years ago | (#34025864)

No the higher price don' make risky, but the risky do the higher price... Are there any editors around here?

Apparently, no.

Re:Nice editing, again (1)

shift3 (911297) | more than 3 years ago | (#34026354)

I purchased a domain name for our WoW guild from Bluehost. They only wanted $56 per year, and gave WAY more then i could ever need for a forums.... Due to suspected botting (i guess they thought we were a scammer?) they had me call to verify my identity. They did not ask for SSN or anything else that really ID me as me. I guess talking to a real person was more then enough for them. On the flip side, I used web.com for my personal space a long time ago... They charge me $19.99 a month (239.88/year) for less bandwidth, less space, less SQL DBs, and 1 FTP account. Where am i going with this you may ask? I have no idea.... both domains were TLD .COM. Just a vast difference in pricing, and the cheaper one seemed to do more to ensure i was real, then the more expensive one.

Re:Nice editing, again (2)

koreaman (835838) | more than 3 years ago | (#34026638)

There is a difference between registering a domain name and paying for hosting. If you paid $56 to register a .com domain, you got ripped off. If you paid $56 for a year of hosting, you got a great deal...

Re:Nice editing, again (1)

elFisico (877213) | more than 3 years ago | (#34035212)

ugh, and what if I only paid about 16$ for a year of simple hosting? :-)

.cx is riskiest (5, Funny)

Norsefire (1494323) | more than 3 years ago | (#34025528)

Computers can be repaired, what has been seen cannot be unseen.

Re:.cx is riskiest (-1, Redundant)

Anonymous Coward | more than 3 years ago | (#34025714)

Damn you!

I was going to post the same exact thing.

Re:.cx is riskiest (5, Funny)

tygerstripes (832644) | more than 3 years ago | (#34025722)

It's true, Christmas Island is gaping hole of malware.

Measurements? (3, Interesting)

Reilaos (1544173) | more than 3 years ago | (#34025530)

How do you measure risk?

If a domain is 100% infected with software that cleans up your inbox for you more "risky" than one 50% infected with software that goes and registers you as a sex offender, steals your credit card numbers and posts your porn habits on the web?

Re:Measurements? (1)

sorak (246725) | more than 3 years ago | (#34028246)

one 50% infected with software that goes and registers you as a sex offender, steals your credit card numbers and posts your porn habits on the web?

Facebook?

Re:Measurements? (1)

martas (1439879) | more than 3 years ago | (#34029044)

chances are the relative distribution of types of malware will be the same across domains, so i don't think that's an issue... still worth looking into, tho

This Survey Will Soon Have No Meaning (2, Informative)

damn_registrars (1103043) | more than 3 years ago | (#34025558)

Since ICANN has already committed to start selling gTLDs to anyone with enough money.

Even scamming is a business (3, Informative)

sohmc (595388) | more than 3 years ago | (#34025562)

The best way to increase profit is by reducing cost.

Buying a domain for $90 dollars is far more expensive than a domain for $5-10 bucks.

Also, people are used to seeing ".com" addresses. .TRAVEL, et al are still relatively new.

Re:Even scamming is a business (3, Insightful)

NYMeatball (1635689) | more than 3 years ago | (#34026414)

The best way to increase profit is by reducing cost.

I know this is verging on off topic, but I have to disagree with this completely. This reminds me of the corporate tactics of today. Surely if we aren't spending money, we'll make tons of money!

The only way this strategy ever works is when you are guaranteed to have maxed out on every single opportunity for growth, be it "vertical", "organic", "synergized" or otherwise. Cutting cost isn't always the best way to increase profit, its simply the easiest because it doesn't require any thought other than "get rid of that".

Sorry. Off topic but I see this so often at my company that every time I see it elsewhere I rage.

Not just malware (1)

gmuslera (3436) | more than 3 years ago | (#34025570)

Your privacy will be at big risk connecting with domains that end in facebook.com

Re:Not just malware (1)

internewt (640704) | more than 3 years ago | (#34026534)

That's pretty much what I was going to say. From my point of view, any site that tries to compromise my privacy is a security risk, and most of the big data-rapists are on .coms, Google analytics, Facebook, Webtrends, etc.. These advertisers and tracking domains are dotted about very liberally on the web, and there are few pages I load these days that don't have something blocked in Adblock, or an untrusted domain in NoScript.

Shit, just had a look in Adblock for this page, and there is another domain that I am going to blacklist, demandbase.com. They are serving up 1x1 pixel graphics, so are providing me with nothing at all. And I don't give a flying fuck about if slashdot find them useful or not.

Web bugs usually rely on the http referrer though, and I have been routinely forging those for a good few years now. Snopes is about the most famous site that actually needs the correct referrer, though the extension I use in FF, RefControl, allows different rules to be created for different sites. Discogs.com recently set up a referral checking mechanism too. I guess to stop 3rd party applications from being able to pull album artwork from their site, or something.

Re:Not just malware (1)

Jesus_666 (702802) | more than 3 years ago | (#34032856)

I recommend Ghostery [mozilla.org] . Detects and optionally blocks tracking sites and receives updates every once in a while to keep up with new ones. I just had a look and sure enough they already know about Demandbase.

The info page [ghostery.com] reveals that Demandbase offers to track "all Web site visitors in your target market, including those who do not submit their contact information" and allow you to "integrate them with your direct marketing programs - from email campaigns to telesales". So yeah, they advertise knowing uncomfortably much (from the trackee's perspective) about your visitors.

Anonymous Coward (0)

Anonymous Coward | more than 3 years ago | (#34025590)

No reference to gnaa?

Don't give ICANN/domain registrars any ideas! (1)

mtinsley (1283400) | more than 3 years ago | (#34025604)

Or they'll create a .safe TLD and charge some ridiculous registration fee.

Re:Don't give ICANN/domain registrars any ideas! (1)

leuk_he (194174) | more than 3 years ago | (#34025924)

Like verisign does for https certificates?

besides that, not the domain name, but your surfing habits and security measures mean a lot more than if it is a .com or even https. You are not safe on a safe reputable site. They can be hacked or host 3th party content (ADs?!)

Re:Don't give ICANN/domain registrars any ideas! (3, Funny)

wastedlife (1319259) | more than 3 years ago | (#34026176)

They can be hacked or host 3th party content (ADs?!)

OH NOES!!! Not the dreaded thirth party content!

Sorry, I couldn't help it. I'll probably fulfill Muphrey's law in some way with this post anyway.

Re:Don't give ICANN/domain registrars any ideas! (0)

Anonymous Coward | more than 3 years ago | (#34029826)

Muphrey's

Yup. :)

Re:Don't give ICANN/domain registrars any ideas! (0)

Anonymous Coward | more than 3 years ago | (#34033650)

Sorry, I couldn't help it. I'll probably fulfill Muphrey's law in some way with this post anyway.

Muphrey's law

Admit it, that was intentional. [wikipedia.org]

Re:Don't give ICANN/domain registrars any ideas! (3, Informative)

CastrTroy (595695) | more than 3 years ago | (#34026222)

HTTPS certs don't verify that the site is safe. They only verify that you're transmitting information to the specified site, and that only the specified site can read it. There's no guarantee that the site you're communicating with won't contain malware. Actually, the fact that they have a cert may make it easier for them to install malware since they can send you signed active X controls, and other great things.

Re:Don't give ICANN/domain registrars any ideas! (0)

Anonymous Coward | more than 3 years ago | (#34025974)

You know what, if they put in place proper checks that might not even be a bad thing. The issue is the lax way they dole these things out to all and sundry.

not unit price, but total (3, Insightful)

tverbeek (457094) | more than 3 years ago | (#34025616)

It isn't the $89.99, but the $89.99 times 1000 junk domains.

Plus different TLD operators have different policies: some actually police who can register, requiring that the perp put some effort into pretending to be eligible to use them. .COM obviously does not.

There's also the factor that nobody has ever heard of .TRAVEL (so it looks bogus), but .COM is familiar and friendly-looking.

Re:not unit price, but total (1)

rakuen (1230808) | more than 3 years ago | (#34026678)

I think your last sentence is the real kicker. We could come up with a TLD that costs less than a .com, but if it doesn't have the recognition factor, it's not going to matter. People will use what they're familiar with and tend to avoid the unknown.

Law of small numbers (1)

Khopesh (112447) | more than 3 years ago | (#34027390)

Another major contributor to this crap is their bad statistics. This is a law of small numbers, similar to when a baseball player is batting .500 early in the season (a .400 season's average is godly). There isn't enough data to make that a meaningful number. TLDs like .VN are very small quantities, so they are easily overrun by a few spammers buying their typical bulk quantities of spamvertising domains.

Reports like this can accidentally suggest dangerous blanket blacklisting. I think it's far better to use the more sophisticated systems of IP reputation (URIBLs in this case). That said, organizations that bring legal pressure to improperly relaxed registrars need this kind of data to move forward. Knujon [knujon.org] ("no junk" backwards) is doing this, though their efforts are mostly restricted to the USA.

Even more safe (5, Interesting)

Anonymous Coward | more than 3 years ago | (#34025702)

My country domain (Bulgaria - bg) costs 130$ and only one company can sell is - register.bg. For many years we all have complained about this monopoly, there was many petitions and stuff (we won in some way - now there`re two resellers working for register.bg) but this way has some advantages for example:

1. No one could register government like domains - president.bg and so on
2. If you want to register company name. google.bg for example, you have to provide official registration papers for the company
3. There isn`t even one single spam or other related issue with .bg domain, if someone try to use it for illegal purpuses register.bg will wipe the domain and file official complain to the police.
4. Individuals cannot register .bg, they get to choose from yourname.[a-z].bg and you cannot register viagra.a.bg it got to be your real name(you can if your name is Viagra :D )

It is in some way very restrictive and the bureaucracy is a big pain, but the country domain name is important and if someone is misusing it everyone blame the country.

Any safer and it'd be the death penalty (3, Insightful)

professorguy (1108737) | more than 3 years ago | (#34026820)

3. There isn`t even one single spam or other related issue with .bg domain, if someone try to use it for illegal purpuses register.bg will wipe the domain and file official complain to the police.

So, your website gets hacked and a page is uploaded which delivers malware to visitors. It wasn't your fault, you've kept it patched and backup the logs, but the hackers had a 0-day in their toolkit.

So now YOU lose your domain and go to jail? Nice system you got there.

Re:Any safer and it'd be the death penalty (1)

Lehk228 (705449) | more than 3 years ago | (#34027846)

certainly cuts down on the "but it wasn't my fault" crowd.

host your website off a windows machine with your webserver running as admin and it IS your fault that you got hacked.

if computer owners were held liable for negligence when their machine participates in DDOS then maybe people would take computer and information security seriously

Re:Even more safe (1)

Ozymandias_KoK (48811) | more than 3 years ago | (#34027928)

So I guess the band Via Gra should be fine, then...

Handy malware domains lists (5, Informative)

Ponyegg (866243) | more than 3 years ago | (#34025752)

I work in online advertising, specifically I look after a major UK publisher's adservers/ad-delivery. We use the following to keep an eye on identified malware delivering domains:

http://www.malwaredomainlist.com/mdl.php [malwaredomainlist.com]
http://www.malwaredomains.com/ [malwaredomains.com]
http://www.malwareurl.com/ [malwareurl.com]
http://www.anti-malvertising.com/ [anti-malvertising.com]

What we need is a totally free internet (1)

digitaldc (879047) | more than 3 years ago | (#34025908)

We have free software and with hand-me-down free hardware, we can build our OWN free internet.
Enough is enough!

Re:What we need is a totally free internet (1)

commodore64_love (1445365) | more than 3 years ago | (#34026416)

You mean like FidoNet or Usenet? That's not working out so great. Usenet became absorbed into the "evil" internet, and FidoNet is just about dead.

So you're telling me that.. (2, Insightful)

MXPS (1091249) | more than 3 years ago | (#34025982)

TIME.TRAVEL is finally safe to visit? I'm not buying it.

Spammers use throwaway domains (5, Insightful)

mysidia (191772) | more than 3 years ago | (#34026020)

It is more expensive to register domains on a "premium" TLD. Since fewer domains are registered on the TLDs, there will be fewer used by spammers.

Because people black list domains used by spammers; URI-based blacklists, and RHS blacklists that blacklist by domain name. Spam filters start to recognize them, in any case.

So spammers register thousands of domains at the cheapest prices available (probably using stolen cards or multiple shell companies)

.NET and .COM are probably the cheapest TLDs to register throwaway domains on.

It follows, that spam might be reduced, with greater costs or qualifications to register a domain.

I for one would be in favor of a "paper" requirement.

ICANN should require that every domain have a primary 'contact address' verified by the registrar that is listed in public WHOIS.

ICANN should require registrars to verify BY PAPER certified+restricted mail to each new primary contact address, which must be an address in a country the registrar does business in, and may not be a PO Box or forwarded address.

The registrant should be required to SIGN a document mailed, and send it back, before the domain can be placed in the zone. And the signature must match the signature on the mail slip.

The slip signed must include a statement agreeing to the ICANN policies, and certifying that the signer is the principal, and the address provided belongs to the principal who owns the domain, and not a proxy, agent, or designee.

And from then on, that 'contact information' can be used by the owner of THAT account to designate as the org contact for domains registered or transferred. Using a different contact for a domain, requiring going through verification again.

For a minor inconvenience, spammers could be stopped.

Nice try (1)

TiggertheMad (556308) | more than 3 years ago | (#34026644)

For a minor inconvenience, spammers could be stopped.

...until they just rootkit a few servers that is on someone else's domain. Really, your proposal would just stop criminals from registering throw away domains, and switch to buying/leasing botnets of infected computers.

Re:Nice try (3, Insightful)

corbettw (214229) | more than 3 years ago | (#34027502)

Which they aren't doing already?

Just because one approach wouldn't stop all forms of spam, doesn't mean it couldn't significantly impact spam overall by eliminating one or more vectors.

Re:Nice try (1)

Jesus_666 (702802) | more than 3 years ago | (#34032896)

No. A solution that isn't 100% effective with no downsides whatsoever is not a solution. This is plain to see from just about any discussion on any topic ever.

Re:Nice try (1)

mysidia (191772) | more than 3 years ago | (#34029992)

...until they just rootkit a few servers that is on someone else's domain.

They already do, but there are a finite relatively small number of servers that they can easily rootkit, and once those are blacklisted, they're blacklisted.

It might not be perfect, but it makes things much harder, for spammers: using totally fake information and stolen CCs to register domains becomes especially hard, since they now need a fraudulent physical address they can take mail at, risks of getting caught are higher, and hosting providers can look at the contact info in WHOIS and do a better job at refusing to open accounts for contacts that have been associated with known spam domains.

The numbers of windows workstations are much larger, and the main participants in botnets which are used to host spam sites. If it were just compromised servers hosting phishing and spam sites, the spam problem would be much smaller than it is today.

There are an infinite number of throwaway domains they can register, limited only by the number of times the spammer can shell out $10; if their average spamming run nets them $100, before that domain gets blacklisted and they move on to another one, it's financially worth it to the spammer to just keep registering new domains domains.

Re:Spammers use throwaway domains (0)

Anonymous Coward | more than 3 years ago | (#34026680)

i see you really are a fan of privacy...

so then in your system you provide a public list of people owning the domains that the spammers/nigerian princes could go out and murder and then impersonate.

people have killed for less when money is involved...

Re:Spammers use throwaway domains (1)

SleazyRidr (1563649) | more than 3 years ago | (#34028088)

Someone needs to post that checklist of why that won't work.

Re:Spammers use throwaway domains (1)

mhollis (727905) | more than 3 years ago | (#34030118)

That is just not practical. I develop and host websites. If I need to change registrars because someone wasn't happy with their web designer and they came to me. As it is today, it can take up to 10 days to complete a registrar change.

I am using Melbourne IT as my registrar because my hosting provider works well with them. Certified mail to and from another country would take upwards of two weeks -- and all that time my client is waiting.

I completely understand the eagerness to deny spammers and malware fiends domains. But this is not the right solution for those of us who are legitimate.

Re:Spammers use throwaway domains (1)

mysidia (191772) | more than 3 years ago | (#34032326)

That is just not practical. I develop and host websites. If I need to change registrars because someone wasn't happy with their web designer and they came to me.

The registrar is responsible for registering the domain and has nothing whatsoever to do with design or hosting.

Minor inconvenience? More like PITA. (1)

tivoKlr (659818) | more than 3 years ago | (#34030934)

Seriously, you make buying a domain name sound WORSE than going to the DMV. First off, what's the point of having employees if the principal can't delegate responsibilities such as picking up certified mail and signing for it, acting as agent and signing a contract (which is what you're speaking of with the "matching signatures" point), and lastly, many businesses use a PO Box for whatever reason, and where I live, there is NO local delivery (I guess 2 blocks is too far for the USPS to manage to haul my mail from the PO to my house) so I am forced, if I want to use the US Mail, to have a PO Box as my address. Trust me, if I could pay to have my mail delivered, I would consider it, but FFS, we don't all live in the city. Not that I don't agree with you in principle, the system is FAR too lax, but the pendulum swingeth too far...

Re:Minor inconvenience? More like PITA. (1)

mysidia (191772) | more than 3 years ago | (#34032222)

Seriously, you make buying a domain name sound WORSE than going to the DMV. First off, what's the point of having employees if the principal can't delegate responsibilities such as picking up certified mail and signing for it,

The registry could offer some flexibility in regards to the PO Box rule by offering another option: have a statement signed by two different witnesses and notarized.

The registrar would be required to verify the notarization, and provide a publicly viewable scan of the document, with a URL placed in the WHOIS record.

A notarized statement, with a copy of the letters of incorporation could also be used. Some combination of these 'enhanced verification' methods could be used to lift or reduce other restrictions in domain registration.

What i'm saying is not that the holder of the domain can't have employees, but they can't have it both ways. You can't list one person as owner, and have another person register the domain.

The employee can be listed as the primary contact, and therefore the 'principal' that owns the domain name. That employee would list their address, receive the restricted mail, sign for it, and sign the form.

The primary contact and legal owner of the domain is that employee or officer as far as the registry is concerned.

This says nothing about what the employee can do with the domain -- if the registrant is a corporation or other organization, it's up to them to impose any legal requirements on the employee that are required to ensure the employee does not steal the domain or fail in their fiduciary duty to transfer the domain to an officer later designated to be the primary contact of record.

Risk of WHAT? (2, Insightful)

Sloppy (14984) | more than 3 years ago | (#34026078)

Risk of what? Risk of "falling in" and coming out of your trance 3 hours later with 20 new browser tabs open? tvtropes and wikipedia are both .orgs, so I bet .org is the riskiest TLD.

It's pretty funny: even if you RTFA it doesn't really say what the risk is. The fact that they quote McAfee implies that they're talking about a risk of Windows users deciding to download and install malware from websites, but this isn't actually stated.

Re:Risk of WHAT? (1)

jecowa (1152159) | more than 3 years ago | (#34026506)

When I read the headline, I thought it meant risk of homeland security deciding your a terrorist – like what happened to that dude who wrote a stupid blog post and got a warrantless tracking device installed on his car by the authorities.

If they're talking about computer viruses. just don't install the things. It's not that difficult to not install a virus.

Re:Risk of WHAT? (1)

H0p313ss (811249) | more than 3 years ago | (#34026988)

Risk of "falling in" and coming out of your trance 3 hours later with 20 new browser tabs open? tvtropes and wikipedia are both .orgs, so I bet .org is the riskiest TLD.

This is true, I visited tvtropes one Saturday afternoon; when I regained consciousness it was Wednesday, I was naked and there were three dead hookers in the basement.

Re:Risk of WHAT? (1)

rrohbeck (944847) | more than 3 years ago | (#34027350)

Don't forget slashdot.org and the risk of serious productivity loss.

Surely (3, Interesting)

ninjacheeseburger (1330559) | more than 3 years ago | (#34026108)

I would of thought .gov would be the safest domain.

Re:Surely (5, Funny)

John Hasler (414242) | more than 3 years ago | (#34026352)

Are you kidding? Visit irs.gov and a third of your income vanishs.

Re:Surely (1)

internewt (640704) | more than 3 years ago | (#34030494)

Unless you're really rich

Re:Surely (2, Funny)

SheeEttin (899897) | more than 3 years ago | (#34034890)

And ~5% of your vowels, it seems!

Re:Surely (1)

Snowbat (1118171) | more than 3 years ago | (#34027478)

I would of thought .gov would be the safest domain.

Not so much. [google.com]

California local government sites were regular victims (I ran into this [calecia.com] one). I suspect the brief deletion of ca.gov [networkworld.com] was frustration and not so inadvertent.

Re:Surely (0)

Anonymous Coward | more than 3 years ago | (#34028162)

That or .mil?

Re:Surely (1)

houghi (78078) | more than 3 years ago | (#34029552)

What about .int ?

Re:Surely (0)

Anonymous Coward | more than 3 years ago | (#34029592)

The PDF file linked to in TFA says, on page 6:

The five TLDs with the least risky registrations, each with 0.3% or fewer domains rated risky, are: Governmental (.GOV), Japan (.JP), Educational (.EDU), Ireland (.IE), Croatia (.HR)

What's more, if you check the actual rank, you'll find on page 14 of the report, that .GOV *is* ranked as the safest domain period, with a weighted risk ratio of 0.0%; the total number of "risky domains" found was 2, out of 4345 tested.

So there you go! Your gut feeling was correct: .GOV is indeed the safest one, although I'll personally add that .MIL was apparently not tested.

The riskiest? (0)

Anonymous Coward | more than 3 years ago | (#34026172)

Obviously is clownpenis.fart.

Re:The riskiest? (1)

eln (21727) | more than 3 years ago | (#34026564)

Stop slandering my website.

$50 on Credit Cards Is Major (1)

Doc Ruby (173196) | more than 3 years ago | (#34026210)

In credit cards, charges over $50 are in a different category. Typically the cardholder is responsible for $50 and less, so those charges aren't screened by the credit corp as much since the credit corp isn't liable. This is why frauds usually charge under $50, even if just testing for a larger hit or assembling small (under $50) charges into a big charge.

So charging over $50, like TRAVEL and .jp do, would screen out some fraudulent charges on stolen card numbers.

We need onetime passwords instead of sharing plaintext credit card numbers.

Higher Prices = More likely to notice your CC bill (1)

djsmiley (752149) | more than 3 years ago | (#34026250)

Atm I have 1 charge on my CC, its for .... actually I wont say, thats a helpful bit of security info there! But anyway, if it went up by £9.99 - common price for .COM domain over here - I'd likely not notice....

However, if it suddenly rose by £89.99, I'd surely notice.

Or did we forget that malware works by NOT being noticed. These people are experts at staying hidden.

COCK (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#34026344)

Tealeaf statistics, retarded summary (2, Insightful)

Arancaytar (966377) | more than 3 years ago | (#34026880)

With a massive and diverse category like a top-level domain, the only statement you can make is "56% of malicious domains are .com"

Concluding, from this, that ".com is the riskiest domain" is like saying "people with long hair are the least likely to murder you" based on how many murders are committed by people with long hair. Actually, it fails on two counts: Firstly, 56% of malicious domains end in .com because most domains do. A better measure would be the relative percentage of malicious domains for a given TLD.

Even that statistic would only say anything about "risk" if you randomly picked a domain under the .com TLD (with perfectly equal chances for each). People don't use the internet like that; they use it by following links from popular sites to other popular sites. One of those neat little obvious-in-hindsight discoveries; there was a small search engine who made it big by using that.

Re:Tealeaf statistics, retarded summary (0)

Anonymous Coward | more than 3 years ago | (#34027138)

Thank you, I was trying to write a cogent summary in a similar fashion. This is a sad excuse for an article to be on slashdot. Heres a few other fails I saw when looking at this article: First, It does not factor in that the vast majority of the world isn't going to visit certain domains for one reason or another (e.g.; most of the english speaking world will not visit japanese domains in general due to the language barrier) -- meanwhile there are lots of .com urls that everybody goes to from all over the world making it a much more desirable target. Second, it only analyzes 27 million websites. The total number of websites is widely presumed to be well over 200 million by now. At this point, it has likely surpassed 300 million+. The sample size is NOT small, but still fails to account for a lot. Also, with the number of websites that are having malware attacks via adnetworks, it may fail to factor in that at the core of the problem is the ad network which can be used/applied on any domain. (The only news articles relating to this are "Key points" from the report which omits key data that could be used to prove whether or not the report is valid on this point.)

Re:Tealeaf statistics, retarded summary (0)

Anonymous Coward | more than 3 years ago | (#34032528)

A better measure would be the relative percentage of malicious domains for a given TLD.

Which, incidentally, is precisely what the actual McAfee paper did.

I worry about the most dangerous domains... (1)

Obfuscant (592200) | more than 3 years ago | (#34027194)

I do have to admit, I'm human. Whenever I see a .com domain walking down the street, I get a bit worried. Sometimes I cross the street until he goes past. If I see one get on an airplane I'm getting on, my heartbeat goes up a few notches and I call my wife and kids in the few remaining minutes before the door closes to say I love them and I'll try to come home safe.

Now, if you'll excuse me, I have a call coming in from Vivian Schiller, and then I need to get ready for my daily news report for NPR.

TLD = Laughable Metric of "Dangerousness" (1)

Wowlapalooza (1339989) | more than 3 years ago | (#34027584)

In other news, researchers have revealed that most mass-murderers had 2 arms, 2 legs and 2 eyes. So be especially wary of such people.

.COM has more abandoned domains (1)

sandytaru (1158959) | more than 3 years ago | (#34027616)

Since .COM has been around so much longer, and since eighty bazillion Internet squatters snapped up addresses during the dot com bubble, only to abandon them after the bubble burst, there's a lot more unattended .COM real estate overall. Very sophisticated hackers don't even have to pay money - they just need to break into an unattended URL, use the 50 free megs of space that most websites came with through Dot Easy or whatever, and stuff their malware there.

Goatse.com (1)

DTemp (1086779) | more than 3 years ago | (#34028348)

Surprisingly safe!

Dont come to us with bullshit articles (1)

unity100 (970058) | more than 3 years ago | (#34028532)

made on bullshit statistics again. .com is the riskiest, because internet = com for A LOT of people on the face of planet, and whatever is done, is done on com domains, be it legit business or fraud.

this is the second time some bull was served to us on slashdot based on ridiculous statistics in 2 days' time.

Even weirder... (1)

CCarrot (1562079) | more than 3 years ago | (#34029170)

FTFA:

It (sic) August, McAfee released its report on the Top 10 Most Dangerous Celebrities online in which Cameron Diaz took the top spot.

Yeah, keep us posted on those dangerous celebs, McAfee. Not only are they diluting the value of your entertainment dollar, they're also after your lolcat collection! The problem's so monumental, we can't even take the time to proofread our blurbs!

There's your metric on whether this article should be taken seriously or not, /. .

I work for a hosting company and noticed... (1)

FauxReal (653820) | more than 3 years ago | (#34030206)

I work for a hosting company and higher priced domains are simply easier for the people with stolen credit cards to spot on their statements.

If it's minor they tend to shrug it oas soemthing trivial they did, but larger purchases grab their attention.

What really surprises me is how long some people will let a $9.95/mo. charge sit on their acct. before they take action and investigate it... in quite a few cases it's YEARS. I also noticed that a fraudster will tend to use a stolen card to register one or two domains and then not do anything else to someone's card. But then they'll use that domain to phish other people's CC#s and bleed them dry.

Just stuff I've noticed from talking to customers.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?