Slashdot Mirror
Riskiest Web Domains To Visit
wiredmikey writes "According to a report released today, .COM is the riskiest top-level domain, the riskiest country domain is Vietnam (.VN). Japan's .JP ranks as the safest country domain for the second year in a row and TRAVEL as the safest overall domain. It's interesting to note that .JP (currently $89.99 at GoDaddy) and .TRAVEL ($89.99 at Moniker) domains are also some of the most expensive domains. Are cybercriminals getting cheap with other people's credit cards? Or do the higher price make it more risky?"
...obviously means scammers, hackers, etc can't buy as many of them, so they're going to go for the cheapies.
This is quite possibly the most pointless report ever compiled.
== Jez ==
Do you miss Firefox? Try Pale Moon.
We could call it .MALWARE or .INFECTED or .BADSTUFFINSTALLEDONYOURCOMPUTER. All the bad stuff would be relegated to this new domain.
Please note that my idea is no less insightful than the referenced article which is very insightful.
"Or do the higher price make it more risky?"
No the higher price don' make risky, but the risky do the higher price... Are there any editors around here?
Computers can be repaired, what has been seen cannot be unseen.
How do you measure risk?
If a domain is 100% infected with software that cleans up your inbox for you more "risky" than one 50% infected with software that goes and registers you as a sex offender, steals your credit card numbers and posts your porn habits on the web?
Since ICANN has already committed to start selling gTLDs to anyone with enough money.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
The best way to increase profit is by reducing cost.
Buying a domain for $90 dollars is far more expensive than a domain for $5-10 bucks.
Also, people are used to seeing ".com" addresses. .TRAVEL, et al are still relatively new.
We don't live in Shouldland.
Your privacy will be at big risk connecting with domains that end in facebook.com
No reference to gnaa?
Or they'll create a .safe TLD and charge some ridiculous registration fee.
It isn't the $89.99, but the $89.99 times 1000 junk domains.
Plus different TLD operators have different policies: some actually police who can register, requiring that the perp put some effort into pretending to be eligible to use them. .COM obviously does not.
There's also the factor that nobody has ever heard of .TRAVEL (so it looks bogus), but .COM is familiar and friendly-looking.
http://alternatives.rzero.com/
My country domain (Bulgaria - bg) costs 130$ and only one company can sell is - register.bg. For many years we all have complained about this monopoly, there was many petitions and stuff (we won in some way - now there`re two resellers working for register.bg) but this way has some advantages for example:
1. No one could register government like domains - president.bg and so on .bg domain, if someone try to use it for illegal purpuses register.bg will wipe the domain and file official complain to the police. .bg, they get to choose from yourname.[a-z].bg and you cannot register viagra.a.bg it got to be your real name(you can if your name is Viagra :D )
2. If you want to register company name. google.bg for example, you have to provide official registration papers for the company
3. There isn`t even one single spam or other related issue with
4. Individuals cannot register
It is in some way very restrictive and the bureaucracy is a big pain, but the country domain name is important and if someone is misusing it everyone blame the country.
I work in online advertising, specifically I look after a major UK publisher's adservers/ad-delivery. We use the following to keep an eye on identified malware delivering domains:
http://www.malwaredomainlist.com/mdl.php
http://www.malwaredomains.com/
http://www.malwareurl.com/
http://www.anti-malvertising.com/
We have free software and with hand-me-down free hardware, we can build our OWN free internet.
Enough is enough!
He who knows best knows how little he knows. - Thomas Jefferson
TIME.TRAVEL is finally safe to visit? I'm not buying it.
It is more expensive to register domains on a "premium" TLD. Since fewer domains are registered on the TLDs, there will be fewer used by spammers.
Because people black list domains used by spammers; URI-based blacklists, and RHS blacklists that blacklist by domain name. Spam filters start to recognize them, in any case.
So spammers register thousands of domains at the cheapest prices available (probably using stolen cards or multiple shell companies)
It follows, that spam might be reduced, with greater costs or qualifications to register a domain.
I for one would be in favor of a "paper" requirement.
ICANN should require that every domain have a primary 'contact address' verified by the registrar that is listed in public WHOIS.
ICANN should require registrars to verify BY PAPER certified+restricted mail to each new primary contact address, which must be an address in a country the registrar does business in, and may not be a PO Box or forwarded address.
The registrant should be required to SIGN a document mailed, and send it back, before the domain can be placed in the zone. And the signature must match the signature on the mail slip.
The slip signed must include a statement agreeing to the ICANN policies, and certifying that the signer is the principal, and the address provided belongs to the principal who owns the domain, and not a proxy, agent, or designee.
And from then on, that 'contact information' can be used by the owner of THAT account to designate as the org contact for domains registered or transferred. Using a different contact for a domain, requiring going through verification again.
For a minor inconvenience, spammers could be stopped.
Risk of what? Risk of "falling in" and coming out of your trance 3 hours later with 20 new browser tabs open? tvtropes and wikipedia are both .orgs, so I bet .org is the riskiest TLD.
It's pretty funny: even if you RTFA it doesn't really say what the risk is. The fact that they quote McAfee implies that they're talking about a risk of Windows users deciding to download and install malware from websites, but this isn't actually stated.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I would of thought .gov would be the safest domain.
Obviously is clownpenis.fart.
In credit cards, charges over $50 are in a different category. Typically the cardholder is responsible for $50 and less, so those charges aren't screened by the credit corp as much since the credit corp isn't liable. This is why frauds usually charge under $50, even if just testing for a larger hit or assembling small (under $50) charges into a big charge.
So charging over $50, like TRAVEL and .jp do, would screen out some fraudulent charges on stolen card numbers.
We need onetime passwords instead of sharing plaintext credit card numbers.
--
make install -not war
Atm I have 1 charge on my CC, its for .... actually I wont say, thats a helpful bit of security info there! But anyway, if it went up by £9.99 - common price for .COM domain over here - I'd likely not notice....
However, if it suddenly rose by £89.99, I'd surely notice.
Or did we forget that malware works by NOT being noticed. These people are experts at staying hidden.
- http://www.milkme.co.uk
For a minor inconvenience, spammers could be stopped.
...until they just rootkit a few servers that is on someone else's domain. Really, your proposal would just stop criminals from registering throw away domains, and switch to buying/leasing botnets of infected computers.
HA! I just wasted some of your bandwidth with a frivolous sig!
3. There isn`t even one single spam or other related issue with .bg domain, if someone try to use it for illegal purpuses register.bg will wipe the domain and file official complain to the police.
So, your website gets hacked and a page is uploaded which delivers malware to visitors. It wasn't your fault, you've kept it patched and backup the logs, but the hackers had a 0-day in their toolkit.
So now YOU lose your domain and go to jail? Nice system you got there.
With a massive and diverse category like a top-level domain, the only statement you can make is "56% of malicious domains are .com"
Concluding, from this, that ".com is the riskiest domain" is like saying "people with long hair are the least likely to murder you" based on how many murders are committed by people with long hair. Actually, it fails on two counts: Firstly, 56% of malicious domains end in .com because most domains do. A better measure would be the relative percentage of malicious domains for a given TLD.
Even that statistic would only say anything about "risk" if you randomly picked a domain under the .com TLD (with perfectly equal chances for each). People don't use the internet like that; they use it by following links from popular sites to other popular sites. One of those neat little obvious-in-hindsight discoveries; there was a small search engine who made it big by using that.
Now, if you'll excuse me, I have a call coming in from Vivian Schiller, and then I need to get ready for my daily news report for NPR.
Another major contributor to this crap is their bad statistics. This is a law of small numbers, similar to when a baseball player is batting .500 early in the season (a .400 season's average is godly). There isn't enough data to make that a meaningful number. TLDs like .VN are very small quantities, so they are easily overrun by a few spammers buying their typical bulk quantities of spamvertising domains.
Reports like this can accidentally suggest dangerous blanket blacklisting. I think it's far better to use the more sophisticated systems of IP reputation (URIBLs in this case). That said, organizations that bring legal pressure to improperly relaxed registrars need this kind of data to move forward. Knujon ("no junk" backwards) is doing this, though their efforts are mostly restricted to the USA.
Use my userscript to add story images to Slashdot. There's no going back.
In other news, researchers have revealed that most mass-murderers had 2 arms, 2 legs and 2 eyes. So be especially wary of such people.
Since .COM has been around so much longer, and since eighty bazillion Internet squatters snapped up addresses during the dot com bubble, only to abandon them after the bubble burst, there's a lot more unattended .COM real estate overall. Very sophisticated hackers don't even have to pay money - they just need to break into an unattended URL, use the 50 free megs of space that most websites came with through Dot Easy or whatever, and stuff their malware there.
Occasionally living proof of the Ballmer peak.
Surprisingly safe!
made on bullshit statistics again. .com is the riskiest, because internet = com for A LOT of people on the face of planet, and whatever is done, is done on com domains, be it legit business or fraud.
this is the second time some bull was served to us on slashdot based on ridiculous statistics in 2 days' time.
Read radical news here
FTFA:
It (sic) August, McAfee released its report on the Top 10 Most Dangerous Celebrities online in which Cameron Diaz took the top spot.
Yeah, keep us posted on those dangerous celebs, McAfee. Not only are they diluting the value of your entertainment dollar, they're also after your lolcat collection! The problem's so monumental, we can't even take the time to proofread our blurbs!
There's your metric on whether this article should be taken seriously or not, /. .
"I love animals! Some are cute, others are tasty, what's not to like?" - Betsy Schroeder, Jeopardy contestant
Please, do tell, how do you determine if Perl has been encrypted with rot13?
It still works, and usually it even does the same thing, only with better syntax. I'm pretty sure that rot-13 encryption is a stage of Perl debugging.
As for dangerous domains - you forgot ".sh". Sites from this domain could do rm -rf before you click "back".
I work for a hosting company and higher priced domains are simply easier for the people with stolen credit cards to spot on their statements.
If it's minor they tend to shrug it oas soemthing trivial they did, but larger purchases grab their attention.
What really surprises me is how long some people will let a $9.95/mo. charge sit on their acct. before they take action and investigate it... in quite a few cases it's YEARS. I also noticed that a fraudster will tend to use a stolen card to register one or two domains and then not do anything else to someone's card. But then they'll use that domain to phish other people's CC#s and bleed them dry.
Just stuff I've noticed from talking to customers.
Deltron 3030 - Virus (music video)
Seriously, you make buying a domain name sound WORSE than going to the DMV. First off, what's the point of having employees if the principal can't delegate responsibilities such as picking up certified mail and signing for it, acting as agent and signing a contract (which is what you're speaking of with the "matching signatures" point), and lastly, many businesses use a PO Box for whatever reason, and where I live, there is NO local delivery (I guess 2 blocks is too far for the USPS to manage to haul my mail from the PO to my house) so I am forced, if I want to use the US Mail, to have a PO Box as my address. Trust me, if I could pay to have my mail delivered, I would consider it, but FFS, we don't all live in the city. Not that I don't agree with you in principle, the system is FAR too lax, but the pendulum swingeth too far...
Ocean is land, covered with water.
As the subject line suggests I think they are banking on ignorance. Of all the millions upon millions of internet users how many of them actually know what a domain is? Beyond that how many of them actually think about what they are doing on the internet? They get an intereting looking email and the click the link and poof they are infected. for all the ease and conveinence that GUI's have been there is a con to the pros. GUI's hav enabled the unthinking to access almost any part of the world an open them selves to a plethora of scams.
Hence it is safe to use Japanese DNS
http://aruljohn.com/track.pl?host=210.134.143.7
I'd like to buy homeland for our 10 million people. http://twitter.com/mahadiga