[ Home | Weather | Wiki | HN | News | xkcd ] [ Search | Settings | About ] [ Light | Dark ]
Phishing domains tanked after Meta sued Freenom
[ Top | New | Ask | Show | Same poster | Same domain | Source site ]
Posted on Friday, May 26th 2023 by todsacerdotihttps://krebsonsecurity.com/2023/05/phishing-domains-tanked-...
[ Threaded | Oldest | Newest ]
@ Friday, May 26th 2023 by talhahWhile freenom did genuinely have issues with spam and the like.
I must say it played a pivotal role in my life, it allowed me to do my passion and have a domain name in my early teens when I couldn't pay for anything. Being able to toy with a domain name led me down many rabbit holes and led to me trying out self-hosting and system administration.
Sad we can't have free things.
@ Friday, May 26th 2023 by 5e92cb50239222b | ParentI am still using a couple of .cf and .tk domains for semi-serious mail, haven't had any issues with delivery.
@ Friday, May 26th 2023 by throwawayadvsec | Parentthat's actually really weird
@ Friday, May 26th 2023 by jeroenhd | ParentThese domains apply a serious bonus to spam scores, but if you do everything else right (send a normal but not too large amount of email, get your mail server from a domain with high reliability, set up SPF/DKIM/DMARC/etc.) you shouldn't fall below the spam line in most spam filters.
@ Monday, May 29th 2023 by breakingcups | ParentGiven .tk's known practice of seizing domains for their own use, it might be wise to migrate to a more stable TLD.
@ Friday, May 26th 2023 by seszett | ParentI have mixed feelings as well, for the same reason, but I find it absolutely terrible that the citizens of Mali, RCA, Gabon, and Equatorial Guinea have basically been robbed of their TLD by their (mostly failed) governments.
@ Saturday, May 27th 2023 by esperent | Parent.io is similarly problematic. Although at this point I think the best solution would be to retroactively set .io to mean Input/Output and give the Chagossians a new TLD.
EDIT: it could also be argued that this controversy is beneficial for the Chagossians I guess. I didn't know anything about them until I purchased a .io domain a few years ago.
@ Saturday, May 27th 2023 by TheCleric | ParentDo you not see the obvious irony in taking a people who were forcibly removed from their home so it could be given to others, issuing them a TLD, and now you're suggesting forcibly removing that from them and giving it to others?
@ Saturday, May 27th 2023 by pxc | ParentThat is really painful.
But if those TLDs don't even bring them any money and they're not named after something in the Chagossian's own language, do they even own them in any meaningful sense?
Aside from the right to return to their homelands, these people should be given some actual royalties from .io domain purchases. And then maybe also a new TLD that is more meaningfully connected to them and less likely to be hijacked.
@ Saturday, May 27th 2023 by dchftcs | ParentIt's something they didn't really ask for, never meaningfully utilized anyway, and ultimately is an entry in a table on some servers they can't really care less about.
You can fantasize about the hardships the citizens suffered for the appropriation of the .io TLD and draw any analogy you want, but there are probably more pressing needs of the people you're not addressing by spending time to supply this sort of sympathy.
Worse, imagine a world where you actually advocate for the displaced indigenous people to care about this problem. Probably you'd be asking them to divert attention from real problems such as being able to afford food tomorrow.
@ Saturday, May 27th 2023 by TheCleric | ParentNo, the real problems are obviously more important. I'm just pointing out the minor insult that echoes the major injury that would be this plan.
@ Saturday, May 27th 2023 by esperent | ParentWhen I wrote that I wasn't imagining any forcing going on. Rather I was thinking about dialogue happening with the ethnic group in question to try and find a TLD that makes sense in their own language rather than English.
@ Saturday, May 27th 2023 by seanhunter | ParentI don't buy this at all. Country-specific tlds are more or less a total failure. To the extent they still have a role, it is in having official government sites (eg "gov.uk" in the uk)
Firstly the US never bought into it so all the original successful internet companies are ".coms". For this reason if you are a global company, chances are you would prefer a ".com" to anything else. Most companies want to address a global audience and part of the point of e-commerce is to make this happen. So they don't necessarily want a parochial-seeming national tld but would prefer a global one. This makes country-specific tlds redundant for commerce.
Secondly the people running the national TLDs are (in my experience) often doing so to further their own egos and personal interests and so tend to offer a shitty service. This is why I gave up my ".co.uk" domain some years back. The UK NIC were just annoying in a bunch of different ways.
@ Saturday, May 27th 2023 by Fgehono | Parent'more or less'.
In Europe they are working very well and are used constantly.
.de is used by most Germans. .fr french, .at etc.
@ Saturday, May 27th 2023 by talhah | ParentIn Qatar national services use ".qa", and these are not necessarily official government sites.
For example our community schools uses a .qa domain and the biggest telecom provider among various other sites.
What you're saying does not apply to all countries.
@ Saturday, May 27th 2023 by raverbashing | Parent>Firstly the US never bought into it
"Never bought into is" as never bothered and never cared about other countries (main character syndrome)
@ Saturday, May 27th 2023 by changethe | Parentnot sure what world you live in, but ccTLDs are widely used across the world, and in a lot of countries much preferred over .com.
german people, for example, will trust a business running on a .de domain much more than a .com one.
in most cases it is much preferred for an international company to run the country-specific website on the according ccTLD. companies that "want to address a global audience" are a specific set of companies that might prefer a "global" website, but most businesses will run country specific sites, not "global" sites.
also not sure what the UK NIC being "annoying in a bunch of different ways" has to do with anything, or even means.
seems to me like you are living in your own world, far detached from reality.
@ Saturday, May 27th 2023 by seanhunter | ParentI'm happy to be wrong about this and hear about the thriving ccTLD scene but there's no reason to get personal and say I'm detached from reality.
The way in which the UK nic used to be annoying that is relevant for this is that they used to make it much harder to register, transfer and renew domains. So at some point even though I had a .co.uk and a .com I just stopped trying to transfer the .co.uk and let it lapse at the next renewal date.
@ Saturday, May 27th 2023 by changethe | Parentyeah you're right that some registries might have some weird quirks about certain things like transfers or additional mandatory requirements etc.
UK transfers are surely more complicated than they have to be (push vs. pull logic).
and I can also see where you're coming from, since in the UK it doesn't seem to be such a big thing.
but in most other non-english speaking countries (or even .com.au or co.nz), ccTLDs are actually a big trust factor. also for example high-end keyworddomains sell for a multiple of the respective .com domain price. sometimes as much as 5-10 times.
@ Saturday, May 27th 2023 by oaw-bct-ar-bamf | ParentGermany absolutely LOVES their .de TLD.
.de has more weight than .net or .com for most people in Germany.
@ Saturday, May 27th 2023 by seszett | ParentIt might be different for the UK, but as others have said ccTLDs in my experience are much preferred over .com. .com is basically used for generic US multinational companies, which means a handful of websites you care about but locally relevant sites are going to be .fr or .be for me.
.fr and .be are as easy to manage as any other TLD, and they have the advantage that you're probably not going to be price gouged as they are not run for profit.
@ Saturday, May 27th 2023 by Boltgolt | ParentA failure in the US maybe, but in countries like The Netherlands it's weird if a Dutch site does NOT have a .nl TLD
@ Friday, May 26th 2023 by TheFreim | ParentSame here, running little websites using a free hosting provider and a tk domain was a great experience.
@ Friday, May 26th 2023 by davchana | ParentI recently recovered password for my 2002 era davinder.8m.net free website. It is still hsoted all these 20 years for free.
@ Friday, May 26th 2023 by lathiat | ParentYes! My freeservers site from the same era (2000, when I was 15 ) is also somehow still alive. I don't have the password though. So I cannot fix the error haunting me for all time that I listed Generations as a TV series of Star Trek rather than a movie.
I'd love to know how/why they've managed to keep all of those alive so long. I am very appreciative but equally surprised.
@ Saturday, May 27th 2023 by belltaco | ParentStorage and bandwidth has gotten orders of magnitude cheaper since then so that might be part of it. Identifying and deleting inactive websites might have deemed to be more expensive than just letting them stay on.
@ Friday, May 26th 2023 by nine_k | Parent>the free domain name provider has a long history of ignoring abuse complaints about phishing websites while monetizing traffic to those abusive domains
If the way to have there things is defrauding others, then they are not as free as they seem.
I'd say that a third-level domain is fine for teenage projects; was fine for me even past teens.
@ Friday, May 26th 2023 by Beached | Parentcan you link me some free third level domain services that allow full control over all records? while I don't need it now, in the past I have wanted such a service and was unable to find them.
@ Friday, May 26th 2023 by VWWHFSfQ | Parentfor $8 a year you can get a regular domain and then have as many free 3rd level domains with full DNS control as you want. or do you really just mean free free
@ Friday, May 26th 2023 by TremendousJudge | Parentbased on the top level comment, I guess free free; something a child without a credit card can use on his own while playing around
@ Friday, May 26th 2023 by p1necone | ParentYeah, the refrain is usually "anyone should be able to afford $8 a year", but I remember being teenager and even when I was making an income I still couldn't get a credit card. It's less about the money and more about the ability to pay.
@ Friday, May 26th 2023 by 5e92cb50239222b | ParentYou don't really need credit cards, we found ways to pay for domains and hosting back in the day when we weren't legally able to get one (due to being minors). Some smaller companies accept other ways to pay that can be used anonymously. I definitely couldn't afford $8 a year thought, so others were covering that.
@ Saturday, May 27th 2023 by mminer237 | ParentEven if you can't get a credit card, most banks will give you a debit card at 13.
@ Saturday, May 27th 2023 by talhah | ParentNot in the part of the world I lived in, plus debit cards here work on local only sites whereas registrars are non-local.
@ Friday, May 26th 2023 by ajosh | ParentSitelutions.com still offers this. Without a paid account, the only limitation is the TTL.
@ Friday, May 26th 2023 by nine_k | Parent"All records" makes an important difference indeed. I mostly thought about web projects where you need A / AAAA and CNAME. I do remember that I had access to MX and TXT at some free provider around 1995; GeoCities? Can't remember.
@ Saturday, May 27th 2023 by Anunayj | ParentSo far I've only found https://nic.eu.org/ but it works, and I assume it's unlikely to go anywhere for the foreseeable future.
@ Saturday, May 27th 2023 by tinus_hn | ParentIt requires specific care because in the DOM security model, third level sites are all in the same security domain and can read each others cookies and control each others pages. The browsers have a special list with gov.uk, co.uk etc so it knows these are special.
That wasn't a concern in 2002 but today it should be.
@ Saturday, May 27th 2023 by ajsnigrutin | Parent>have a domain name in my early teens
yep, being a kid iterested in tech and having parents, that are not, is probably a huge pain... internet at home and a computer.. sure... giving your credit card info to your kid for some name on the internet? No way s/he's getting that.
Having a free option (and dynamic dns, and possibly even a free virtual machine somewhere) makes a lot of learning and experimenting possible for kids.
@ Saturday, May 27th 2023 by plugin-baby | Parent>giving your credit card info to your kid for some name on the internet?
I'd guess that in many cases, being interested in tech might make people _less_ likely to do this.
@ Friday, May 26th 2023 by obituary_latteNow I just wish Google would get googleusercontent.com and googleapis.com under control...
@ Friday, May 26th 2023 by caretoelaborate | ParentWhat's going on here?
@ Saturday, May 27th 2023 by abwizz | Parenti suspect that, in absolute numbers, most of spam and phishing and malware is homed there
@ Saturday, May 27th 2023 by iamacyborg | ParentThink of all the email spam you get from cold sales outreach.
@ Friday, May 26th 2023 by IMSAI8080Any phishing domain in my spam folder is NameCheap 9 times out of 10.
@ Friday, May 26th 2023 by eli | ParentIsn't it the biggest after godaddy?
@ Friday, May 26th 2023 by IMSAI8080 | ParentNo idea. It might just be they are lower priced than other places that attracts miscreants wanting domains in bulk.
@ Saturday, May 27th 2023 by TechBro8615 | ParentSo spammers are attracted to the same low prices and quality of services as anyone else? The subtext of this comment chain is a pretty weird take. The fact a domain is registered at Namecheap does not by itself make it any more likely to be a source of spam.
@ Saturday, May 27th 2023 by Emiledel | ParentWould you have evidence of this?
@ Saturday, May 27th 2023 by TechBro8615 | ParentYes, I have domains at Namecheap that don't host spam.
@ Saturday, May 27th 2023 by johndough | ParentI think it is more likely that spammers favor Namecheap because Namecheap ignores spam reports (at least mine). So far, I received the same kind of spam from ~500 of their domains.
@ Saturday, May 27th 2023 by KomoD | ParentIn my experience they handle abuse amazingly, suspended within 30min most of the time
@ Saturday, May 27th 2023 by zinekeller | ParentIt was just a relatively recent development in large part due to Facebook (https://domainnamewire.com/2022/04/25/meta-platforms-drops-l...), after this settlement the response to abuse reports did markedly improve.
@ Saturday, May 27th 2023 by KomoD | ParentThey've handled abuse great for me, even before that
@ Saturday, May 27th 2023 by TechBro8615 | ParentWhat kind of evidence do you need to provide when reporting spam to a domain registrar? Could I get your domain banned by spoofing spam emails and sending screenshots of them to Namecheap?
@ Saturday, May 27th 2023 by KomoD | ParentScreenshots are not enough, they ask for eml
@ Saturday, May 27th 2023 by TechBro8615 | ParentCan't that still be pretty trivially faked?
@ Saturday, May 27th 2023 by KomoD | ParentNot too sure, not sure of the process how they validate it
@ Sunday, May 28th 2023 by IMSAI8080 | ParentThat wasn't the intent of the comment. The original article was suggesting Freenom was popular with spammers. I was adding my observation that it has often been Namecheap that is prolific in my spam folder. We then go on to discuss why that may be.
@ Friday, May 26th 2023 by paulpauperIt's funny how meta actually takes spam somewhat seriously, unlike google.
@ Friday, May 26th 2023 by rayval | ParentYes, Google launching .ZIP and .MOV domains is yet another sign of the moral rot at a once ethical company.
@ Friday, May 26th 2023 by acheron | Parent"Once ethical"? How far back do you have to go for that? 1999?
@ Friday, May 26th 2023 by yjftsjthsd-h | ParentI dunno, I feel like you could make that case right up until they merged with doubleclick.
@ Friday, May 26th 2023 by stonogo | ParentYou could, but you cold make it the other way too.
@ Friday, May 26th 2023 by 100721 | Parent~~Do no evil.~~
@ Monday, May 29th 2023 by arsome | ParentPersonally I find .com and .sh to be much worse as it refers to actual executable files.
@ Friday, May 26th 2023 by amerkhalid | ParentI was about to order something from a website that showed as first page result on Google Search.
Spending couple of minutes on the site, it became obvious that it is a scam website. Confirmed further by another search on domain. I wanted to report it but there is no easy way to report this. So I gave up and hope no one falls for it.
: https:// littletikes . savemoney . store
@ Friday, May 26th 2023 by eli | ParentYou can report phishing sites really easily here https://safebrowsing.google.com/safebrowsing/report_phish/...
Or alternatively report an abusive google ad here
@ Friday, May 26th 2023 by paulpauper | ParentAnd likely nothing will happen.
@ Friday, May 26th 2023 by BenjiWiebe | ParentYmmv but I've got very good results reporting websites to Google safe browsing and them getting blocked.
@ Friday, May 26th 2023 by jeroenhd | ParentEvery third of fourth technical Google search I try lists about 10 to 20 fake sites. Many of them using .it for some reason, but there are plenty of other TLDs with this problem as well. At this point I'll click a .biz before I click a .it.
I'm not going to report hundreds of domains every month. Google needs to get their crap together.
The same is very much true for other parts of Google as well. Youtube comments are hilariously full of spam. There's a pretty good tool out there to get rid of the spam, which just runs the comments through a basic spam filter, but for big channels you can't let the tool run for too long because of API call limits.
@ Friday, May 26th 2023 by amerkhalid | ParentThank you, I tried to report it from the search page. I clicked on the 3 dots menu. The options were not perfect for this kind of scam reporting but I selected something close enough. Then it took me to another page where there was a huge form to fill out.
It should be easier to report scams or phishing sites from search page, imo.
@ Friday, May 26th 2023 by Thoreandan | ParentGoogle's ignoring spam is especially egregious through side channels, e.g. spammers adding you to Photos message shares.
@ Friday, May 26th 2023 by herbst | ParentThis is super annoying. I get mentioned in random documents all the time... No idea why
@ Friday, May 26th 2023 by kevin_thibedeau | ParentI've had people open up Facebook and Instagram accounts using my email address. They don't bother with requiring verification to use their services. Before I took over the accounts I'd get periodic notices about "friend" activity but never a nag to verify the e-mail.
@ Saturday, May 27th 2023 by ipaddr | ParentDon't they verify by phone number these days
@ Saturday, May 27th 2023 by KomoD | ParentUnless it happens on their own platform, then they dont care
@ Friday, May 26th 2023 by nubinetworkI wish they would do .cc next. I see a lot of spam from them on my personal mailboxes. Followed by all those google gtlds.
@ Saturday, May 27th 2023 by ipaddr | ParentHoping for .facebook and .google
@ Friday, May 26th 2023 by throwawayadvsecNote: they "stopped phishing" by basically forbidding almost anyone from registering a domain, I've been trying to get a new domain there for months without success
@ Friday, May 26th 2023 by GordonS | ParentExisting domains stopped working too, I lost the one I've been using for 10+ years :(
The most annoying part is there has been zero communication from Freenom - not a single email. They also never replied when I asked what was going on.
@ Saturday, May 27th 2023 by matoro | ParentThis is the real answer, I have a paid domain and am still unable to get contact or transfer off (I have attempted this with all known registrars that support .tk, Freenom simply fails to respond to the transfer request)
@ Saturday, May 27th 2023 by Spivak | ParentI mean that's basically the point. The barrier to entry of $10/yr and breaking anonymity is enough to price out bad actors.
If anyone at all has a way to combat this stuff that doesn't rely on "bad actors need disposable identities to get around blocks and don't usually have money" will basically win the internet.
@ Monday, May 29th 2023 by throwawayadvsec | ParentLLM?
@ Friday, May 26th 2023 by thayneThe title is a little deceptive. From near the end:
>Unfortunately, the lawsuits have had little effect on the overall number of phishing attacks and phishing-related domains, which have steadily increased in volume over the years.
>Piscitello said despite the steep drop in phishing domains coming out of Freenom, the alternatives available to phishers are many.
@ Friday, May 26th 2023 by NextgridFacebook is playing double-standards here.
They are knowingly allowing card fraud and other cybercrime groups to operate openly on there. We're not talking about criminals that use the platform while trying to appear sneaky and flying under the radar - we're talking about groups outright advertising their wares in the group name: https://krebsonsecurity.com/2018/04/deleted-facebook-cybercr...
>Some had existed on Facebook for up to nine years; approximately ten percent of them had plied their trade on the social network for more than four years.
>KrebsOnSecurity's research was far from exhaustive: For the most part, I only looked at groups that promoted fraudulent activities in the English language. Also, I ignored groups that had fewer than 25 members. As such, there may well be hundreds or thousands of other groups who openly promote fraud as their purpose of membership but which achieve greater stealth by masking their intent with variations on or mispellings of different cyber fraud slang terms.
I have my own personal experience with this. I came across a page promoting Snapchat (and maybe other services) hacking services that in exchange for a fee claimed it would email you the credentials of the target account, with plenty of obviously compromised accounts posting comments claiming it works. Obviously very illegal in the vast majority of jurisdictions, but the double whammy there is that the service was itself a scam.
Reporting the aforementioned group and a few of the fake comments yielded that none of this activity goes against their community standards.
@ Saturday, May 27th 2023 by shashashasha___ | Parenti love reading the comment in HN, not the articles. but this is a strange one.
>They are knowingly allowing card fraud and other cybercrime groups to operate openly on there.
i wonder if you believe yourself when you write stuff like that?
as if that company has a policy to allow fraud and cybercrime and they really believe its good for their business.
if you do... well... watch out from those black helicopters
@ Saturday, May 27th 2023 by Nextgrid | ParentYou don't need an explicit policy to allow it (putting it in writing would be stupid). There's plenty of ways to effectively allow it without saying it, like not encouraging/deprioritizing projects that aim to crack down on this kind of behavior, effectively turning a blind eye to the bad content without ever explicitly "allowing" it so they retain plausible deniability when confronted.
@ Saturday, May 27th 2023 by 8organicbitsWhat alternative options exist for low budget passion projects, toy projects, and the like? It's such a tough space to exist, trying to offer a free service while also combating spam.
The best list I'm seeing is: https://free-for.life/#/?id=domains
@ Saturday, May 27th 2023 by joemazerinoMaybe this is the way. I'm no fan of Meta but harping on lax domain setup controls might put the right pressure to lower malware installs.
Search Hacker News
Hacker News provided by Y Combinator and Algolia.
These pages best viewed with Netscape Navigator 1.1 or later.