Interesting domain theft statistic
In our discussions related to the Transfer Policy PDP, the issue of domain hyjacking and other nefarious actions has come up often, with some people claiming it is a major issue and others that it is not. I just cam across an interesting tidbit. If you register a domain with GoDaddy, one of the things that pops up (encouraging you to purchase a service from them) is the attached image. I have no idea where the statistic of 170,000 attempted domain thefts per year comes from. Alan
Many thanks Dr. Alan Greenberg. Realistic Possibility: If the domain is shifted to another registrar after getting stolen, can one do anything at all ? A case study: A domain was originally purchased in early 2011 from a US-based domain registrar. The company got in transition multiple times and got split in multiple child companies, a few acquisitions and again some split for country-wise branches during which this domain information got misplaced, rather lost. This flaw was exploited and somehow bought the domain and put it up on an auction. It took full 90 days to repair the damage. Sincerely, Gopal T V 0 9840121302 https://vidwan.inflibnet.ac.in/profile/57545 https://www.facebook.com/gopal.tadepalli PS: How much ever it is attempted to note down the information sources for authenticity, the gist gets used in academics. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Dr. T V Gopal Professor Department of Computer Science and Engineering College of Engineering Anna University Chennai - 600 025, INDIA Ph : (Off) 22351723 Extn. 3340 (Res) 24454753 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ On 2021-11-24 11:04, Alan Greenberg via CPWG wrote:
In our discussions related to the Transfer Policy PDP, the issue of domain hyjacking and other nefarious actions has come up often, with some people claiming it is a major issue and others that it is not. I just cam across an interesting tidbit.
If you register a domain with GoDaddy, one of the things that pops up (encouraging you to purchase a service from them) is the attached image.
I have no idea where the statistic of 170,000 attempted domain thefts per year comes from.
Alan _______________________________________________ CPWG mailing list CPWG@icann.org https://mm.icann.org/mailman/listinfo/cpwg
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
On 24/11/2021 05:34, Alan Greenberg via CPWG wrote:
In our discussions related to the Transfer Policy PDP, the issue of domain hyjacking and other nefarious actions has come up often, with some people claiming it is a major issue and others that it is not. I just cam across an interesting tidbit.
If you register a domain with GoDaddy, one of the things that pops up (encouraging you to purchase a service from them) is the attached image.
I have no idea where the statistic of 170,000 attempted domain thefts per year comes from.
It may be based on Godaddy's experience, Alan, It is the largest gTLD registrar on the web and owns a number of other registrars, brand protection registrars and ccTLD registrars. Like most of the larger registrar operators, it is a bit of an iceberg with a recognisable large brand on many other brands acquired through takeovers of other registrars and businesses over the years. Some of the mentions of stolen domain names that appear on the various domainer fora mention that their registrant's logins were compromised as part of the theft. This is often down to phishing e-mails sent to the registrant purporting to be from the registrar. High profile brand domain names are often on brand protection registrars and it is typically ordinary registrants and SMEs that are targeted. These are the people that the the 60 day transfer lock manages to protect. The ordinary registrant may not even know that ICANN exists or the process for reversing a domain theft. Some of the arguments on getting rid of the 60 day lock and the opt-in proposals on the Zoom meetings can only have come from being unaware of the issue domain name thefts. The registrants of domain names that are unused as e-mail domain names or developed websites may even be unaware that their domain name has been stolen until it is too late. Most of the time, the targets are high value domain names (short, keyword, short numerical and brand) that can be converted to cash by a quick resale on domain name auction/sales sites. By the time that the domain name has been resold, it can have moved through a number of registrars. The gTLD market may be more affected by domain name theft due to global market for most domain names and the ease with which the stolen domain name can be converted to cash. The ccTLD markets are much smaller in scale and some have a more complex transfer process with a pro-active single registry being the final authority. With ccTLDs, cybersquatting and trademark infringement may be larger problems. The worst case scenario is when a gTLD registrar gets compromised. As the Epik data breach demonstrated, this happens and there is often a scramble to secure affected domain names before they are transferred out. That 60 day lock is a failsafe. Regards...jmcc -- ********************************************************** John McCormac * e-mail: jmcc@hosterstats.com MC2 * web: http://www.hosterstats.com/ 22 Viewmount * Domain Registrations Statistics Waterford * Domnomics - the business of domain names Ireland * https://amzn.to/2OPtEIO IE * Skype: hosterstats.com ********************************************************** -- This email has been checked for viruses by AVG. https://www.avg.com
Here is an interesting case on how far some of these thiefs go to obtain valuable domains. https://domaingang.com/domain-crime/warning-tilt-com-is-currently-a-stolen-d... Also demonstrates having data public can be dangerous for your opsec. Best, Theo On Wed, Nov 24, 2021, at 10:38 AM, John McCormac via CPWG wrote:
On 24/11/2021 05:34, Alan Greenberg via CPWG wrote:
In our discussions related to the Transfer Policy PDP, the issue of domain hyjacking and other nefarious actions has come up often, with some people claiming it is a major issue and others that it is not. I just cam across an interesting tidbit.
If you register a domain with GoDaddy, one of the things that pops up (encouraging you to purchase a service from them) is the attached image.
I have no idea where the statistic of 170,000 attempted domain thefts per year comes from.
It may be based on Godaddy's experience, Alan, It is the largest gTLD registrar on the web and owns a number of other registrars, brand protection registrars and ccTLD registrars. Like most of the larger registrar operators, it is a bit of an iceberg with a recognisable large brand on many other brands acquired through takeovers of other registrars and businesses over the years.
Some of the mentions of stolen domain names that appear on the various domainer fora mention that their registrant's logins were compromised as part of the theft. This is often down to phishing e-mails sent to the registrant purporting to be from the registrar.
High profile brand domain names are often on brand protection registrars and it is typically ordinary registrants and SMEs that are targeted. These are the people that the the 60 day transfer lock manages to protect.
The ordinary registrant may not even know that ICANN exists or the process for reversing a domain theft.
Some of the arguments on getting rid of the 60 day lock and the opt-in proposals on the Zoom meetings can only have come from being unaware of the issue domain name thefts.
The registrants of domain names that are unused as e-mail domain names or developed websites may even be unaware that their domain name has been stolen until it is too late. Most of the time, the targets are high value domain names (short, keyword, short numerical and brand) that can be converted to cash by a quick resale on domain name auction/sales sites. By the time that the domain name has been resold, it can have moved through a number of registrars.
The gTLD market may be more affected by domain name theft due to global market for most domain names and the ease with which the stolen domain name can be converted to cash. The ccTLD markets are much smaller in scale and some have a more complex transfer process with a pro-active single registry being the final authority. With ccTLDs, cybersquatting and trademark infringement may be larger problems.
The worst case scenario is when a gTLD registrar gets compromised. As the Epik data breach demonstrated, this happens and there is often a scramble to secure affected domain names before they are transferred out. That 60 day lock is a failsafe.
Regards...jmcc -- ********************************************************** John McCormac * e-mail: jmcc@hosterstats.com MC2 * web: http://www.hosterstats.com/ 22 Viewmount * Domain Registrations Statistics Waterford * Domnomics - the business of domain names Ireland * https://amzn.to/2OPtEIO IE * Skype: hosterstats.com **********************************************************
-- This email has been checked for viruses by AVG. https://www.avg.com
_______________________________________________ CPWG mailing list CPWG@icann.org https://mm.icann.org/mailman/listinfo/cpwg
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
participants (4)
-
Alan Greenberg -
gopal＠annauniv.edu -
John McCormac -
Theo Geurts