Live data from Hacker News

Phishers Love New TLDs Like .shop, .top and .xyz

krebsonsecurity.com

31–40 of 220 posts

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#32
post #19
post #13

Earlier quoted context omitted.

There are lots of people called John Smith. They all want a domain name. There's only so many variations of jsmith, j-smith, etc you can squeeze into .com, .net, and a few others. Why shouldn't they be able to buy a domain name which contains their name? Is it useful to be able to differentiate between McDonald's the restaurant and McDonald's the legal firm and McDonald's garage? Why shouldn't each of those industrie…

>There are lots of people called John Smith. They all want a domain name. There's only so many variations of jsmith, j-smith, etc you can squeeze into .com, .net, and a few others. >Why shouldn't they be able to buy a domain name which contains their name? I fail to see how johnsmith[insert number here].com is any worse than johnsmith.[insert TLD here]. If anything a number is less likely to get mixed up than tlds, w…

Surely the number 14 is likely to get misheard as 40. And 13135432 is easily typo'd to 13134532.

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#33

The implication that gTLDs are bad and new ones shouldn't be introduced because of this is a bit silly to me. The argument that they somehow have lower registration requirements makes no sense, .shop .top and .xyz registrations involve the exact same amount of verification as .com (none). Prices aren't really that different and plenty of gTLDs are more expensive than traditional ones. Registering a domain is frustrat…

The lions share of issues with domains would go away if we made squatting illegal, or at the least, extremely expensive. Tbh I'm increasingly thinking that just about any speculative instrument in the economy is just grift and drag. If you want to make money, make things. Stop trying to extract rent or exorbitant prices for land, for domains, for PS5s, etc. Feels like 9/10ths of the economy now is nothing but fucking…

>The lions share of issues with domains would go away if we made squatting illegal, or at the least, extremely expensive.

How do you define squatting? Is the owner of nissan.com "squatting" on it because he wouldn't sell to the japanese car company? How much interest do you need in a given domain before it's not squatting?

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#34
post #8

Earlier quoted context omitted.

This would have me staying away from iMessage. What other content is Big Brother not transmitting for my "protection?"

This is actually why I moved off of Facebook Messenger. It started blocking random links I tried to send so I moved to something E2E encrypted.

Facebook Messenger is E2E encrypted now (though obviously that's not going to prevent the developer from blocking links unless the client is also open source).

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#35
post #33

Earlier quoted context omitted.

The lions share of issues with domains would go away if we made squatting illegal, or at the least, extremely expensive. Tbh I'm increasingly thinking that just about any speculative instrument in the economy is just grift and drag. If you want to make money, make things. Stop trying to extract rent or exorbitant prices for land, for domains, for PS5s, etc. Feels like 9/10ths of the economy now is nothing but fucking…

>The lions share of issues with domains would go away if we made squatting illegal, or at the least, extremely expensive. How do you define squatting? Is the owner of nissan.com "squatting" on it because he wouldn't sell to the japanese car company? How much interest do you need in a given domain before it's not squatting?

I would argue if you aren't doing some combination of:

- Hosting a website

- Operating email accounts

- Infrastructure (mail, DNS, etc.)

- Misc. Services (Minecraft server, TeamSpeak server, something)

Then you're squatting. Like if you own turkeyonapig.com and it's literally just a web page with a picture of a turkey sitting on a pig? Not squatting. It's odd but it's clearly doing exactly what it's meant to be doing. If you own turkeyonapig.com and are doing nothing but advertising that fact, and that someone can buy it? Squatting.

> Is the owner of nissan.com "squatting" on it because he wouldn't sell to the japanese car company?

I mean, it depends. One would argue that people going to nissan.com are clearly looking for the Japanese car company, so it's in the public's interest that that domain be sold to them. On the other hand, if someone owns it and is using to run a Nissan fan website? Well I suppose that's trickier, but that would also probably be better suited to something like nissanfans.com.

It's a tricky thing but not impossible to figure out.

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#36

The whole environment of the newer gTLDs just feels… gross. I rarely find a reputable business that is using anything but .com or .co.XX as the primary domain. Putting on my regular-person hat: When I see a billboard or print ad with e.g. `example.travel`, I read that as a social media handle and not a website address like `example.com` would convey. In public perception, dot com means websites. Always has. (Tangenti…

Really? what about countries that allow just .ccTLD?

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#37

Earlier quoted context omitted.

I think the issue is you can register a known company name on one of these and plenty of people will think it's legit. Companies have to register on all these random domain to protect themselves. dell.shop, that's probably the dell computer I know, right?

The people who would fall for that would probably also fall for `dell.computerdealshop.com` though

When a scam hits someone's inbox or text message, it finds them in a particular time in their life, in a particular state of mind, and in a particular context. It's not just about how gullible or uninformed or whatever they are. They may be tired, they may be drunk, they may be spending all their energy worrying about a sick relative, or trying not to.

They may have just been shopping for a computer, maybe even a dell. Or maybe they need a computer for their kid and don't have the means to afford one and are more likely to fall for a scam advertising a good deal on a computer than for any other scam.

These all add to the probability that someone falls for a scam. Phishing is all about casting a wide enough net that the probabilities align against some of the people you hit at the time you hit them.

Victims are not just uninformed. They are also compromised, and/or incentivized to believe this particular scam, and/or unlucky enough that the scam takes place when they were recently engaged in activity that makes the scam more believable.

Seeing dell.computerdealshop.com will snap a lot of people out of it where seeing dell.shop would not have.

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#38
post #33

Earlier quoted context omitted.

>The lions share of issues with domains would go away if we made squatting illegal, or at the least, extremely expensive. How do you define squatting? Is the owner of nissan.com "squatting" on it because he wouldn't sell to the japanese car company? How much interest do you need in a given domain before it's not squatting?

I would argue if you aren't doing some combination of: - Hosting a website - Operating email accounts - Infrastructure (mail, DNS, etc.) - Misc. Services (Minecraft server, TeamSpeak server, something) Then you're squatting. Like if you own turkeyonapig.com and it's literally just a web page with a picture of a turkey sitting on a pig? Not squatting. It's odd but it's clearly doing exactly what it's meant to be doing…

> a web page with a picture of a turkey sitting on a pig? Not squatting

GPT/Cursor will create that page for you in 5 min. I bet a NotSquattingAsAService startups will appear which will create the "not squatting" fake site for you for $2.

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#39
post #13
post #5

I have always thought the infinite proliferation of TLDs was a stupid idea. I'd be enlightened if I could think of one scenario that benefits from it outside of the registrars.

There are lots of people called John Smith. They all want a domain name. There's only so many variations of jsmith, j-smith, etc you can squeeze into .com, .net, and a few others. Why shouldn't they be able to buy a domain name which contains their name? Is it useful to be able to differentiate between McDonald's the restaurant and McDonald's the legal firm and McDonald's garage? Why shouldn't each of those industrie…

The only actual answer would have been to drain the TLD swamp and open up the root zone. Give us john.smith, website.jsmith, and mc.donalds. It's just a label anyway, and one that normies don't pay any attention to—save that even if they did, it's hard not to fall for mc-donalds.com or mcdonalds-restaurant.com anyway.

If the whole EV certificates thing would have been set up in a way that it wasn't just a money extraction racket, that would be the way forward. Let user agents convey whether a site is trusthworthy, and what entity it is connected to.

Re: Phishers Love New TLDs Like .shop, .top and .xyz

#40

Earlier quoted context omitted.

I would argue if you aren't doing some combination of: - Hosting a website - Operating email accounts - Infrastructure (mail, DNS, etc.) - Misc. Services (Minecraft server, TeamSpeak server, something) Then you're squatting. Like if you own turkeyonapig.com and it's literally just a web page with a picture of a turkey sitting on a pig? Not squatting. It's odd but it's clearly doing exactly what it's meant to be doing…

> a web page with a picture of a turkey sitting on a pig? Not squatting GPT/Cursor will create that page for you in 5 min. I bet a NotSquattingAsAService startups will appear which will create the "not squatting" fake site for you for $2.

I mean, that's an improvement in my mind over millions of insipid "BUY THIS DOMAIN!" web pages. At the least the internet would be more interesting?

But also like, then you aren't advertising it for sale. So I'm wondering how many offers you're going to get to sell that domain, which is the point of squatting it.

Post reply on HN