Laura
The internet is an incredible tool that has revolutionized the way we communicate, work, and live. However, like any powerful tool, it can also be used for harm. One of the ways that malicious actors can exploit the internet is through the abuse of top-level domains or TLDs. These TLDs are the highest level in the hierarchical structure of the Domain Name System (DNS), which is the backbone of the internet – and with nearly 1600 available extensions, those who leverage domain names for abuse have a lot of choice.
Unmasking TLD Abuse: Unveiling the Threats Lurking Behind Domain Extensions
TLD abuse is a serious issue that can have far-reaching consequences for internet users. At its core, TLD abuse occurs when top-level domain registries allow registrars to sell high volumes of domains to professional spammers and malware operators.
The topic of domain name abuse has recently come back into the spotlight with Google Registry’s release of .zip and .mov. These new TLDs have sparked concern and debate amongst security experts1, with a range of opinions about how serious a threat they pose. The reason for concern is that both .zip and .mov are already widely used and recognized primarily as file extensions for archive and video files, respectively. This can cause confusion where these TLDs are displayed in emails, on social media, and elsewhere. Bad actors can take advantage of this ambiguity by registering domain names that are likely to be used by other people to casually refer to a file name, increasing the likelihood of a clickthrough response.
However, it’s not just tricky or newly launched TLDs that pose a risk, in fact, the domain extensions we are all most familiar with see the highest levels of abuse by bad actors. According to a report by PhishLabs, nearly 50% of all phishing scams targeting enterprises use the legacy gTLDs, such as .com, .org, and .net. Within this group, almost 40% of attacks exploit .com, making it the most widely used Legacy gTLD and the most abused overall2 – a high proportion being once used, expired .com’s picked up by scammers through aftermarket services.
These examples illustrate the serious nature of TLD abuse and the need for measures to prevent it. By being aware of the risks and taking steps to protect ourselves, we can make the internet a safer place.
The Underbelly Exposed: What Are the Most Abused TLDs
The Spamhaus Project is an international organization that tracks spam and related cyber threats. They maintain a list of the top 10 most abused TLDs, which is updated regularly based on their data.
According to Spamhaus, Top Level Domain registries that allow registrars to sell high volumes of domains to professional spammers and malware operators essentially aid and abet the plague of abuse on the internet. Unfortunately, not all registrars are equally vigilant where commonly abused domain extensions are concerned. The registration of frequently abused TLDs is also often aided by race-to-the-bottom pricing promotions that allow commonly abused domains to be bought for a few dollars, increasing the likelihood of abuse. At Webnames.ca, we have a team of experts that watch for this sort of malicious activity. We want to be part of the solution, not part of the problem, which is why our we have system alerts and human experts regularly reviewing for fraudulent activity, shutting it down immediately when detected to prevent these types of abuses where we can.
What Factors Increase the Likelihood of a TLD Being Considered “Bad”?
First off, no TLD is inherently bad in and of itself – it gets characterized as because of how it’s used or, more accurately, misused online. A TLD typically gets characterized as “bad” in two ways. When the ratio of so-called bad domains to good domains is higher than average within a TLD, this indicates that the registry could do a better job of enforcing policies and shunning abusers. However, some TLDs with a high fraction of bad domains may be quite small, and their total number of bad domains could be relatively limited with respect to other, bigger TLDs. Their total “badness” (an index used by Spamhaus) to the internet is limited by their small total size.
Dt is the number of active domains observed
Moreover, some large TLDs may have many bad domains as a result of the sheer size of their domain corpus. Even if their corrective measures are effective, they still constitute a problem on the global scale, and they could assign further resources to improve their anti-abuse processes and bring down the overall number of bad domains.
At the date of publication, The Spamhaus Project lists the following as the top 10 most abused TLDs3:
- .rest – 3.95 on the badness index
- .boston – 3.48 on the badness index
- .wiki – 2.80 on the badness index
- .degree – 2.32 on the badness index
- .cyou – 2.16 on the badness index
- .top – 2.03 on the badness index
- .live – 1.95 on the badness index
- .wtf – 1.84 on the badness index
- .name – 1.69 on the badness index
- .beauty – 1.41 on the badness index
These TLDs have been found to have a high ratio of bad domains and are particularly vulnerable to abuse.
Unleashing Chaos: The Potentially Devastating Impact of TLD Abuse
The impact of TLD abuse reverberates throughout the internet ecosystem, leaving a trail of destruction in its path. The consequences of this abuse can be far-reaching and deeply impactful, affecting users, businesses, and the overall health of the internet. Delving into negative ramifications of TLD abuse can help netizens stay cognizant of the cyberthreat landscape. Here are some of the many ways that TLD abuse can impact everyone:
Spamming
One of the most visible and pervasive consequences of TLD abuse is the proliferation of spam emails. Cybercriminals exploit compromised TLDs to inundate unsuspecting users’ inboxes with unsolicited messages, advertising dubious products and services. This flood of spam not only disrupts productivity, but also poses risks of falling victim to scams or inadvertently downloading malware.
Phishing
TLD abuse provides fertile ground for phishing campaigns, where attackers masquerade as trusted entities to trick individuals into revealing sensitive information such as passwords, credit card details, or social security numbers. By exploiting TLDs that resemble legitimate domains, cybercriminals take advantage of human trust and ingenuity, causing financial losses, identity theft, and profound personal and corporate harm.
Malware Distribution
Abused TLDs often serve as conduits for the distribution of malware, including viruses, ransomware, and spyware. By embedding malicious code within websites or deceptive downloads, cybercriminals exploit TLDs to unleash devastating attacks on unsuspecting visitors. The consequences range from data breaches and financial loss to system compromise, hampering the stability and security of networks and devices.
Reputation Damage
The abuse of certain TLDs tarnishes the reputation of not only those specific domains, but also the entire online community. When users encounter high volumes of malicious content, spam or other fraudulent activities associated with particular TLDs, trust erodes, casting a cloud of skepticism over legitimate websites and businesses operating within those domains. The resulting loss of credibility affects both individual entities and the overall perception of the internet as a reliable platform.
Economic Impact
TLD abuse can impose significant economic burdens on businesses and individuals. Companies must invest substantial resources in combating spam, phishing attacks, and malware distributed though abusive TLDs. Moreover, the financial repercussions of falling victim to online scams or data breaches can be devastating, resulting in monetary losses, legal liabilities, and reputational damage.
User Distrust and Disengagement
When users constantly encounter abuse within TLDs, their trust in the internet as a whole erodes. This can lead to heightened skepticism, reduced engagement, and decreased willingness to explore new websites or engage in online transactions. Ultimately, TLD abuse hampers user confidence, stifling innovation and hindering the growth of the digital economy.
Fortifying the Defenses: Strategies for Protecting Yourself
With TLD abuse becoming a growing problem, it is important to take proactive measures such as using domain-based threat intelligence and following best practices for online security. Domain-based threat intelligence is a powerful tool that can help identify and block malicious domains before they can cause harm. By analyzing domain names and their associated infrastructure, it is possible to identify patterns and characteristics that are indicative of malicious activity. This type of intelligence can be used to identify domains that are being used for phishing attacks, malware distribution and other types of cyber threats.
In addition to this, there are measures that can be taken by registries, registrars, and other stakeholders to prevent TLD abuse. These include implementing policies that require registrants to provide accurate contact information and verifying that what is provided is legitimate. Registries can also monitor their TLDs for abuse and take action against malicious domains.
It is important to note that TLD abuse is a complex issue that requires collaboration between various parties including registries, registrars, law enforcement agencies and security researchers. By working together, it is possible to prevent TLD abuse and protect the internet from this particular cyber threat.
Empowering A Safer Online Future
While the manipulation and misuse of top-level domains cast a long shadow over the digital realm, the unveiling of this menace is not meant to be disheartening or defeating. Instead, it serves as a rallying cry for a call to action, a reminder that we have the power and responsibility to protect and fortify the internet we all rely on.
The battle against TLD abuse requires a collective effort. Domain registries must implement stringent policies and practices to mitigate abuse, closely monitoring domain registrations and take swift action against bad actors. Collaboration between law enforcement agencies is crucial for sharing intelligence, developing proactive strategies and dismantling abusive networks.
Equally important is raising awareness among internet users. Education about TLD abuse, its consequences, and best practices for online safety empowers individuals to navigate the digital world with caution and vigilance. By recognizing the warning signs of spam, phishing, and other fraudulent activities, users can become the first line of defense, safeguarding their personal information and reporting suspicious activity.
Regulatory bodies and policymakers also play a vital role in establishing frameworks that address TLD abuse. Stricter regulations, increased accountability, and international cooperation are essential for combatting cross-border abuse and ensuring a safer online environment.
Furthermore, technological advancements and innovations have a pivotal role to play in preventing TLD abuse. Continued development of sophisticated algorithms, machine learning, and artificial intelligence can bolster the identification and swift mitigation of abusive domains, reducing their impact on the internet.
The dark side of TLD abuse may seem formidable, but it is not insurmountable. By joining forces and taking proactive measures, we can all fortify the integrity of the internet, preserve trust, and create a safer digital space. Using reputable domain registrars, like Webnames.ca, is one way to mitigate this risk. We offer various security features, such as domain privacy protection, SSL certificates, and email security, to help protect your website from cyber threats and ensure that your website visitors are safe. If you subscribe to our blog, we regularly update you with cybersecurity tips, threats to look out for, and how to keep your data safe.
By working together in reporting abuses and recognizing potential threats we can build a future where TLD abuse becomes a relic of the past.
arstechnica.com. “Google pushes .zip and .mov domains onto the Internet, and the Internet pushes back.” arstechnica.com, 18 May 2023.
phishlabs.com. “Top 10 TLDs Abused.” phishlabs.com, 14 September 2021.
spamhaus.org. “The Top 10 Worst: The World’s Most Abused TLDs.” phishlabs.com, 25 May 2023.