Domain name monitoring helps make the internet more secure in the Netherlands

Domain name monitoring

An increasing number of organisations in the Netherlands are recognising the security benefits of domain name monitoring, as evidenced by the growing demand for services in the .nl zone. In 2020, more than three hundred big organisations were monitoring the online use of their names, and the number continues to rise. SIDN BrandGuard performed 4.4 million domain name checks last year, identifying 30,000 phishing sites. While that's a small proportion of the ten million or so domain names registered in the Netherlands, the consistent detection of malicious sites does make cybercriminals more reluctant to use .nl for their activities. So, for example, a study in summer 2020 found that, although the number of domain names potentially registered for phishing had increased, the percentage of them that were actually put to malicious use was down. How can domain name monitoring have such a big impact?

Fraudsters go elsewhere

One reason for the effectiveness of monitoring is that cybercriminals often select their 'markets' at the global level and have various activities to choose from. If one country is doing a lot to clamp down on a particular form of cybercrime, the scammers go elsewhere or switch to other forms. The targeting of industries and organisations works in much the same way: if an organisation has its house in order and actively tackles abuse, cybercriminals will usually look for softer targets. And that will often lead them to organisations that don't expect to be hit. In recent years, for example, an increasing number of manufacturers and wholesalers largely unknown to the general public have fallen victim to domain name fraud.

Improved response

Of course, there's more to tackling domain name abuse than detection. The way detected issues are dealt with is also important. Awareness of and willingness to use the many available extrajudicial mechanisms, such as the Notice and Take Down Procedure, are growing. And a lot of the mechanisms concerned have been made more effective. For example, in 2019, we upgraded the procedure for verifying registrant data, so that business domain names used for malicious activities can now be disabled within five days.

COVID-19 and the first lockdown

Domain name monitoring can have substantial social benefits as well. During the first lockdown, we started proactive monitoring for malicious registrations linked to COVID-19. That led to various fake webshops offering face masks and the like being taken down. At the peak, our automated detection systems were flagging up more than two thousand suspicious registrations a month.

Small effort, big impact

Domain name monitoring isn't difficult. Any organisation can do some form of monitoring, whether that's on an independent, occasional basis or professionally, using specialist tooling. So a relatively small effort can have a major impact on the nation's internet security.