Speed vital in the fight against phishing

Prevention is much better than cure

Phishing sites are active for an average of just 21 hours. That's the length of time between the first visit by a potential victim and the last. The reason such sites don't stay up for longer is that they're typically detected by anti-phishing organisations within about eight hours. However, the domain name used for a phishing site will often be registered a few days before the site itself goes live. Active monitoring for malicious registrations therefore opens the way for intervening before the first abuse reports arrive, thus preventing a great deal of harm. The report's authors conclude: "Domain name registrars and registry operators can prevent and mitigate large amounts of phishing by finding and suspending maliciously registered domains."

Proactive intervention

As well as delivering real-time reports on potentially abusive .nl registrations, SIDN BrandGuard can keep you informed about domain names registered under other TLDs. Real-time reporting involves immediately flagging up every registration of a suspected (typo-) domain name very similar to the name of your organisation or brand, thus enabling proactive intervention. In practice, however, many organisations are reluctant to act against suspect websites. The reason being that, at the time of registration, there is often no evidence of abuse. The domain name in question may be so similar to the name of a prominent bank or high street shop as to be a clear trademark infringement, but there's no evidence of malicious use.

Invisible but harmful

Unfortunately, a domain name that initially gives no cause for concern may in fact be a major threat. It might, for example, already be in use for mail distribution in connection with social engineering or other malicious activities. Or a domain that seemed harmless may suddenly spring into life with a phishing site and a massive spamming operation. And that can cause serious damage to a brand, a brand owner and its customers. Early intervention, or at least attentive monitoring of suspicious registrations, is therefore advisable.

Defensive registrations

Within reason, defensive registrations can also help. We suggest registering obvious typo-versions of your domain name and taking action against third parties who infringe your trademark with such registrations. The introduction of autocomplete functionality and other browser enhancements, coupled with advances in firewall technology, have reduced the need for large-scale defensive registration. However, a selective approach based on common typos, plus redirects to your homepage, can provide cost-effective protection.

Openness

Finally, be open about what domain names you use, and make sure they all have SSL certificates. If it ever does come to light that your name's being abused for phishing, tell the Fraud Help Desk. Tell your customers as well, so they can make informed decisions if they get suspect mail.

Want to know more about domain name monitoring? Check out the details of SIDN BrandGuard.