Home / Blogs

New gTLDs: Floodgates for Spammers?

Ever since I heard of the new generic Top-Level Domains (gTLDs), I wondered whether they would be prone to abuse. For example, Microsoft might want to register www.microsoft.microsoft, or Sony might want to register www.sony. But isn’t this opening up the floodgates for spammers to register their own domains and squat on them? Why couldn’t a spammer register www.cit.ibank? They could then send phishing messages and fool people into clicking very legitimate looking domains.

But I don’t think this will be a problem. One reason I say this is because the process of getting your own personal gTLD is going to be a pain and it won’t come cheap. For one thing, it will cost over $150,000 (forget the exact number, is it $185k?) to get your own domain names. Spammers need to be able to register their domains as quickly as possible for the lowest cost. They open them up, send a spam run, get blocked, and move on. They register them, send a spam run, get blocked, and move on. They need to do this in volume because they have to churn through domains (register and discard) so quickly in order to stay ahead of spam filters. Doing this means that domain acquisition must be cheap.

If each domain costs them $150,000 or more, this would very quickly disintegrate their earnings potential. They cannot afford to spend so much money rotating through personalized domains. 100 domains is $15 million. Spammers make a good deal of money, but spending that much money on domains is tantamount to financial suicide (perhaps they should go work for AIG or Citigroup). A spammer who started doing this, even for one domain, would experience buyer’s remorse very quickly. They wouldn’t need companies like Microsoft to sue them out of business, they’d do it to themselves in short order.

The second reason I doubt spammers would abuse this is because approval of customized domains is a manual process, at least at first. Not only would domain acquisition be expensive, it would also be time consuming. Spammers need to churn through domains quickly, they cannot afford to wait through long vetting processes like a confirmation hearing before they finally get a yea/nay decision.

We already have a model in place for how manual vetting cuts down on abuse. When the Chinese government stopped permitting people to sign up for .cn domains automatically and submit written applications and have them reviewed by the government, the abuse of .cn plummeted. Privacy advocates cried foul but there’s no denying that ever since the Chinese started de-automating the approval process, we see much less spam and malware links with a .cn link. Thus, if ICANN does manual review of these personalized domains, this also interferes with the spammer business model.

I think that these types of domains will be neat but I wonder who will actually use them. Will Coke, Pepsi, and Microsoft start using them as their main sites? Will www.microsoft replace microsoft.com? One thing to remember is that the .com or .org TLDs are culturally synonymous with the Internet. The .info, .biz, and .us never really took off. They’re around but let’s face it: if you have a .net domain, it’s because you couldn’t get the .com registered. People know that, and if you have a .net or .biz you’re kind of lame (admit it). The .com is waterfront property, and the others are the cheap knockoffs. Yeah, they function, but they are not where it’s at.

I can see large companies registering the domains but not using them, either. They will send material to their users, but then their users will get confused. The support desks will be flooded with requests like this:

“Where’s facebook.com?”

“Oh, it’s now my.facebook!”

“Huh?”

“Type my.facebook into your browser?”

“Oh, my.facebook.com?”

“No, my.facebook. That’s it.”

“Where do I put the .com?”

“No, you don’t need .com anymore, just my.facebook!”

“I know, but where does the .com come in?”


People are already trained to understand that the language of the Internet is .com, it’s a meme that has permeated society. Yeah, a personalized domain might look cool, but the people who can afford it will probably have to revert back to the user experience, and users will continue to use and recognize the .com. If you want to make money, don’t confuse your users!

I could be wrong about that. But I doubt it.

NORDVPN DISCOUNT - CircleID x NordVPN
Get NordVPN  [74% +3 extra months, from $2.99/month]
By Terry Zink, Program Manager

Filed Under

Comments

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

Related

Topics

Cybersecurity

Sponsored byVerisign

IPv4 Markets

Sponsored byIPv4.Global

Brand Protection

Sponsored byCSC

New TLDs

Sponsored byRadix

Threat Intelligence

Sponsored byWhoisXML API

Domain Names

Sponsored byVerisign

DNS

Sponsored byDNIB.com