Phishing threatens “.us” domain names

A recent study by the Interisle Consulting Group reveals that “.us” is one of the most commonly used country code top-level domains (ccTLD) by phishing websites. Of the six million phishing campaigns analyzed by the organization, 30,000 used a .us domain, the United States’ ccTLD.

European Union countries claim a significantly lesser rate of ccTLD fraud thanks to much more effective monitoring policies. A major ccTLD such as Germany’s .de thus hosts fewer fraudulent websites than .us, despite a larger market share.

“Ironically, at least 109 of the .us domains in our data have been used to attack the United States government, particularly the US postal service and its customers,” points out Interisle.

The US Trade Department delegates .us management to the National Telecommunications and Information Administration (NTIA). The latter itself outsources it to GoDaddy, the world’s largest domain registrar.

The use of .us normally requires verifying that the user is based in the United States and the website’s business is legitimate. In regard to the first concern, GoDaddy seems to only request a default statement upon domain name creation. Interisle is thus calling on the NTIA to set stricter standards for service providers.